Getting openvpn client to forward all traffic through server

Question

I am trying to set up an openvpn server and client, with all client traffic being routed through the server. I am currently able to access the server through the client, but when I enable 'push "redirect-gateway def1"' on the server, the client loses all ability to connect to the internet, vpn or otherwise. In addition, it can no longer connect to the server, though lan connectivity is still fine. My server config file is:

local ***.***

port 1194

proto tcp

dev tun

ca ca.crt
cert server.crt
key server.key

dh dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway local def1"

keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log

verb 3

and here's the client:

client

dev tun

proto tcp

remote ***.*** 1194

resolv-retry infinite

nobind

persist-key
persist-tun

ca ca.crt
cert laptop.crt
key laptop.key

ns-cert-type server

comp-lzo

verb 3

On the server, I enabled ip forwarding and enabled routing via iptables:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

but the client is still not able to connect to anything on the VPN or the internet.

Answer 1

For reference, the relevant section of the HOWTO is here, though I suspect you've followed that.

The first thing I'd try is to remove the 'local', that is the command should be

push "redirect-gateway def1"

and not

push "redirect-gateway local def1"

The local flag only works if all of your clients are on the same subnet.

A couple of other things to be aware of are that DNS traffic is routed through the vpn so you won't be able to resolve addresses unless you've dealt with that. DHCP can also get forwarded though it doesn't look like that should happen in your case as you're using a routed not a bridged VPN, but might be worth checking anyway.

Answer 2

If you are "pushing" a new gateway to the client, then you also need to push some routes, in particular the route to the subnet where that gateway resides. That will give you internet access through the VPN. If the network where the gateway resides is different from the one where the VPN server lives, then you also need additional routes so that the client can access these other networks. Plus, you may then want to also push DNS servers to the client, because otherwise the client cannot resolve the names of any of the targets on the network it is now connected to.

Here is an extract from our OpenVPN server config file:

# Push route to client to bind it to our local
# virtual endpoint.
#
push "route 10.180.0.1 255.255.255.255"

# Push any routes the client needs to get in
# to the local network.
#
push "route 10.171.0.0 255.255.0.0"
push "route 10.172.0.0 255.255.0.0"
push "route 10.173.0.0 255.255.0.0"
push "route 10.174.0.0 255.255.0.0"
push "route 10.175.0.0 255.255.0.0"
push "route 10.176.0.0 255.255.0.0"
push "route 10.177.0.0 255.255.0.0"
push "route 10.181.0.0 255.255.0.0"
push "route 10.182.0.0 255.255.0.0"
push "route 192.168.61.0 255.255.255.0"

# Push DHCP options to Windows clients.
#
push "dhcp-option DOMAIN our-internal-domain.com"
push "dhcp-option DNS 10.a.b.c"
push "dhcp-option WINS 10.b.c.d"

These are all internal networks, and we don't even push a new gateway (as most of our users connect from far away, they are better off accessing the internet through their default gateway and we are not control freaks).

Answer 3

Actually, the problem was that NAT wasn't set up correctly. Fixed, and the vpn is working now.