No internet access when toggling `redirect-gateway` in OpenVPN client config

Question

I have a router with IP 192.168.1.1 subnetting 192.168.1.0/24.

On that subnet, a Synology NAS has an IP of 192.168.1.181 and is running a VPN server using subnet 192.168.2.0/24.

When I connect a client to that server from outside both networks, I get assigned 192.168.2.6. From that client I can ping machines on 192.168.1.0/24 (192.168.1.17 & 192.168.1.181 for example) and 192.168.1.1 & 192.168.2.1.

From machines already on 192.168.1.0/24, I can ping the VPN client (192.168.2.6) after adding a static route of route add 192.168.2.0 mask 255.255.255.0 192.168.1.181 (windows).

Before adding the redirect-gateway line to the client config, I would be able to access the internet while on the VPN but was unable to access local web services like a router service or the Synology NAS web service (running within 192.168.1.0/24). I thought this was maybe because the external IP (whatmyip.org) from a VPN client showed the same external address as if I was not connected to the VPN.

After adding the redirect-gateway line to the client config, I verified I had the correct external IP (matches the 192.168.1.0/24 clients external IP) when connected but could not access external sites (google.com) but could access internal web services (192.168.1.1's & 192.168.1.181's).

What am I missing?

---

Weird observation, not sure why but the client (192.168.2.6) gets a DHCP & gateway server of 192.168.2.5 which as far as I know, isn't anything that exists. I can't ping it. 192.168.2.1 is definitely the VPN server and I can access it's web service (192.168.1.181 on 192.168.1.0/24).

Connected client ipconfig /all:

Description . . . . . . . . . . . : TAP-Windows Adapter V9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.2.6(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Lease Obtained. . . . . . . . . . : Thursday, August 13, 2015 11:55:43 AM
Lease Expires . . . . . . . . . . : Friday, August 12, 2016 11:55:42 AM
Default Gateway . . . . . . . . . : 192.168.2.5
DHCP Server . . . . . . . . . . . : 192.168.2.5
DNS Servers . . . . . . . . . . . : 192.168.2.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Answer 1

You must make sure your router has an outbound NAT entry for the VPN 192.168.2.0/24 network and that DNS has been set.

See this: https://openvpn.net/index.php/open-source/documentation/howto.html

You must redirect the gateway: push "redirect-gateway def1"

Make sure the client has DNS set or push it with openVPN using push "dhcp-option DNS x.x.x.x"

The final step as mentioned above is that your router must have outbound NAT configured for your VPN network, otherwise you won't get out onto the internet.

Answer 2

Two main issues:

1. you've already discovered and that's the return route. This needs to be added to not just one system, but also your router.

2. you may need to also add a second internal network to your NAT list.

Another option would be to configure the Synology to NAT the VPN traffic inside the network so traffic for public internet appears to come from the synology, but you will not be able to easily access services on the VPN IPs from your LAN. Specify your router brand, or if possible move your OpenVPN config to the router for simpler setup.