I've set up an OpenVPN network, and it is working properly in the sense that I can access the inner/LAN machines from the remote client. However, my problem is that all traffic from the remote machines appears to the LAN machines as though it is coming from the OpenVPN server machine, and not from the client machine.
To Better explain, consider my network topology:
Machine R connected to the OpenVPN server on Machine A, and got assigned the IP address of 10.200.200.5.
Machine R then makes a request to Apache running on Machine B. The request arrives properly and I get a response. The problem is that Machine B sees the request coming in from 192.168.0.10 (Machine A's IP) and not 10.200.200.5.
I would like the latter.
My Current Setup
This is a snippet of the relevant iptables rules:
*nat :PREROUTING ACCEPT [18:1080] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -o eth0 -j MASQUERADE *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] // snip # accept incoming VPN connections -A INPUT -p udp -m udp --dport 1194 -j ACCEPT # forward VPN traffic -A FORWARD -s 10.200.200.0/25 -d 192.168.128.0/17 -i tun0 -j ACCEPT -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
I have also enabled ip_forwarding:
echo 1 > /proc/sys/net/ipv4/ip_forward
.. and made the appropriate changes to /etc/sysctl.conf to make it permanent.
In the OpenVPN configuration, I have:
server 10.200.200.0 255.255.255.128 push "route 192.168.0.0 255.255.255.0"
Since Machine A is not Machine B's gateway, I manually added a route on Machine B as follows:
ip route add 10.200.200.0/25 via 192.168.0.10 dev eth0
To test the which IP is being routed, I created a small PHP script called showip.php:
<?php echo "Your IP is: ", $_SERVER['REMOTE_ADDR'], "\n"; ?>
# wget -q -O - http://192.168.0.11/showip.php Your IP is: 192.168.0.10
How do I get it to say 10.200.200.5?
To clarify, in my particular case Machine A has one NIC (eth0) which serves both the LAN and WAN.