Openvpn – How to set OpenVPN client to force traffic through VPN Server

openvpnvpn

The OpenVPN client and server are setup and run very well. However, the network traffic goes from client to VPN Server only for internal traffic (e.g. *.mydomain.com)

I have heard some setting on the server site that enable/disable all traffic or just internal traffic (otherwise the common network e.g. google.com will go through its existing network as of no VPN connection)

Is there any setting I can change on the client side to accomplish that as well?

Best Answer

Note entirely sure that this is what you are looking for, but you can force all client traffic through the VPN by setting the redirect-gateway def1-parameter.

Pushing the redirect-gateway option to clients will cause all IP network traffic originating on client machines to pass through the OpenVPN server.

More information in the official how to: https://openvpn.net/index.php/open-source/documentation/howto.html#redirect

Related Solutions

Openvpn – Getting openvpn client to forward all traffic through server

For reference, the relevant section of the HOWTO is here, though I suspect you've followed that.

The first thing I'd try is to remove the 'local', that is the command should be

push "redirect-gateway def1"

and not

push "redirect-gateway local def1"

The local flag only works if all of your clients are on the same subnet.

A couple of other things to be aware of are that DNS traffic is routed through the vpn so you won't be able to resolve addresses unless you've dealt with that. DHCP can also get forwarded though it doesn't look like that should happen in your case as you're using a routed not a bridged VPN, but might be worth checking anyway.

Openvpn – How to force all traffic through VPN

From the OpenVPN HowTo Documentation

Implementation

Add the following directive to the server configuration file:

push "redirect-gateway def1"

If your VPN setup is over a wireless network, where all clients and the server are on the same wireless subnet, add the local flag:

push "redirect-gateway local def1"

Pushing the redirect-gateway option to clients will cause all IP network traffic originating on client machines to pass through the OpenVPN server. The server will need to be configured to deal with this traffic somehow, such as by NATing it to the internet, or routing it through the server site's HTTP proxy.

On Linux, you could use a command such as this to NAT the VPN client traffic to the internet:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

This command assumes that the VPN subnet is 10.8.0.0/24 (taken from the server directive in the OpenVPN server configuration) and that the local ethernet interface is eth0.

When redirect-gateway is used, OpenVPN clients will route DNS queries through the VPN, and the VPN server will need handle them. This can be accomplished by pushing a DNS server address to connecting clients which will replace their normal DNS server settings during the time that the VPN is active. For example:

push "dhcp-option DNS 10.8.0.1" will configure Windows clients (or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server. Any address which is reachable from clients may be used as the DNS server address.

Best Answer

Related Solutions

Openvpn – Getting openvpn client to forward all traffic through server

Openvpn – How to force all traffic through VPN

Related Topic