ref: https://nikinuryadin.wordpress.com/2010/04/16/step-by-step-setting-up-openvpn-in-debian-with-routing-tun-connection/
Configure openvpn using routing (tun) connection
Configuring the server
#vim /etc/openvpn/server.conf
(add the following lines)
port 443
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/vpnsarandi.crt
key /etc/openvpn/easy-rsa/keys/vpnsarandi.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server 10.1.0.0 255.255.255.0
client-config-dir ccd
route 192.168.1.0 255.255.255.0
route 192.168.2.0 255.255.255.0
client-to-client
push “route 192.168.1.0 255.255.255.0”
push “route 192.168.2.0 255.255.255.0”
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
Making directory ccd:
#mkdir /etc/openvpn/ccd
Making file client1 in ccd directory
#vim /etc/openvpn/ccd/clent1
(add the following lines)
iroute 192.168.1.0 255.255.255.0
Restart OpenVPN:
#/etc/init.d/openvpn restart
Setting up the windows client. First, download the OpenVPN client from
here (at the time of writing, select 2.1 RC15). Install it, and create a file ‘client.conf’ in the config directory with the following parameters
client
dev tun
proto udp
remote x.x.x.x 443 # (replace with your server IP)
resolv-retry infinite
nobind
pkcs12 client1.p12 # (replace with the client name)
ns-cert-type server
comp-lzo
verb 3
#redirect-gateway
You can also add ‘redirect-gateway’ to the client configuration to pass all traffic down the VPN tunnel (rather than just traffic intended for the VPN itself).
copy the client1.p12 certificate file to the config directory on the client, start the gui, and connect.
If you need to create any clients in the future, do the following command:
#cd /etc/openvpn/easy-rsa
#source ./vars
#./build-key-pkcs12 clientx
Enable IP and TUN/TAP forwarding:
On linux client
IP Forwarding
Check if IP Forwarding is enabled
#sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0
or
cat /proc/sys/net/ipv4/ip_forward
0
As we can see in both the above examples this was disabled (as show by the value 0).
Enable IP Forwarding on the fly
#sysctl -w net.ipv4.ip_forward=1
or
#echo 1 > /proc/sys/net/ipv4/ip_forward
Permanent setting using /etc/sysctl.conf
#/etc/sysctl.conf:
net.ipv4.ip_forward = 1
#sysctl -p /etc/sysctl.conf
On RedHat based systems this is also enabled when restarting the network service:
#service network restart
and on Debian/Ubuntu systems this can be also done restarting the procps service:
#/etc/init.d/procps.sh restart
Using distribution specific init scripts
Although the methods presented above should work just fine and you would not need any other method of doing this, I just wanted to note that there are also other methods to enable IP Forwarding specific to some Linux distributions.
For example Debian based distributions might use the setting:
#/etc/network/options:
ip_forward=no
set it to yes and restart the network service.
Also RedHat distributions might set this using:
#/etc/sysconfig/network:
FORWARD_IPV4=true
and again restart the network service.
Regardless the method you have used once you have completed this you can check it out using the same method shown above:
#sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
#cat /proc/sys/net/ipv4/ip_forward
1
If the result is 1 then the Linux system will start forwarding IP packets even if they are not destined to any of its own network interfaces.
TUN/TAP forwarding:
Allow TUN interface connections to OpenVPN server
# iptables -A INPUT -i tun+ -j ACCEPT
Allow TUN interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tun+ -j ACCEPT
Allow TAP interface connections to OpenVPN server
# iptables -A INPUT -i tap+ -j ACCEPT
Allow TAP interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tap+ -j ACCEPT
** rule iptables for internet sharing from eth1 to eth0.
#iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
#iptables-save
Restart Networking and OpenVPN
#/etc/init.d/networking restart
#/etc/init.d/openvpn restart
