OpenVPN not routing via default route

openvpnstatic-ip

I set up a OpenVPN server for subnet 10.8.0.0/24 which has limited access to the internal network. Additionally I want to configure 10.8.1.0/24 manually with static IPs for selected clients to give them additional permission (e.g. SSH access).

Access control is done via iptables and works as expected.

Now I push a route to an external IP (in this example 10.10.10.10) with a webserver running on port 80 & 443.

When connecting to the VPN without a client specific configuration and thus getting an 10.8.0.0/24 IP I have no problems accessing the webserver on 10.10.10.10. I can see packages coming in on tun0 and leaving the server on p4p1 (external interface).
When connecting to the VPN with a client specific configuraiton and thus getting an 10.8.1.0/24 IP I am able to ping all internal servers, but packages designated for 10.10.10.10 won't be relayed to any physical interface on the VPN server (checked in TCP dumps).

Regarding this an excerpt from the OpenVPN server configuration:

server 10.8.0.0 255.255.255.0
push "route 10.10.10.10 255.255.255.255"
client-config-dir /etc/openvpn/ccd
route 10.8.1.0 255.255.255.0
client-to-client
comp-lzo
persist-key
persist-tun

client-configuration /etc/openvpn/ccd/some-client:

ifconfig-push 10.8.1.133 10.8.1.134

As traffic is working via any specific route listed to the internal interface (p1p1) I guess that OpenVPN is not correctly redirecting traffic towards the default route going onto interface p4p1, but I don't know why it would do that and how it can be fixed.

Any suggestions?

Best Answer

As Diamant said, the webserver needs to have a route back to 10.8.1.0/24 through the VPN server as well. Alternatively, the VPN server will need to be configured to perform NAT for requests to the webserver.

Additionally, I'm not sure about this but you may need to add push "route 10.8.0.0 255.255.0.0" to your server config.

EDIT: The netmask in the server config bothers me. Instead of the suggestion above, try removing the server 10.8.0.0 255.255.255.0 line in the server config and adding this instead:

mode server
tls-server
ifconfig 10.8.0.1 255.255.254.0    # different netmask to support 10.8.1.0/24 range
ifconfig-pool 10.8.0.0 10.8.0.253
route-gateway 10.8.0.1
push "route-gateway 10.8.0.1"

EDIT2: added missing config lines

Related Topic