Debian OpenVPN listen on eth0?

Question

I have a Debian 7 machine with an OpenVPN client and several services. The OpenVPN client does work as intended and all outgoing traffic from the Debian machine flows over the VPN connection (tun0). However, the local network connection (eth0) should be accepting connections for the services I run on the machine (e.g. a web server) and those should be accessible for local machines. How can I allow this?

eth0      Link encap:Ethernet  HWaddr 08:00:27:8f:6d:ce
          inet addr:192.168.1.121  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fe8f:6dce/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:928 errors:0 dropped:0 overruns:0 frame:0
          TX packets:836 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:189364 (184.9 KiB)  TX bytes:118000 (115.2 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:172.16.144.186  P-t-P:172.16.144.185  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
          TX packets:44 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:486
          RX bytes:107 (107.0 B)  TX bytes:3092 (3.0 KiB)

Answer 1

There are some requirements to your setup to accomplish this:

1. Make sure that net.ipv4.ip_forward = 1 in /etc/sysctl.conf, this will allow traffic to pass through the OpenVPN box, making it work as a router.
2. eth0 and tun0 are on different subnets. Make sure that your clients have a route towards the OpenVPN box for the VPN subnet, and make sure that your servers have a route towards their VPN interface for the client subnet.

This is not very easy to do right, so it might be easier to use a part of the 192.168.1.0/24 subnet for your VPN, and use proxy-arp to handle the routing. You can find more about this in the OpenVPN Cookbook.