How to allow VPN client to use their local internet for browsing

[RixwanSaleem]

I have configured Ikev2 VPN server road warrior using strongswan package on centos 8 and it works fine. when clients connect they use remote site internet for browsing how to allow client to use their internet here is below my IP tables and firewall rules.

iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N LIBVIRT_INP
-N LIBVIRT_OUT
-N LIBVIRT_FWO
-N LIBVIRT_FWI
-N LIBVIRT_FWX
-A INPUT -j LIBVIRT_INP
-A FORWARD -j LIBVIRT_FWX
-A FORWARD -j LIBVIRT_FWI
-A FORWARD -j LIBVIRT_FWO
-A OUTPUT -j LIBVIRT_OUT
-A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT
-A LIBVIRT_FWO -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT
iptables -S INPUT

-P INPUT ACCEPT
-A INPUT -j LIBVIRT_INP
iptables -S OUTPUT

-P OUTPUT ACCEPT
-A OUTPUT -j LIBVIRT_OUT
iptables -L

Chain INPUT (policy ACCEPT)
target prot opt source destination
LIBVIRT_INP all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
LIBVIRT_FWX all -- anywhere anywhere
LIBVIRT_FWI all -- anywhere anywhere
LIBVIRT_FWO all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
LIBVIRT_OUT all -- anywhere anywhere

Chain LIBVIRT_INP (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp dpt:bootps

Chain LIBVIRT_OUT (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootpc
ACCEPT tcp -- anywhere anywhere tcp dpt:bootpc

Chain LIBVIRT_FWO (1 references)
target prot opt source destination
ACCEPT all -- 192.168.122.0/24 anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain LIBVIRT_FWI (1 references)
target prot opt source destination
ACCEPT all -- anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain LIBVIRT_FWX (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

firewall-cmd --list-all

public (active)
target: default
icmp-block-inversion: no
interfaces: eno1 enp0s20f0u14
sources:
services: cockpit dhcpv6-client http https ipsec openvpn ssh
ports: 500/udp 4500/udp
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule protocol value="esp" accept
rule protocol value="ah" accept

[Thermi]

That doesn't depend on the firewall of the server but on the configuration of the client, specifically the negotiated traffic selector.

[Thermi]

Depends on the exact TS. If you only allow traffic to the networks of the remote LAN from the VIPs assigned to the RWs through the tunnel, then the RWs should not try to connect to any Internet hosts through the tunnel. But that is ultimately up to them. The negotiated TS forbids it, but clients like the integrated Windows VPN client don't behave rationally in that regard.

[RixwanSaleem]

Thank You for very detailed explanations
im currently stucked with this issue .Due to Covid our entire team (700 Plus Employees) working from home over Ikev2 VPN
how can i force them to use local internet instead of office .

[Thermi]

What clients are they using?

[RixwanSaleem]

sorry for late response
the dont use any client software its configure on device .it will good if you recommend any client software

[Thermi]

What do you mean? Something has to implement IKE and IPsec. Are you using Windows and setting it up using GPOs, or something?