Routing between LAN and VPN behind NAT

02 Mar 2009 7:39 (Edited: 02 Mar 2009 7:39)

Took a while to get traffic routed from remote OpenVPN clients to LAN at the OpenVPN server end.

Here's the network setup:

Remote office:

Router: 10.1.1.250 / 255.255.255.0
OpenVPN server LAN IP (eth0): 10.1.1.1
OpenVPN server VPN IP (tun0): 10.8.0.1
LAN DNS server IP: 10.1.1.10

Key settings from openvpn server.conf:

push "route 10.1.1.0 255.255.255.0"
push "dhcp-option DNS 10.1.1.10" # DNS server
push "dhcp-option WINS 10.1.1.10" # WINS server address

Now the problem is that while remote VPN clients can successfully ping the LAN IP of the OpenVPN server (10.1.1.1), they cannot ping other hosts in the LAN (for example the DNS/WINS server, 10.1.1.10).

Routing traffic between VPN and LAN worked as long as the OpenVPN server acted also as the router for the network. When routing was moved to another server (10.0.0.250), VPN<->LAN routing went bust.

The problem is easily solved with applying the following iptables rule and enabling IP forwarding (using CentOS v4.7):

# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# sysctl -w net.ipv4.ip_forward=1

Make sure you enable ip_forwarding at /etc/sysctl.conf to make the setting persist through boots. Don't forget to save the iptables rules as well with, for example, iptables-save.

Tags: lan  nat  openvpn  routing 

List of my blog entries

• Power consumption of common home electronics devices (19 Nov 2007)
• Downloads more accessible to users with firewalls (25 Jun 2007)
• More download capacity added (28 Feb 2007)
• Fixed problems with blog image scaling functions (20 Jan 2007)
• Further problems with the DB server (updated) (13 Jan 2007)
• Yesterday's problems with the site (12 Jan 2007)
• Bypassing lock code on Nokia phones (27 Dec 2006)
• iptables and vsftpd with ssl (25 Sep 2006)
• Replying to feedback mail (24 Jan 2006)
• Windows XP HDD stuck in PIO mode instead of DMA (13 Jan 2006)
• Problems with Windows Update (07 Jan 2006)
• auditd causing crond (cron) and sshd (ssh) to lock up (06 Jan 2006)
• Squeezebox under the microscope (25 Nov 2005)
• And so it begins... (10 Nov 2005)

User comments

(No comments made)

Post your comment

In order to post your comments here, you need be logged in to our system. Simply follow this link in order to login and to post your comments here.