[Openvpn-users] Route all traffic to one of the clients instead of the server

[邓尧]

Hi,

My server has a special client and I need to redirect all traffic of other
clients to this special client. Basically the special client instead of the
server is used as a NAT gateway.

The server tunnel address is 192.168.50.1, the special client's tunnel
address is 192.168.50.200 which is statically configured with a
"client-config-dir" configuration file.

The following options are added to the server's configuration file:
push "route-gateway 192.168.50.200"
client-to-client

The following option is added in normal clients' "client-config-dir"
configuration files:
push "redirect-gateway def1 bypass-dhcp"

Communications among clients and the server seem to be fine. Command "route
-n" on the clients also shows expected results.

But "traceroute" shows that the first hop of client traffic is still
192.168.50.1 instead of 192.168.50.200, even though the default gateway of
the client is shown as 192.168.50.200. If NAT is disabled on the server,
all communications to the Internet is broken.

I did some experiments, if "redirect-gateway" isn't pushed to the clients,
and the routing table on the clients are manually configured, it works
well. Because I have some Android/iOS clients which cannot be configured
manually without rooting the devices, this isn't an appropriate option for
me.

Is this an OpenVPN bug/feature or I configured incorrectly ?

OpenVPN version is 2.3.10, Linux distribution is Ubuntu 16.04.

Thanks

[Gert Doering]

Hi,

Post by 邓尧
My server has a special client and I need to redirect all traffic of other
clients to this special client. Basically the special client instead of the
server is used as a NAT gateway.
The server tunnel address is 192.168.50.1, the special client's tunnel
address is 192.168.50.200 which is statically configured with a
"client-config-dir" configuration file.

Is this tun or tap based?

Since you can never(!) send traffic from one client directly to another
client - it will always go to the server first - this is where the
route next-hop makes a difference.

On tap, you can use another client's IP address as the next-hop, and
ARP plus ethernet-address-based forwarding on the server will ensure that
the packet will actually arrive at the other client. If that's not
working for you, please show the client log to see what routes are pushed
by the server and how they are installed.

On tun, the packet will always be routed by the server, so if you want
to send all traffic towards a particular client, you need to set up
"iroute" for "all traffic" on the server, in that client's CCD file
(which needs a few workarounds today, see the open trac item on
iroute 0.0.0.0).

gert