Topic: Local network invokation from bash

[ramasule]

This is a repost in the right forum (hopefully).

I would like to invoke the local network command in the gui from bash and/or add a local network to the system minus the addition to the routing table.

The problem I'm having is when my openvpn connects it cannot update the routing table if there is a entry in there already from the local network wizard. 

If I update the local network wizard after openvpn connects it works fine.

If I dont add a local network the firewall drops service packets like they are lastyears fasion.

My server ip is 192.168.11.1   its openvpn server is 192.168.100.1

My VPN Client is 192.168.12.1  its openvpn address is 192.168.100.4

My 2nd VPN Client is 192.168.14.1 its openvpn address is 192.168.100.8

The trusted network I want to allow is 192.168.100.0 / 255.255.255.0 / 192.168.11.1

Here is a link to pastebin of my routing tables in the 4 possible configureations
1. Trusted network then Openvpn  (didnt work)
2. Trusted network no openvpn
3. Openvpn no trusted network    (works for pinging clients but does not have dns / domain     service)
4. Openvpn then trusted network  (works)

http://pastebin.com/m39786f9b


When I compair the firewall rules before and after I get

[0:0] -A local_chk_8501 -s 192.168.100.0/255.255.255.0 -j ACCEPT

as a discrepancy and that is the rule I need however when I try to either add the rule manually or expand a template like in the howto it does not work / show up.


So what I'm trying to accomplish is a script that will add this local network so I may put it in my openvpn startup.

I am really new to linux / scripts / iptables / sme so the more you can help the better.

Thank you for your time,

Derek L

[CharlieBrady]

I am assuming that you are using an openvpn contrib package which integrates openvpn with SME server. If you are, then it doesn't work correctly (as you want it to), so you should report a bug via the Bug Tracker. If you are not using a contrib package, then you should use one, since the integration work has already been done for you.

You are asking "How do I do X?", when you should be saying "I have problem X, how is the best way to fix that?".

[ramasule]

http://wiki.contribs.org/SME_Server:Documentation:Administration_Manual:Chapter11#Local_networks

No I am not using a contrib, I am using the Openvpn server base install.  But that is besides the point.
All I want to know is when I log into the my sme gui there is a link called "Local Networks"  I want to add the network 192.168.100.0 as a local network because then it allows dns and other services originating from that network. 
I want to do this via bash though so I can write it in a script.

OR even better I would like to know what/where this local network adds configs to the firewall / whatever else and just manually enter that rule into the firewall/whateverelse.
I have tried the how to on expanding rules into the firewall and it didnt stick.
http://wiki.contribs.org/Firewall

Thank you for your time,

Derek L

[Stefano]

ramasule: IMHO you'd try the openvpn contrib as (maybe) it already does what you are asking for.

if it does not, you can open a NFR in bugzilla against that contrib.

since you are trying to modify SME default behaviour, if you decide not to use the contrib, you'd read the developers documentation and do it yourself..

hth
ciao
Stefano

[ramasule]

The openvpn contrib is for tap devices not tun.

I would really like to get this working as it would provide the sme and openvpn community a great server with linksys routers as vpn clients to remote networks.

I just want to know what the local networks gui does / what rules it implements and build a script for that thats it.

[Daniel B.]

The openvpn contrib is for tap devices not tun.

Why is this a problem ? linksys routers can connect to my smeserver-openvpn-bridge contrib (at least with openWRT). Using tap device may degrade performances, but I'd be surprised if the difference is noticeable. The big advantage of using tap, and bridged mode, is that you don't have to bother with routing and firewall rules

[ramasule]

Because everyone in the openvpn community says TUN TUN TUN, plus it has the option to be a larger scalability then TAP.  IE each router has its own subnet with 254 clients. 

Also mostly because I want this to be an option and to help the community.

[CharlieBrady]

Also mostly because I want this to be an option and to help the community.

Great. Start working on your own contrib (or vary the one which already exists). Open a New Feature Request on the bug tracker, and start contributing your code. Ask for development advice on the devinfo mailing list.