Arch Linux

srnty

Member

Registered: 2012-09-21

Posts: 24

[SOLVED] OpenVPN "Local" Only

I'd like for my VPN to provide no internet access, only connections between its clients. Is this configured on the server side or for each individual client?

Last edited by srnty (2019-03-17 05:23:20)

jasonwryan

Anarchist

From: .nz

Registered: 2009-05-09

Posts: 30,426

Website

Re: [SOLVED] OpenVPN "Local" Only

Why do you need a Virtual Private Network on your Private Network? What are you actually trying to achieve?

---

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

srnty

Member

Registered: 2012-09-21

Posts: 24

Re: [SOLVED] OpenVPN "Local" Only

I think I phrased that wrong. I have computers on the VPN across several networks. I just don't want any traffic routed through the VPN unless it is between two machines on the VPN.

Last edited by srnty (2019-03-13 22:58:58)

loqs

Member

Registered: 2014-03-06

Posts: 19,103

Re: [SOLVED] OpenVPN "Local" Only

The server can push route options to the client for the client to perform.  The client can also be configured to perform such routing without needing any pushed options.
Note on linux you will need a helper script if you want the openvpn client to change routing.
If you can configure the topology so one subnet is dedicated to the VPN you can then route that traffic through the device VPN will use.

srnty

Member

Registered: 2012-09-21

Posts: 24

Re: [SOLVED] OpenVPN "Local" Only

So if the IP of my VPN server is 192.168.0.1, I should add the line

push route 192.168.0.0 255.255.255.0 1

to my openvpn server.conf?

Do I need to define a second route for all other traffic to directed elsewhere?

loqs

Member

Registered: 2014-03-06

Posts: 19,103

Re: [SOLVED] OpenVPN "Local" Only

No provided there is a default route `ip r`

srnty

Member

Registered: 2012-09-21

Posts: 24

Re: [SOLVED] OpenVPN "Local" Only

Thanks! I'll try that when I get home.

sincomil

Member

Registered: 2018-02-13

Posts: 118

Re: [SOLVED] OpenVPN "Local" Only

Pushing the default route is not the only thing that provides an internet connection for clients, because clever users can write their own routes to reach the internet through you VPN-server. You have to reject(drop) packet forwarding to the WAN interface from your client IP network. This is MUST-HAVE option if your clients should never get to the internet from you VPN-server.
You can achieve this by putting rule in iptables FILTER table FORWARD chain on you VPN-server firewall:

# iptables -t filter -I FORWARD -s 10.8.0.0/24 -o $WAN_IF -j REJECT 

This example assumes that
- Your vpn-client network is: 10.8.0.0/24
- You interface connected to the Internet is $WAN

Last edited by sincomil (2019-03-14 14:24:47)

srnty

Member

Registered: 2012-09-21

Posts: 24

Re: [SOLVED] OpenVPN "Local" Only

Pushing the default route is not the only thing that provides an internet connection for clients, because clever users can write their own routes to reach the internet through you VPN-server. You have to reject(drop) packet forwarding to the WAN interface from your client IP network. This is MUST-HAVE option if your clients should never get to the internet from you VPN-server.
You can achieve this by putting rule in iptables FILTER table FORWARD chain on you VPN-server firewall:

# iptables -t filter -I FORWARD -s 10.8.0.0/24 -o $WAN_IF -j REJECT 

This example assumes that
- Your vpn-client network is: 10.8.0.0/24
- You interface connected to the Internet is $WAN

Do I run this command on the VPN server?

Also, how do I reverse it once I've entered it?

Last edited by srnty (2019-03-15 22:29:53)

srnty

Member

Registered: 2012-09-21

Posts: 24

Re: [SOLVED] OpenVPN "Local" Only

I tried everyone's advice and it all worked perfectly. Thank you!