I have setup a small server with a bridged openvpn setup. My goal is use my network services and Internet connection from every location with Internet access. Right now I am just able to use services in my own network via the vpn. I looked into the option of a redirected gateway to force all traffic through the vpn. As soon as I activate this option I am not able to access the Internet, but for example my private owncloud setup in my local network. It would be really helpful, if someone could give me some advice. Thanks in advance.
GOAL:
Route all traffic of my Ubuntu-Laptop through my vpn.
Being able to access both internal as external services.
What I have already tried:
Push the DNS-settings through the vpn
Running various iptable commands with no effect
Where I think the problem is:
Even if I have already tried to configure the nat via iptable settings, I was never sure if I did it correct.
Server configuration
server.conf:
server-bridge
port 1194
proto tcp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
# server-bridge br0_address netmask clientlowerlimit clientupperlimit
server-bridge 192.168.0.100 255.255.255.0 192.168.0.101 192.168.0.120
# push "route subnet_identifier netmask router_address"
push "route 192.168.0.0 255.255.255.0 192.168.0.1"
# push "dhcp-option DNS router_address"
push "dhcp-option DNS 192.168.0.1"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
ifconfig-pool-persist ipp.txt
dh dh2048.pem
script-security 2
push "dhcp-option DNS 192.168.0.1"
push "redirect-gateway def1"
bridge script:
#!/bin/sh
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.0.21"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"
eth_gateway="192.168.0.1"
case "$1" in
start)
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done
sleep 10
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw $eth_gateway
;;
stop)
ifconfig $br down
brctl delbr $br
for t in $tap; do
openvpn --rmtun --dev $t
done
ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw $eth_gateway
;;
*)
echo "Usage: bridge {start|stop}"
exit 1
;;
esac
exit 0
Client configuration
client.conf:
client
dev tap0
proto tcp
#I use port 80 because it is nerver blocked
remote domain.org 80
persist-key
persist-tun
ca ca.crt
cert test.crt
key test.key
remote-cert-tls server
comp-lzo
verb 3
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
update-resolve-conf:
#!/bin/bash
#
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood and Chris Hanson.
# Licensed under the GNU GPL. See /usr/share/common-licenses/GPL.
#
# Example envs set from openvpn:
#
foreign_option_1='dhcp-option DNS 8.8.8.8'
foreign_option_2='dhcp-option DNS 192.168.0.1'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
#
[ -x /sbin/resolvconf ] || exit 0
[ "$script_type" ] || exit 0
[ "$dev" ] || exit 0
split_into_parts()
{
part1="$1"
part2="$2"
part3="$3"
}
case "$script_type" in
up)
NMSRVRS=""
SRCHS=""
for optionvarname in ${!foreign_option_*} ; do
option="${!optionvarname}"
echo "$option"
split_into_parts $option
if [ "$part1" = "dhcp-option" ] ; then
if [ "$part2" = "DNS" ] ; then
NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3"
elif [ "$part2" = "DOMAIN" ] ; then
SRCHS="${SRCHS:+$SRCHS }$part3"
fi
fi
done
R=""
[ "$SRCHS" ] && R="search $SRCHS
"
for NS in $NMSRVRS ; do
R="${R}nameserver $NS
"
done
echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"
;;
down)
/sbin/resolvconf -d "${dev}.openvpn"
;;
esac