Como forçar todo o tráfego através de VPN?

Question

Eu tenho um openVPN configurado no servidor e estou usando o openVPN connect para meu cliente. Eu tenho alguns sites internos que preciso acessar e alguns deles não funcionam. Eu quero ter certeza de que quando o tráfego está passando pela VPN e não através da conexão normal com a internet. O ip do gateway para minha rede é 192.168.0.1 e o gateway para o openVPN é 10.8.0.1. Eu fiz rota de rastreamento e mostra que os sites que não funcionam acessam 192.168.0.1 e não 10.8.0.1. Como eu forçaria todo o tráfego através da VPN? Estou executando o windows 7 como cliente e o Ubuntu 10.04 para o servidor.

    

Answer 1

Do Documentação do OpenVPN HowTo

Implementation

Add the following directive to the server configuration file:

push "redirect-gateway def1"

If your VPN setup is over a wireless network, where all clients and the server are on the same wireless subnet, add the local flag:

push "redirect-gateway local def1"

Pushing the redirect-gateway option to clients will cause all IP network traffic originating on client machines to pass through the OpenVPN server. The server will need to be configured to deal with this traffic somehow, such as by NATing it to the internet, or routing it through the server site's HTTP proxy.

On Linux, you could use a command such as this to NAT the VPN client traffic to the internet:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

This command assumes that the VPN subnet is 10.8.0.0/24 (taken from the server directive in the OpenVPN server configuration) and that the local ethernet interface is eth0.

When redirect-gateway is used, OpenVPN clients will route DNS queries through the VPN, and the VPN server will need handle them. This can be accomplished by pushing a DNS server address to connecting clients which will replace their normal DNS server settings during the time that the VPN is active. For example:

push "dhcp-option DNS 10.8.0.1" will configure Windows clients (or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server. Any address which is reachable from clients may be used as the DNS server address.

    

Answer 2

Eu tive o mesmo problema, mas a solução descrita acima não funcionou para mim. Na minha configuração openvpn, eu tive que escrever

redirect-gateway def1

sem o push e sem as aspas - então funcionou.

O cliente era o Windows 10 1607 com o OpenVPN 3.2.12.