# Getting Open VPN to work as a gateway.

## Jmaxxz

I have been try (and failing) to get my openvpn server to act as the default gateway for client machines.

Whenever I add

```
 push "redirect-gateway local def1"
```

to my vpn configuration and connect a windows client, that windows client will no longer be able to access the internet.

Maybe a stupid question, but do I need to configure a gateway on tun0? If so would I just do this in /ect/conf.d/net? Or would this issue more likely be an issue with my vpn.

Thanks,

Jmaxxz

----------

## truc

We'd need more information, starting from your config(s).

----------

## Jmaxxz

Here is my client configuration:

this is on a windows 7 machine

```
client

dev tun

dev-node HomeOpenVPN

proto udp

remote <mydomain>.com 5194

route-method exe

route-delay 2

resolv-retry infinite

nobind

persist-key

persist-tun

mute-replay-warnings

ca ca.crt

cert client.crt

key client.key

ns-cert-type server

cipher AES-256-CBC

comp-lzo

verb 3

```

Will post the server config ASAP

----------

## Jmaxxz

/ect/openvpn/openvpn.conf

```

server 10.65.76.0 255.255.255.0

proto udp

port 5194

dev tun

ca privnet/ca.crt

cert privnet/server.crt

key privnet/server.key

dh privnet/dh1024.pem

cipher AES-256-CBC

comp-lzo

keepalive 10 120

persist-key

persist-tun

#  push "dhcp-option DOMAIN <mydomain>.com"

  push "dhcp-option DNS 10.65.76.1"

  push "dhcp-option WINS 10.65.76.1"

  push "route 10.65.76.0 255.255.255.0"

  push "redirect-gateway def1"

ifconfig-pool-persist ipp.txt

status openvpn-status.log

verb 3

```

----------

## Efo

Hi Jmaxxz,

I dont know if this is relevant, but I had a similar problem once. I used kvpnc and, while the vpn connection worked, I wasnt able to access internet from the client.

I found out that, in the configuration of my client, kvpnc had "Replace default route" enabled in the Network-Routes instead of "Keep default route". I changed that and it worked.

I hope this helps.

Efo

----------

## truc

I see ' push "redirect-gateway def1"' in the server config, and you said were adding ' push "redirect-gateway local def1"'

Since clients&server don't seem to be on the same lan, your actual server config looks good.

Can we see the routing table on the client? Also, try to ping tho public server IP, the local one and show us the result.

----------

## Jmaxxz

```

>route Print

===========================================================================

Interface List

 19...00 ff e5 14 xx xx ......TAP-Win32 Adapter V9

 15...00 21 86 3b xx xx ......Bluetooth Device (Personal Area Network)

 13...00 21 5c 06 xx xx ......Intel(R) Wireless WiFi Link 4965AGN

 11...00 1f 29 7c xx xx ......Intel(R) 82566MM Gigabit Network Connection

  1...........................Software Loopback Interface 1

 12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter

 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2

 17...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface

 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3

 32...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4

 21...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter

===========================================================================

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0    165.92.31.254     165.92.31.17     30

          0.0.0.0        128.0.0.0       10.65.76.5       10.65.76.6     31

       10.65.76.1  255.255.255.255       10.65.76.5       10.65.76.6     31

       10.65.76.4  255.255.255.252         On-link        10.65.76.6    286

       10.65.76.6  255.255.255.255         On-link        10.65.76.6    286

       10.65.76.7  255.255.255.255         On-link        10.65.76.6    286

        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306

        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306

  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306

        128.0.0.0        128.0.0.0       10.65.76.5       10.65.76.6     31

      165.92.30.0    255.255.254.0         On-link      165.92.31.17    286

     165.92.31.17  255.255.255.255         On-link      165.92.31.17    286

    165.92.31.255  255.255.255.255         On-link      165.92.31.17    286

    123.89.13.128  255.255.255.255    165.92.31.254     165.92.31.17     31

        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306

        224.0.0.0        240.0.0.0         On-link        10.65.76.6    286

        224.0.0.0        240.0.0.0         On-link      165.92.31.17    286

  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306

  255.255.255.255  255.255.255.255         On-link        10.65.76.6    286

  255.255.255.255  255.255.255.255         On-link      165.92.31.17    286

===========================================================================

Persistent Routes:

  None

IPv6 Route Table

===========================================================================

Active Routes:

 If Metric Network Destination      Gateway

 21   1130 ::/0                     2002:c058:6301::c058:6301

  1    306 ::1/128                  On-link

 21   1030 2002::/16                On-link

 21    286 2002:9b5c:1f11::9b5c:1f11/128

                                    On-link

 19    286 fe80::/64                On-link

 13    286 fe80::/64                On-link

 13    286 fe80::a96b:5cfa:e587:acbe/128

                                    On-link

 19    286 fe80::b590:971:1939:c841/128

                                    On-link

  1    306 ff00::/8                 On-link

 19    286 ff00::/8                 On-link

 13    286 ff00::/8                 On-link

===========================================================================

Persistent Routes:

  None

```

```

>ping <mydomain>.com

Pinging <mydomain>.com [123.89.13.128] with 32 bytes of data:

Request timed out.

```

----------

## truc

 *truc wrote:*   

>  Also, try to ping tho public server IP, the local one and show us the result.

 

----------

## richard.scott

have you setup ip_forward'ing or nat'ing on the OpenVPN Server?

----------

## Jmaxxz

 *richard.scott wrote:*   

> have you setup ip_forward'ing or nat'ing on the OpenVPN Server?

 

I do not think so.

----------

## richard.scott

 *Jmaxxz wrote:*   

> /ect/openvpn/openvpn.conf
> 
> ```
> 
> server 10.65.76.0 255.255.255.0
> ...

 

Just noticed that the server IP listed in your openvpn.conf isn't the same as for your server.

I believe your server IP is 10.65.76.1? This is what should be in /etc/openvpn/openvpn.con.

Also, once connected via the openvpn you should still be able to ssh to this IP... if this is the case then it is most likely the iptables nat'ing that you need to configure.

Rich

----------

## richard.scott

 *truc wrote:*   

>  *truc wrote:*    Also, try to ping tho public server IP, the local one and show us the result. 

 

yes... good idea. You should still be able to ping the openvpn server once connected.

----------

## Jmaxxz

When i connect i can ping the internal ip of my server. However I can not resolve DNS, so if i ping the public domain name tied to my server it will not resolve so long as i have the redirect-gateway def1 in place

----------

## truc

So, question is, are you able to ping the DNS 10.65.76.1?

I still think it's a routing problem.

If you're not able to ping, show the routing table of the DNS, and its next hop

----------

## Jmaxxz

Here are the routing tables from my server

 *Quote:*   

> Kernel IP routing table
> 
> Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
> 
> 10.65.76.2      *               255.255.255.255 UH        0 0          0 tun0
> ...

 

----------

## truc

Do you always answer to only half the questions you're asked?

It's the second time in the same thread.

I wish you a good luck

----------

## Jmaxxz

 *truc wrote:*   

> Do you always answer to only half the questions you're asked?

 

no, not all the time.

In answer to your question:

I posted my routing table, but I was confused by what you mean by and the next hope

Or if your question was about being able to ping the server:

 *jmaxxz wrote:*   

> When i connect i can ping the internal ip of my server

 

(my on the vpn my server lives at 10.65.76.1)

----------

