Unable to access WAN addr space through SSL VPN tunnel

d00b · #1 (**permalink**) 06-30-2009, 10:18 PM

Folks,

I'm trying an Astaro V7.403 and it seems to be unable to grant access to other hosts in the WAN address space because, when I put that CIDR into "Local networks" box this traffic is routed to my client's tun (correct), including the Astaro WAN's IP address (wrong), creating a routing loop at the client's box.

When I manually edit the openvpn.conf (I know it is an unsupported change) and add this...

Quote:

push "route remote_host 255.255.255.255 net_gateway"

...my Astaro pushes a route into my client's box, forwarding the Astaro's IP to the client's default gateway.

Is there any "authorized" way to solve this?

TIA,
d00b

BAlfson · #2 (**permalink**) 07-01-2009, 01:21 AM

Do I understand correctly that you are trying to offer SSL VPN Remote Access (not Site-to-Site) and that you want the clients to be able to access the Internet via the Astaro HTTP/S Proxy?

d00b · #3 (**permalink**) 07-01-2009, 02:25 PM

Not really... We have a border firewall (no nat) and a couple of servers behind it, including the Astaro WAN. Behind Astaro we have the internal LAN. I'm trying to access these servers on the same address space of Astaro WAN, through the SSL VPN Remote Access, connecting from outsite (internet, border firewall's wan).

Do I make myself clear?

BAlfson · #4 (**permalink**) 07-01-2009, 03:59 PM

Are the servers in the network on the external interface of the Astaro? If so, then you might try to resolve this by adding host definitions for those servers to the list of 'Local networks' for the SSL VPN.

Cheers - Bob

d00b · #5 (**permalink**) 07-01-2009, 05:34 PM

Thank you, Bob, it solves the problem, but I'll need to update these definitions everytime someone puts a new server (or adds a new IP address) in the public segment.

My suggestion is to add an option to push to the client a route to the Astaro, to avoid a routing deadlock even when we set an IP range where the Astaro itself is part of.

BAlfson · #6 (**permalink**) 07-01-2009, 08:41 PM

Yes, but you only have a total of eight (8) IPs in your DMZ. You might be able to just put 'Any' in 'Local networks'. That is the "standard" way to allow the VPN clients to reach the public Internet.

In fact, the preferred solution is to put the DMZ "behind" the Astaro and to assign private IPs to them. Assign the Public IP for each server to an 'Additional Address' on the External interface, and create DNAT's like 'Any -> [Services] -> [Public IP] : DNAT to [Private IP]'. In order to reach the servers via their FQDN from your internal network, add static entries in the Astaro DNS proxy or your internal DNS server.

Cheers - Bob