0

I've installed OpenVPN server on my Ubuntu server via https://git.io/vpn and it works like a charm! However a new request came in and it is rather complicated.

You see, the clients connecting this VPN are doing so, because we have limited acces to some URLs we manage. They need specific IP to access it, thus, they are using the VPN. The problem is, their whole traffic goes thru the VPN. We need to forward the traffic thru the VPN server only if the URL contains the specific domain, we've restricted. Everything else needs to go thru their own ISP.

In lame mans term: If VPN is connected, use local clients internet connection EXCEPT if the URL exuals example.com.

I'm not a big VPN magician, can you aid me a little?

Bert
  • 1,028
  • 1
  • 16
  • 33

1 Answers1

2

OpenVPN works on Layer 3. That means you can't generally route based on names, but on IP.

What you are looking for is split tunnel routing, not replacing default route.

What you're looking for is the push route.

You simply remove any routing configuration you have, and include something like the following in the server config:

push "route 10.1.1.1 255.255.255.255 10.0.2.1"

This will add a route to 10.1.1.1/32 via 10.0.2.1 on the client.

vidarlo
  • 6,654
  • 2
  • 18
  • 31
  • Thank you! I'll give it a try as soon as I can. Sounds simple enough. Any drawbacks with this maybe? – Bert Jan 23 '23 at 10:59
  • The drawback is that whenever the IP address of the domain changes, you need to change the configuration and make sure every VPN client reconnects. – Tero Kilkanen Jan 23 '23 at 15:37
  • That is not a drawaback since everything has static IP. But will this allow me to SSH to other servers on the Office LAN? – Bert Jan 24 '23 at 13:27
  • I don't know what your network looks like. You should look into how routing works, because what you want can probably be configured – vidarlo Jan 24 '23 at 13:30
  • So if I want to send the client request when "example.com" url is used, I just have to einter push "route [LOCAL IP RANGE] [NETMASK] [TARGET SERVER]" ? – Bert Jan 24 '23 at 13:32
  • Not good. All traffic still goes through the VPN server. – Bert Jan 24 '23 at 13:37
  • Can you post your complete server and client config, sans any secrets? Edit your question to include this. What I wrote *does* work, but you probably have some other routing directive in your config as well. – vidarlo Jan 24 '23 at 13:43
  • https://pastebin.com/uegc7AbS | I've X-ed out the server IP where the URL is living in the push route. No other routing in the config. Where can I find the client config? – Bert Jan 25 '23 at 09:25
  • I have a client-common.txt if that helps | https://pastebin.com/v1ji0wtf – Bert Jan 25 '23 at 09:28
  • 1
    Remove the `push "redirect-gateway def1 bypass-dhcp"` line. This pushes override of default gateway. – vidarlo Jan 25 '23 at 09:51
  • Trying it now. Let's see... Well.... this resulted in blocking me out from the whole network. Unable to access the Firewall or anything now. :-/ Also, there is no internet access for the client as soon as I enable the VPN connection. – Bert Jan 25 '23 at 10:04
  • Then post your routing tables when connected. – vidarlo Jan 25 '23 at 10:07
  • Well, that will happen tomorrow probably, because now I have to go to the office and fix it locally. However, I take back what I said about "no internet". There is internet, but the DNS provider is not working. I can access websites with their IP address typed in the browser. What do I have to change for that? – Bert Jan 25 '23 at 10:09
  • Do I just remove: push "dhcp-option DNS 1.0.0.1" which referrs to the local DNS server? – Bert Jan 25 '23 at 10:10
  • 1
    To remove pushing of DNS - yes, you do. And if you use a DNS server in a private network you need a route to reach the dns server as well. – vidarlo Jan 25 '23 at 10:38
  • I reached out to a technician, and removed both DNS lines from the config. Now I have internet access, working as intended, but my IP address according to "whyt is my IP" is my own, and not what the VPN servers. If I leave only "dhcp-option DNS 1.1.11", that still disables DNS name check. Why is this happening? I don't get it. – Bert Jan 25 '23 at 10:44
  • What do you actually want? Above you state that internet traffic should *not* go through VPN; here you complain that the IP shown is your own... My gut feeling is that you really have no idea what you're doing, and throwing stuff randomly at the wall to see what sticks. – vidarlo Jan 25 '23 at 13:33
  • Oh, dang it... You're right. I should check the incoming IP address on the target server, not on a "what is my IP" site... my bad ! :-D – Bert Jan 25 '23 at 16:38