Goal of this article is to document the configuration of an Linux to Linux OpenVPN connection with complete redirect including web traffic and DNS.

OpenVPN Server

Out of the box OpenVPN is configured so that only the traffic that passes through the OpenVPN server is redirected, especially connections to machines behind the OpenVPN server. For complete VPN traffic redirect including web and DNS traffic, we have to adjust the /etc/openvpn/server.conf as follows:

# all clients redirect their default gateway to the OVPN server
push "redirect-gateway def1"
# push internal DNS to the clients, 192.0.2.53 is our internal DNS sever  
push "dhcp-option DNS 192.0.2.53"

Router

In order to redirect all OpenVPN client traffic properly, we have to set some iptables directives:

IPTABLES="/usr/sbin/iptables"

# Interfaces
IFWAN="enp1s0"                  # Interface Internet external
IFTUN="tun0"                    # Interface VPN

# Networks
NETTUN="198.51.100.0/24"        # Network VPN

# TUN access to the internet
$IPTABLES -A FORWARD -i $IFTUN -s $NETTUN -o $IFWAN -m conntrack --ctstate NEW -j ACCEPT

# NAT
$IPTABLES -t nat -A POSTROUTING -s $NETTUN -o $IFWAN -j MASQUERADE

OpenVPN physical client

And finally, we have to configure our client so it really accepts the complete rerouting.

For DNS redirection, we need an additional package:

sudo apt install openvpn-systemd-resolved

To set the resolving mechanism into effect, we have to adjust our client.ovpn config:

client
dev tun
proto udp
...
script-security 2
up update-systemd-resolved
down "update-systemd-resolved --down"
...

To add a local search domain for your network to which the VPN client is connected now, your can execute an sudo resolvectl domain tun0 intra.example.net (given this is your local domain).

That’s it! After restarting the openvpn service at the OpenVPN server and applying the firewall rules at the router, we should be able to connect from the client and routing all traffic through the VPN.

OpenVPN VM client/Terminal Server

The mechanism for physical clients does not work the same way for clients that we access via web. Because, when the default route points to the VPN endpoint, we are not able to access the web server that is running the VM’s presentation layer, e.g. Apache tomcat/Guacamole, from the outside.

So we have to ignore the defaulte route redirection on client side and start OpenVPN as openvpn --pull-filter ignore redirect-gateway.

In order to get the web traffic nonetheless through the VPN, we have to setup a web proxy inside the network we are connecting to. I’m using mitmproxy with the following service configuration:

[Unit]
Description=mitmdump service
After=network.target

[Service]
StandardOutput=syslog
StardardError=syslog
SyslogIdentifier=mitmdump
Type=simple
User=root
ExecStart=/usr/bin/mitmdump --listen-host 192.0.2.254 --ignore-hosts '.*'
Restart=always
RestartSec=1

[Install]
WantedBy=multi-user.target

Here, 192.0.2.254 is the IP address of the machine running mitmproxy/mitmdump. The --ignore-hosts directive means that no filtering or inspection is done by the proxy, but ist’s only acting as a traffic redirector.

Finally, we have to set up the proxy 192.0.2.254:8080 manually in the browser at our VM.

That’s it! After restarting the openvpn service at the OpenVPN server, restarting the mitmproxy at the proxy machine, and applying the firewall rules at the router, we should be able to connect from the client and routing the web traffic through the VPN.