Goal of this article is to document the configuration of an Linux to Linux OpenVPN connection with complete redirect including web traffic and DNS.

OpenVPN Server

Out of the box OpenVPN is configured so that only the traffic that passes through the OpenVPN server is redirected, especially connections to machines behind the OpenVPN server. For complete VPN traffic redirect including web and DNS traffic, we have to adjust the /etc/openvpn/server.conf as follows:

# all clients redirect their default gateway to the OVPN server
push "redirect-gateway def1"
# push internal DNS to the clients, 192.0.2.53 is our internal DNS sever  
push "dhcp-option DNS 192.0.2.53"

Router

In order to redirect all OpenVPN client traffic properly, we have to set some iptables directives:

IPTABLES="/usr/sbin/iptables"

# Interfaces
IFWAN="enp1s0"                  # Interface Internet external
IFTUN="tun0"                    # Interface VPN

# Networks
NETTUN="198.51.100.0/24"        # Network VPN

# TUN access to the internet
$IPTABLES -A FORWARD -i $IFTUN -s $NETTUN -o $IFWAN -m conntrack --ctstate NEW -j ACCEPT

# NAT
$IPTABLES -t nat -A POSTROUTING -s $NETTUN -o $IFWAN -j MASQUERADE

OpenVPN client

And finally, we have to configure our client so it really accepts the complete rerouting.

For DNS redirection, we need an additional package:

sudo apt install openvpn-systemd-resolved

To set the resolving mechanism into effect, we have to adjust our client.ovpn config:

client
dev tun
proto udp
...
script-security 2
up update-systemd-resolved
down "update-systemd-resolved --down"
...

That’s it! After restarting the openvpn service at the OpenVPN server and applying the firewall rules at the router, we should be able to connect from the client and routing all traffic through the VPN.