Not able to access outside services though Openvpn in brigded bridged mode and routing everything thorugh the vpn

I have setup a small server with a bridged openvpn setup. My goal is use my network services and Internet connection from every location with Internet access. Right now I am just able to use services in my own network via the vpn. I looked into the option of a redirected gateway to force all traffic through the vpn. As soon as I activate this option I am not able to access the Internet, but for example my private owncloud setup in my local network. It would be really helpful, if someone could give me some advice. Thanks in advance.

GOAL:

Route all traffic of my Ubuntu-Laptop through my vpn.

Being able to access both internal as external services.

What I have already tried:

Push the DNS-settings through the vpn

Running various iptable commands with no effect

Where I think the problem is:

Even if I have already tried to configure the nat via iptable settings, I was never sure if I did it correct.

Server configuration

server.conf:

server-bridge
port 1194
proto tcp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
# server-bridge br0_address netmask clientlowerlimit clientupperlimit
server-bridge 192.168.0.100 255.255.255.0 192.168.0.101 192.168.0.120
# push "route subnet_identifier netmask router_address"
push "route 192.168.0.0 255.255.255.0 192.168.0.1"
# push "dhcp-option DNS router_address"
push "dhcp-option DNS 192.168.0.1"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
ifconfig-pool-persist ipp.txt
dh dh2048.pem
script-security 2
push "dhcp-option DNS 192.168.0.1"
push "redirect-gateway def1"

bridge script:

#!/bin/sh
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.0.21"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"
eth_gateway="192.168.0.1"
case "$1" in
start)
for t in $tap; do openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do brctl addif $br $t
done
for t in $tap; do ifconfig $t 0.0.0.0 promisc up
done
sleep 10
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw $eth_gateway
;;
stop)
ifconfig $br down
brctl delbr $br
for t in $tap; do openvpn --rmtun --dev $t
done
ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw $eth_gateway
;;
*)
echo "Usage: bridge {start|stop}"
exit 1
;;
esac
exit 0

Client configuration

client.conf:

client
dev tap0
proto tcp
#I use port 80 because it is nerver blocked
remote domain.org 80
persist-key
persist-tun
ca ca.crt
cert test.crt
key test.key
remote-cert-tls server
comp-lzo
verb 3
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

update-resolve-conf:

#!/bin/bash
#
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood and Chris Hanson.
# Licensed under the GNU GPL. See /usr/share/common-licenses/GPL.
#
# Example envs set from openvpn:
# foreign_option_1='dhcp-option DNS 8.8.8.8' foreign_option_2='dhcp-option DNS 192.168.0.1'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
#
[ -x /sbin/resolvconf ] || exit 0
[ "$script_type" ] || exit 0
[ "$dev" ] || exit 0
split_into_parts()
{
part1="$1"
part2="$2"
part3="$3"
}
case "$script_type" in
up)
NMSRVRS=""
SRCHS=""
for optionvarname in ${!foreign_option_*} ; do option="${!optionvarname}" echo "$option" split_into_parts $option if [ "$part1" = "dhcp-option" ] ; then if [ "$part2" = "DNS" ] ; then NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3" elif [ "$part2" = "DOMAIN" ] ; then SRCHS="${SRCHS:+$SRCHS }$part3" fi fi
done
R=""
[ "$SRCHS" ] && R="search $SRCHS
"
for NS in $NMSRVRS ; do R="${R}nameserver $NS
"
done
echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"
;;
down)
/sbin/resolvconf -d "${dev}.openvpn"
;;
esac

2 Answers

I was able to partially solve the problem. I am using the using the ubuntu vpn network manager to connect to the server, so there is no client config anymore However the my server config changed to this:

server-bridge
port 1194
proto tcp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
# server-bridge br0_address netmask clientlowerlimit clientupperlimit
server-bridge 192.168.0.100 255.255.255.0 192.168.0.101 192.168.0.120
# push "route subnet_identifier netmask router_address"
push "route 192.168.0.1 255.255.255.0"
# push "dhcp-option DNS router_address"
push "dhcp-option DNS 192.168.0.1"
push "redirect-gateway def1 bypass-dhcp"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
ifconfig-pool-persist ipp.txt
dh dh2048.pem
script-security 2

After connecting to the server I was still not able to access the Internet via the vpn. To make it work I had to run following command on the client:

sudo route add default gw 192.168.0.1

The only task left to do is to find a way how to automatically run this command after stating the vpn connection. I would be thankful for any suggestions.

Try this for client config of the .ovpn file

client dev tun proto udp remote remote-ip 1194 resolv-retry infinite nobind persist-key persist-tun ca ca-cert.pem cert client-user-cert.pem key client-user-key.pem ns-cert-type server comp-lzo redirect-gateway def1 verb 3 auth-nocache auth-user-pass