1

I have the following network layout:

http://i.stack.imgur.com/eFWWD.png

Everything in blue is a VPN client (except the obvious server)

The my client side (which is the top side where it says "My Site"), If I include include "redirect-gateway", I can access the tunnel (all 10.10.10.x address and 172.16.a.b addresses) but I cannot access internet/LAN. Without it, I can't access the tunnel but I can access internet.

Server configuration:

port 1194
proto udp
dev tun
ca keys/comp-ca/ca.crt
cert keys/comp-ca/comp-svr.crt
key keys/comp-ca/comp-svr.key
dh keys/comp-ca/dh2048.pem
server 10.10.10.1 255.255.255.0
crl-verify keys/comp-ca/crl.pem
ifconfig-pool-persist servers/compSVR/logs/ipp.txt
cipher AES-128-CBC
user root
group root
status servers/compSVR/logs/openvpn-status.log
log-append servers/compSVR/logs/openvpn.log
verb 2
mute 20
max-clients 200
management 127.0.0.1 7505
keepalive 10 120
client-config-dir /etc/openvpn/servers/compSVR/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "route 192.168.2.0 255.255.255.0"
push "route 192.168.100.0 255.255.255.0"

Client configuration:

client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert clientlocal.crt
key clientlocal.key
remote 192.168.100.200 1194
cipher AES-128-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

ccd:

ifconfig-push 10.10.10.177 10.10.10.178
iroute 192.168.100.100 255.255.255.0
iroute 172.16.0.0 255.255.0.0
push "route 192.168.100.0 255.255.255.0"
push "route 172.16.0.0 255.255.0.0"

Also, I know that 192.168.100.200 is a local address so a VPN is pointless but I am connecting to my VPN server to test it locally.

I want to be able to access both the tunnel (and its subnets) and the internet at the same time. Like I mentioned using this configuration, once I connect to the server, I can only see the tunnel. Ive tried check the logs to see if there is anything there that can give me hints but nothing.

My client is a Windows 7 machine and the server is a Ubuntu. Im not sure if there are routes being passed that ruin connecting to the internet.

Here are some route examples:

No VPN:

0.0.0.0          0.0.0.0  192.168.100.100   192.168.100.73     10
        127.0.0.0        255.0.0.0      En vínculo         127.0.0.1    306
        127.0.0.1  255.255.255.255      En vínculo         127.0.0.1    306
  127.255.255.255  255.255.255.255      En vínculo         127.0.0.1    306
       172.16.0.0      255.255.0.0  192.168.100.100   192.168.100.73     12
     192.168.40.0    255.255.255.0      En vínculo      192.168.40.1    276
     192.168.40.1  255.255.255.255      En vínculo      192.168.40.1    276
   192.168.40.255  255.255.255.255      En vínculo      192.168.40.1    276
    192.168.100.0    255.255.255.0      En vínculo    192.168.100.73    266
   192.168.100.73  255.255.255.255      En vínculo    192.168.100.73    266
  192.168.100.255  255.255.255.255      En vínculo    192.168.100.73    266
    192.168.197.0    255.255.255.0      En vínculo     192.168.197.1    276
    192.168.197.1  255.255.255.255      En vínculo     192.168.197.1    276
  192.168.197.255  255.255.255.255      En vínculo     192.168.197.1    276
        224.0.0.0        240.0.0.0      En vínculo         127.0.0.1    306
        224.0.0.0        240.0.0.0      En vínculo      192.168.40.1    276
        224.0.0.0        240.0.0.0      En vínculo     192.168.197.1    276
        224.0.0.0        240.0.0.0      En vínculo    192.168.100.73    266
  255.255.255.255  255.255.255.255      En vínculo         127.0.0.1    306
  255.255.255.255  255.255.255.255      En vínculo      192.168.40.1    276
  255.255.255.255  255.255.255.255      En vínculo     192.168.197.1    276
  255.255.255.255  255.255.255.255      En vínculo    192.168.100.73    266

With "redirect-gateway":

0.0.0.0          0.0.0.0     10.10.10.114     10.10.10.113     31
       10.10.10.0    255.255.255.0     10.10.10.114     10.10.10.113     31
     10.10.10.112  255.255.255.252      En vínculo      10.10.10.113    286
     10.10.10.113  255.255.255.255      En vínculo      10.10.10.113    286
     10.10.10.115  255.255.255.255      En vínculo      10.10.10.113    286
        127.0.0.0        255.0.0.0      En vínculo         127.0.0.1    306
        127.0.0.1  255.255.255.255      En vínculo         127.0.0.1    306
  127.255.255.255  255.255.255.255      En vínculo         127.0.0.1    306
       172.16.0.0      255.255.0.0  192.168.100.100   192.168.100.73     12
      192.168.2.0    255.255.255.0     10.10.10.114     10.10.10.113     31
     192.168.40.0    255.255.255.0      En vínculo      192.168.40.1    276
     192.168.40.1  255.255.255.255      En vínculo      192.168.40.1    276
   192.168.40.255  255.255.255.255      En vínculo      192.168.40.1    276
    192.168.100.0    255.255.255.0      En vínculo    192.168.100.73    266
   192.168.100.73  255.255.255.255      En vínculo    192.168.100.73    266
  192.168.100.200  255.255.255.255  192.168.100.100   192.168.100.73     11
  192.168.100.255  255.255.255.255      En vínculo    192.168.100.73    266
    192.168.197.0    255.255.255.0      En vínculo     192.168.197.1    276
    192.168.197.1  255.255.255.255      En vínculo     192.168.197.1    276
  192.168.197.255  255.255.255.255      En vínculo     192.168.197.1    276
        224.0.0.0        240.0.0.0      En vínculo         127.0.0.1    306
        224.0.0.0        240.0.0.0      En vínculo      10.10.10.113    286
        224.0.0.0        240.0.0.0      En vínculo      192.168.40.1    276
        224.0.0.0        240.0.0.0      En vínculo     192.168.197.1    276
        224.0.0.0        240.0.0.0      En vínculo    192.168.100.73    266
  255.255.255.255  255.255.255.255      En vínculo         127.0.0.1    306
  255.255.255.255  255.255.255.255      En vínculo      10.10.10.113    286
  255.255.255.255  255.255.255.255      En vínculo      192.168.40.1    276
  255.255.255.255  255.255.255.255      En vínculo     192.168.197.1    276
  255.255.255.255  255.255.255.255      En vínculo    192.168.100.73    266

Without "redirect-gateway":

0.0.0.0          0.0.0.0  192.168.100.100   192.168.100.73     11
       10.10.10.0    255.255.255.0     10.10.10.114     10.10.10.113     31
     10.10.10.112  255.255.255.252      En vínculo      10.10.10.113    286
     10.10.10.113  255.255.255.255      En vínculo      10.10.10.113    286
     10.10.10.115  255.255.255.255      En vínculo      10.10.10.113    286
        127.0.0.0        255.0.0.0      En vínculo         127.0.0.1    306
        127.0.0.1  255.255.255.255      En vínculo         127.0.0.1    306
  127.255.255.255  255.255.255.255      En vínculo         127.0.0.1    306
       172.16.0.0      255.255.0.0  192.168.100.100   192.168.100.73     12
      192.168.2.0    255.255.255.0     10.10.10.114     10.10.10.113     31
     192.168.40.0    255.255.255.0      En vínculo      192.168.40.1    276
     192.168.40.1  255.255.255.255      En vínculo      192.168.40.1    276
   192.168.40.255  255.255.255.255      En vínculo      192.168.40.1    276
    192.168.100.0    255.255.255.0      En vínculo    192.168.100.73    266
   192.168.100.73  255.255.255.255      En vínculo    192.168.100.73    266
  192.168.100.255  255.255.255.255      En vínculo    192.168.100.73    266
    192.168.197.0    255.255.255.0      En vínculo     192.168.197.1    276
    192.168.197.1  255.255.255.255      En vínculo     192.168.197.1    276
  192.168.197.255  255.255.255.255      En vínculo     192.168.197.1    276
        224.0.0.0        240.0.0.0      En vínculo         127.0.0.1    306
        224.0.0.0        240.0.0.0      En vínculo      10.10.10.113    286
        224.0.0.0        240.0.0.0      En vínculo      192.168.40.1    276
        224.0.0.0        240.0.0.0      En vínculo     192.168.197.1    276
        224.0.0.0        240.0.0.0      En vínculo    192.168.100.73    266
  255.255.255.255  255.255.255.255      En vínculo         127.0.0.1    306
  255.255.255.255  255.255.255.255      En vínculo      10.10.10.113    286
  255.255.255.255  255.255.255.255      En vínculo      192.168.40.1    276
  255.255.255.255  255.255.255.255      En vínculo     192.168.197.1    276
  255.255.255.255  255.255.255.255      En vínculo    192.168.100.73    266

I think the issues have something to do with the route table (above) that is being passed to Windows.

  • It did not allow me to embed the image due to rep. – riahc3 Dec 2 '14 at 8:35
0

The first problem is that you are testing it on a local network segment 192.168.100.0/24 - it can be done but you run into problems with address conflicts. For example by default you reach the server 192.168.100.200 over the ethernet device but once you set up the VPN you redirect 192.168.100.0/24 into the tunnel with push "route 192.168.100.0 255.255.255.0".

The second problem is that the VPN server may not be configured to property forward the packets that come from the VPN with redirect-gateway. That's why you lose access to the local LAN and Internet - your packets arrive from client to the server but don't get forwarded.

I bet the solution is the same as here: OpenVPN not default gateway for all traffic - read the part about sysctl and iptables and let us know if it helped.

| improve this answer | |
  • About the first problem, I cannot reach the OpenVPN server via the local network, only thru its OpenVPN tunnel address. Fix for this? Second problem, I went ahead and applied everything stated in that answer (using 10.10.10.0/24) – riahc3 Dec 4 '14 at 9:03
  • Some more comments, as I wanted to address just what you said: Adding redirect-gateway autolocal to my Windows client's conf causes the following: I cannot access the OpenVPN via local network. I can access it via tunnel. I can access it thru the internet. I cannot access 172.16.x.x – riahc3 Dec 4 '14 at 9:03
  • Without it, basically the same thing happens. I think there are two things missing right now: Be able to access 192.168.100.200 and 172.16.x.x The first one I have no idea how to solve. The second one, if I manually add a route on my Windows client, it does work. How would I make this automatic? – riahc3 Dec 4 '14 at 9:09
  • I think the main issue is that for certain clients, it is NOT pushing that 172.16.0.0 route that I want... – riahc3 Dec 4 '14 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.