I would appreciate receiving a short-list of a few good web sites that point me to how to set up the following scenario. (You may assume that I am by-now quite familiar with OpenVPN in general.)
I want to set up one always-on (Macintosh, OS/X El Capitan,using "TunnelBlick") computer, within an in-house network, to act as a secure router to a remote network from any machine within the in-house network.
Here are my thoughts ... and questions ... so far:
First, the Mac must be set up (of course ...) so that it can, as a client, reach and connect to the remote system. (Assume that this has already been done.)
The Mac's on-board firewall will need to be turned off or modified to allow (in this case) HTTP and HTTPS traffic to be directed to it.
The physical router for the in-house network must have static routing rules which direct traffic to/from the remote-side IP addresses to first be directed to this Macintosh, as a "gateway."
(Now, my thinking gets fuzzy ...) The OpenVPN client running on this machine must somehow correctly handle those "multiple connections" as they are coming to it from various in-house IP addresses. Is this, in fact, a special case?
Here, for your edification, is an sanitized excerpt of the present client-side
config.ovpn file: (You may assume that it works, because it does.)
client dev tun0 proto udp remote 111.222.333.444 1194 pull resolv-retry infinite nobind ca ca.crt cert thisMacintosh.crt key thisMacintosh.key ns-cert-type server tls-auth ta.key 1 cipher AES-256-CBC comp-lzo verb 3
My question is specifically about employing this machine as a router which will act as a gateway for "any other machine on its local network."
- We are communicating with a server on the Internet at "some address." Let's say, for the sake of example, that it's
22.214.171.124. (Apologies to whoever's address that really is ...)
- One machine, "on the in-house network" say at
192.168.1.20, is to be acting as a router "the rest of the in-house network":
192.168.1.x. It will never need to be concerned with any other internal subnet.
- The secure network on the remote side has an IP-address range of (say)
- The Mac in question currently has the necessary OpenVPN software installed, using a
.confsimilar to the above, and it is now successfully communicating with the Internet host.
- ... so, all I need to do are "the last few steps." And therefore, to know what "those last few steps" are!
FYI: The "TunnelBlick" software of which I speak is simply a "really nice Macintosh-friendly wrapper" for OpenVPN. (Similar flavors also exist for Windows and so-on.) It takes care of, for example, making sure that OpenVPN will start every time this machine is rebooted, and other otherwise-meddlesome details. But it simply hosts the otherwise-normal OpenVPN process which handles the actual communication. Therefore, I believe that my questionings are "essentially generic to any OS," and that "my answer must be terribly easy."
You don't need to answer "in terms of
iptables," nor in terms of the actual equivalent commands that a Macintosh uses. (Unless you -want- to "speak Mac to me.") If you'll just help me grok what needs to be done, I can figure out what steps to take to persuade a Macintosh and the local hardware-router to do it.
Pages I have recently studied, and am continuing to study (especially the second one)
(Based on the second page, I have a now-murky gut feeling that what I need to do "has something to do with
iroute ... but that I could also be totally mistaken about that." (Does this client-machine "have the rest of the in-house network to which it belongs 'behind it?'" Or, "is it not-relevant (i.e. wrong), since all other machines that will be talking through this machine "are right here?") Ooh, so confused. That's why I'm now asking you kind folks!)
(When you post an answer, please also post a comment because I can see the presence of comments but I have not yet discovered how to get a list of "my recent questions ...")