0

I have openVPN running on a server which is also hosting a NGINX server.

When connecting and running via openVPN it will show the server's ip everywhere just fine, but when connecting to a domain that is running on NGINX on the same server it will show the real external ip of the client that is connected via openVPN.

I would like it to also route the traffic incoming to nginx to be routed via the server and then in a NGINX access log showing like either 127.0.0.1 or 10.x.x.x

I am using the following settings.

local 136.x.x.x   
port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
server-ipv6 fddd:1194:1194:1194::/64
push "redirect-gateway local def1 ipv6 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem

2 Answers 2

1

You can't - at least not with the method you're using.

The problem is that you're playing with the traditional routing tables of operating systems - and they're not designed for this specific scenario.

When OpenVPN connects and is told to redirect 0.0.0.0/0 over the VPN, it has to add a route to reach the VPN server. This route is /32 with next hop the local gateway, the most specific possible route.

A specific route always wins over a less specific route, so all traffic destined for will use this route.

There's broadly speaking two ways to solve this issue:

  1. Provide split horizon DNS, so that users of your VPN gets a RFC1918-IP for the webserver, and thus goes over the tunnel.
  2. Use some sort of policy based routing on the client. On Linux this can be namespaces for instance.
-1

I had a very similar setup with openvpn on the same ubuntu 20.04 machine as an nginx server. (If I enable NAT loopback for all on my router, normally have it for forwarded ports only...) Strangely my nginx logs show that the routers ip connecting using openvpn for android for everything but a single WebSocket connection where the real external ip is shown. Connecting using windows 10, same config, the real external ip is always shown when connecting to my site.

I solved it by changing vpn - wiregaurd, with seemingly (i'm no expert) pretty much the same IP tables rules works fine. Local ip is always shown, windows or android. It's faster too, or at least in my testing. Shame it messes up WSL2 routing (unlike the openvpn client)....not a massive deal, but annoying and another story...

EDIT split DNS worked for openVPN in the windows client for everything but the WebSocket connection which still showed as the real ip. In my case using dnsmasq it was a simple one line added to the dnsmasq config:

address=/www.example.com/local.ip.of.nginx-server

Finally to get the websocket connection to show the local ip I had to change the ssl_stapling resolver in my nginx config to the local dnsmasq server (i had it previously set Cloudflare's dns).

2
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. To get notified when this question gets new answers, you can follow this question. Once you have enough reputation, you can also add a bounty to draw more attention to this question. - From Review
    – djdomi
    Nov 4, 2021 at 17:52
  • Very true it doesn't. I'm happy for it to be removed. The hope was the extra info about the real IP shown only on a web socket connection on different clients would point someone more knowledgeable in the right direction. If the aim of the question was to connect to a Vpn on the same network as an nginx sever without showing the real IP then wiregaurd will solve the issue. Beyond me as to why I'm afraid :)
    – Adam84
    Nov 5, 2021 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .