Results 1 to 8 of 8
  1. #1
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default Export Single IP

    Hi, wondering if I am missing an instruction or something obvious when trying to setup the Exports in Untangle for our OpenVPN access.

    When I export the enitire subnet (192.1.1.1 / 255.255.255.0) I can access the all the machines as expected. But for security reasons I would prefer to just export the resources that are needed.

    According to the Wiki:
    If you only want VPN users to access a single computer, in the IP address text box and netmask text box, specify the computer's IP address and 255.255.255.255 subnet mask, then in host/network name text box, provide a descriptive name for the resource.
    However when I try this (e.g. 192.1.1.50 / 255.255.255.255) I do not seem to have access to the specified machine.

    Is there something I need to do in conjunction with the Export to allow access? Or is there any testing or diagnosis I can perform to determine why its not working?

    Any help or advice appreciated. Thanks.

  2. #2
    Untangle Ninja gotkimchi's Avatar
    Join Date
    Jan 2007
    Location
    Bay Area
    Posts
    2,106

    Default

    that is correct, check to see if your 192.1.1.50 has the gateway pointed to Untangle. Also, check to see if firewall is blocking it (windows firewall, if it is running windows)
    to be understood, you must first understand. :)
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself. If you need Untangle support please call or email support@untangle.com

  3. #3
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default

    Thanks for your response.

    Untangle is running in Bridge mode so is not the machines gateway (the modem-router on the external interface is). Does this have an effect on how the hosts are exported? Do I need to export the Gateway and/or Untangle too?

    I cannot see anything in the firewall blocking my access and the fact that I can access 192.1.1.50 when the whole subnet is exported makes me assume that the firewall is not causing the problem.

    Will keep plugging away to see if I can solve this.

  4. #4
    Untangle Ninja gotkimchi's Avatar
    Join Date
    Jan 2007
    Location
    Bay Area
    Posts
    2,106

    Default

    Did you try this, since your untangle is in the bridge mode?
    http://forums.untangle.com/openvpn/1...e-openvpn.html
    to be understood, you must first understand. :)
    Attention: Support and help on the Untangle Forums is provided by volunteers and community members like yourself. If you need Untangle support please call or email support@untangle.com

  5. #5
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default

    Thanks (and sorry, I shoulda found that thread myself as it is so recent but I didn't equate my problem to UT being in bridge mode).

    It looked promising but doesn't fix the problem as far as I can tell. Would this change require a restart of UT or any module/service to become active?

    I have noticed that when exporting a single IP, OpenVPN has the following line in the log (twice).
    Warning: route gateway is not reachable on any active network adapters: 172.16.16.26
    This does not appear when I have exported the entire network (which is when the resources are available to the VPN client) so I deduce it is linked and its meaning shall be my next thread of investigation. Google ahoy...

  6. #6
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,497

    Default

    The route doesn't go in your untangle, it goes into your router. The screen shots in the thread are there to show you how you would configure an untangle router appropriately.

    The problem, is simple, your clients have no clue where your OpenVPN address pool is, so they send the packets to the default gateway. If the gateway isn't told where that address pool is the packets go out the internet, instead of being redirected back at your Untangle for routing to the OpenVPN cloud.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  7. #7
    Untanglit
    Join Date
    Jan 2008
    Posts
    18

    Default

    Progress!

    I disabled the Route VPN traffic that would go through the bridge option and instead went with the alternative of
    OpenVPN would need a static route on your router
    having seen this suggested in your thread and another regarding OpenVPN in Bridge mode.

    After adding a static route on the router from 172.16.16.0 / 255.255.255.0 to 192.168.1.8 (UT's IP) I am now able to successfully access single IP hosts that I have exported. I will continue to test but looks like the static route was what I required. Thanks for helping me to look in the right direction.

    I understand that the Advance Packet Filter option is supposed to bypass the need for a Static Route but in my case it did not seem to help.

    If one of these options are the norm for OpenVPN to work in bridged mode then perhaps a note should be added to the Wiki. Happy to add something myself but as I'm sure you have already determined my VPN knowledge is limited.

    Edit: Thanks sky-knight, was just submitting my progress report when you posted. With the help of gotkimchi I was able to figure out exactly what you just suggested and seem to have things working as required now. And yes, you are right, now I have the answer I realise how simple it is.
    Last edited by synner; 09-28-2009 at 12:19 PM.

  8. #8
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,497

    Default

    Glad you got it sorted, and I don't know why the "Route VPN traffic that would go through the bridge" is even there.

    Not only is it in direct violation of routing standards, but it doesn't WORK. At least not consistently enough for me to say it works. Having it on, and having the static route in place causes no harm either. I don't generally bother turning it off.

    But yes, Bridge mode needs that static route. As long as OpenVPN is going to work in a routed configuration, the default gateway needs the route. Or, all the clients are going to need a static route entry to compensate.
    Last edited by sky-knight; 09-28-2009 at 12:33 PM.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2