openvpn, ipfw, nat

J

jasonhirsh

PLease excuse me.. i am probably over my head

I am trying to be able to send my traffic from client/clients over OPENVPN to my leased server running freebsd 7.0 my goal is so that I can access that server (command line) and through that server the internet


Right now i can access the server over the vpn for command line but no internet connectivity

server.conf

Code: 
daemon
port 1194
proto tcp
dev tun
ca /usr/local/etc/openvpn/easy-rsa/keys/ca.crt
cert /usr/local/etc/openvpn/easy-rsa/keys/server.crt
key /usr/local/etc/openvpn/easy-rsa/keys/server.key  # This file should be kept secret
dh /usr/local/etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0  255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
push "dhcp-option DNS 4.2.2.1"
keepalive 10 120
tls-auth /usr/local/etc/openvpn/easy-rsa/keys/ta.key 0 # This file is secret
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
log-append  /var/log/openvpn.log
verb 5
mute 20



the leased server has a static ip and only one nic

From my research I had THOUGH that solution as IPFW with NAT to share the one nic

my tech support guys say I can't do it.. are they right??
 
You have to setup NAT ipfw and it will work. You will need to setup either NAT on remote server and proper routing for internal subnet. Or two NAT at once, on remote server and on your local.

Also you can take second separate static IP. Then on remote:
Code: 
ipfw nat 1 config ip SECOND.IP
ipfw add nat 1 all from 10.0.0.0/8 to any out via IF_NAME
ipfw add nat 1 all from any to SECOND.IP in via IF_NAME

But it is possible run NAT on sigle IP on entire interface:
Code: 
ipfw nat 1 config if IF_NAME
ipfw add nat 1 all from 10.0.0.0/8 to any out via IF_NAME
ipfw add nat 1 all from any to any in via IF_NAME
 
I am back trying this again.. what do you mean by IF_NAME?

And I presume the 10.0.0.0/8 would cover the 10.8.0.0 subnet?
 
You must log in or register to reply here.
Back
Top