i have a linux machine set up as a gateway between an isolated subnet and the rest of my network.
NAT is done via iptables and works fine.
# Generated by iptables-save v1.6.1 on Mon Nov 27 10:22:22 2017 *filter :INPUT ACCEPT [14459:13422943] :FORWARD DROP [323:21689] :OUTPUT ACCEPT [9723:3273357] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 10.112.0.0/16 -d 10.113.0.0/16 -i eth0 -o eth1 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.113.0.0/16 -i eth1 -o tun0 -m conntrack --ctstate NEW -j ACCEPT COMMIT # Completed on Mon Nov 27 10:22:22 2017 # Generated by iptables-save v1.6.1 on Mon Nov 27 10:22:22 2017 *nat :PREROUTING ACCEPT [795:105677] :INPUT ACCEPT [20:3379] :OUTPUT ACCEPT [12:777] :POSTROUTING ACCEPT [12:777] -A POSTROUTING -s 10.113.0.0/16 -o tun0 -j MASQUERADE COMMIT # Completed on Mon Nov 27 10:22:22 2017
If I connect via openVPN routes to redirect all traffic get pushed from the server and this also works fine.
0.0.0.0/1 via 10.211.1.142 dev tun0 default via 10.112.0.1 dev eth0 proto static 10.112.0.0/16 dev eth0 proto kernel scope link src 10.112.0.2 10.113.0.0/16 dev eth1 proto kernel scope link src 10.113.0.1 10.211.1.142 dev tun0 proto kernel scope link src 10.211.1.141 184.108.40.206 via 10.112.0.1 dev eth0 220.127.116.11/1 via 10.211.1.142 dev tun0
However I would like to only redirect the NATed traffic from the subnet 10.113.0.0 via the tun0 interface and let the gateway itself keep it's normal internet connection (for updated etc).
I thought adding route-nopull to my openvpn.conf would solve this since the traffic is redirected to tun0 by the iptable rules, but apparently this is not enough (the subnet clients cannot connect to the internet)
It seems I am only missing some simple ip route entry or something.