Rotten mud: In openvpn tun mode, the client communicates with the Intranet machine, and openvpntun

Rotten mud: In openvpn tun mode, the client communicates with the Intranet machine, and openvpntun

This article is written by Xiuyi Lin FengProviding friendship sponsorship, first launched in the dark world

In the first two articles, we will explain how to build and configure openvpn. In this article, we will talk about how the openvpn client communicates with intranet machines in tun mode.

I. Actual Problems

First, we will introduce the current basic information as follows:

1. A single network card of the openvpn server maps port 1194 of the openvpn server to the public network through the hardware firewall.

2. The IP address range of the openvpn server is 192.168.5.1/24.

3. The IP address obtained by the openvpn client is 10.8.0.1/24.

The 10.8.0.1/24 network segment is required to be able to access servers in the 192.168.5.1/24 network segment.

Through the first two articles, we can see that our current openvpn client can connect to the openvpn server normally, but it cannot communicate with other machines in the company's intranet. As follows:

If the openvpn server uses the tap bridge mode, this problem can be easily solved. You only need to modify the openvpn configuration file server on the openvpn server. conf to push the company's intranet IP address segment to the client.

However, our company currently uses the tun model, so we need to solve it by other means.

To solve this problem, we only need to perform the following two steps to solve the problem.

Step 1: Modify the openvpn configuration file and push the route of 192.168.5.1/24 to the client. (This step can be omitted)

Step 2: Configure IPtables rules.

Note: the operations in the preceding two steps may not be available in the first step, but you must configure IPtables rules in this step. Otherwise, the client still cannot communicate with the Intranet machine.

The following describes the operations in these two steps.

Ii. openvpn Server Configuration

In this article, we detail the server related to openvpn. in the conf configuration file, what we need to do now is to push the 192.168.5.1/24 CIDR Block route to the client. The specific configuration is as follows:

Push "route 192.168.5.0 255.255.255.0"

After modification, restart openvpn as follows:

Sudo/etc/init. d/openvpn restart

There are so many configurations that need to be modified for openvpn. Configure IPtables rules below.

3. Configure IPtables rules

Now we start to configure IPtables rules. What we need to do is to forward all requests from the 10.8.0.1/24 network segment through the eth0 Nic of the openvpn server, that is, we usually call IPtables NAT rules.

Note: IPtables rules are configured on the openvpn server instead of the openvpn client.

The IPtables NAT rules are as follows:

Sudo iptables-t nat-a postrouting-s 10.8.0.0/24-o eth0-j MASQUERADE

Sudo iptables-nL-t nat

After the above modification, we start the openvpn client to see if it can communicate with machines in the 192.168.5.1/24 CIDR block.

4. Test communication between network segments

On the openvpn client ping192.168.5.1/24 network segment machine, as follows:

Ping 192.168.5.140

Telnet 192.168.5.4 22

From the above two figures, we can see that the openvpn client has now communicated with the Intranet machine normally.

The above is the configuration process for communication between the client and the Intranet machine in openvpn tun mode.

In the actual use of openvpn, we may also encounter the following problems, and then we provide the corresponding openvpn configuration.

V. FQ Configuration

Sometimes in order to go abroad, we will purchase foreign servers, build openvpn, and then use this server for FQ.

In openvpn configuration, you only need to enable the push "redirect-gateway def1 bypass-dhcp" item in the server. conf configuration of the openvpn server. As follows:

Push "redirect-gateway def1 bypass-dhcp"

At this time, after the openvpn client dials, it will find that the IP address has been abroad. As follows:

We can see that the IP address is already abroad. You know how to use it.

6. startup of openvpn client linux

Due to project requirements, a remote openvpn server must be connected when a server is started. If it is a windows system, you can configure it.

In linux, you only need to write the command for connecting the openvpn client to the openvpn server to the/etc/rc. local file. As follows:

Cat/etc/rc. local

Note that the configuration file of the openvpn client must be written as an absolute path instead of a relative path, for example, the CA certificate, client certificate, and client key file:

In addition, if it is a centos system, do not configure it to start the openvpn client to connect to the openvpn server under the/root/directory.

After multiple tests, the openvpn client cannot be started to connect to the openvpn server.

7. Specify an IP address for the client

Sometimes you need to specify an IP address for the client to meet the needs of the actual project. You can modify the configuration of the openvpn server to meet this requirement.

You only need to enable client-config-dir ccd in the server. conf file, and then create the ccd directory under the/etc/openvpn directory. As follows:

Then, create corresponding files based on different clients in the ccd directory and write the following content into the files:

Ifconfig-push 10.8.0.200 255.255.255.0

The above means to specify the IP address 10.8.0.200 for the client.

Now we restart the openvpn server and connect the client. As follows:

We can clearly see that. The IP address obtained by the client is indeed 10.8.0.200.

PS: The above execution is on the linux system. After testing, it is found that if you specify an IP address for the client in windows, an error will be reported. This may be a BUG.