# openvpn, ipfw, nat



## jasonhirsh (Apr 22, 2010)

PLease excuse me.. i am probably over my head

I am trying to be able to send my traffic from client/clients  over OPENVPN to my leased server running freebsd 7.0 my goal is so that I can access that server (command line)   and through that server the internet


Right now i can access the server over the vpn for command line  but no internet connectivity

server.conf


```
daemon
port 1194
proto tcp
dev tun
ca /usr/local/etc/openvpn/easy-rsa/keys/ca.crt
cert /usr/local/etc/openvpn/easy-rsa/keys/server.crt
key /usr/local/etc/openvpn/easy-rsa/keys/server.key  # This file should be kept secret
dh /usr/local/etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0  255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
push "dhcp-option DNS 4.2.2.1"
keepalive 10 120
tls-auth /usr/local/etc/openvpn/easy-rsa/keys/ta.key 0 # This file is secret
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
log-append  /var/log/openvpn.log
verb 5
mute 20
```



the leased server has a static ip  and only one nic

From my research  I had THOUGH that solution as IPFW with NAT to share the one nic

my tech support guys say I can't do it.. are they right??


----------



## jasonhirsh (Apr 23, 2010)

ok i guess he was right


----------



## varda (Apr 24, 2010)

You have to setup NAT ipfw and it will work. You will need to setup either NAT on remote server and proper routing for internal subnet. Or two NAT at once, on remote server and on your local.

Also you can take second separate static IP. Then on remote:

```
ipfw nat 1 config ip SECOND.IP
ipfw add nat 1 all from 10.0.0.0/8 to any out via IF_NAME
ipfw add nat 1 all from any to SECOND.IP in via IF_NAME
```

But it is possible run NAT on sigle IP on entire interface:

```
ipfw nat 1 config if IF_NAME
ipfw add nat 1 all from 10.0.0.0/8 to any out via IF_NAME
ipfw add nat 1 all from any to any in via IF_NAME
```


----------



## jasonhirsh (Oct 5, 2010)

I am back trying this again.. what do you mean by IF_NAME?

And I presume the 10.0.0.0/8 would cover the 10.8.0.0 subnet?


----------



## jasonhirsh (Oct 5, 2010)

*ahhh*

IF_NAME = Interface from IFCONFIG duhhh


----------



## varda (Oct 12, 2010)

Both configurations listed above tested and worked. Because I've used exactly the same solution you have described when starting topic.


----------

