0

I have a LAN at home. It is behind a NAT and externally uses dynamic IP addresses. Inside my home LAN, I use 192.168.1.x IP addresses.

Further, I have a VPS, which has a IP 185.x.x.x address. What I would like to do now is to use OpenVPN to set up a tunnel between my home LAN and the VPS, such that the VPS can access shared files in my home LAN.

I already have set up OpenVPN and all certificates etc. using OpenSSL. When I run

openvpn --config server.conf

on the VPS and

openvpn --config client.conf

on a PC in my LAN, a VPN connection is established and both the VPS and the PC get a TUN device having a 10.8.x.x IP address. So far OK, it seems that these two computers are connected, and I don't see any error messages.

However, I don't know how I shall proceed.

This is my server.conf:

server 10.8.0.0 255.255.255.0
verb 3
key /etc/openvpn/server/server.key
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
dh /etc/openvpn/server/dh.pem
keepalive 10 120
persist-key
persist-tun
comp-lzo
route 192.168.1.0 255.255.255.0

dhcp-option DNS 192.168.1.1

user nobody
group nobody

proto udp
port 1194
dev tun1194
status openvpn-status.log

and this is my client.conf:

client
nobind
dev tun
redirect-gateway def1 bypass-dhcp
remote 185.x.x.x 1194 udp
comp-lzo yes

redirect-gateway def1

key /etc/openvpn/client.key
cert /etc/openvpn/client.crt
ca /etc/openvpn/ca.crt

How should I configure the client and the server, such that I can send traffic on the VPS into my LAN? (e.g. mount a SMB/CIFS share like 192.168.1.2 on the VPS)

Ideally, the VPN connection would use the router at my home as DHCP server, if that's possible. I tried that using the dhcp-option, but it didn't have an effect. It also seems like it does not route traffic from the VPS to my LAN, e.g. I cannot do a ping 192.168.1.2 on my VPS (which I would expect should be possible).

Further, is it possible to connect a further PC from the interner to the VPN server running on the VPS, and the third PC can also access my home LAN? Like so:

Some PC on the internet <---> VPS <---> VPN tunnel <---> Home LAN

2 Answers 2

0

To establish routing between subnets you need to advertise these subnets. Look into using the push "route 192.168.1.0 255.255.255.0" option. See the OpenVPN documentation, expecially https://community.openvpn.net/openvpn/wiki/BridgingAndRouting.

The IP adresses in use by the client and server OpenVPN tun interfaces on a site-to-site OpenVPN tunnel (=point-to-point with routing) are just what you declare them to be.

0

I made a bit of progress. Using this config on the server

server 10.8.0.0 255.255.255.0
verb 3
key /etc/openvpn/server/server.key
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
dh /etc/openvpn/server/dh.pem
keepalive 10 120
persist-key
persist-tun
comp-lzo

route 192.168.1.0 255.255.255.0

push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"

push "redirect-gateway def1 bypass-dhcp"

user nobody
group nobody

proto udp
port 1194
dev tun1194
status openvpn-status.log

and

client
nobind
dev tun
redirect-gateway def1 bypass-dhcp
remote 185.x.x.x 1194 udp
comp-lzo yes

redirect-gateway def1

#iroute 192.168.1.0 255.255.255.0

key /etc/openvpn/client.key
cert /etc/openvpn/client.crt
ca /etc/openvpn/ca.crt

on the client, I get following routing tables after the OpenVPN connection is established:

server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway.netcup. 0.0.0.0         UG    100    0        0 ens3
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun1194
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun1194
185.x.x.x       0.0.0.0         255.255.252.0   U     100    0        0 ens3
192.168.1.0     10.8.0.2        255.255.255.0   UG    0      0        0 tun1194

client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
default         gateway         0.0.0.0         UG    0      0        0 eth0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
link-local      0.0.0.0         255.255.0.0     U     1118   0        0 eth0
185.x.x.x       gateway         255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

however, it is still not possible to ping 192.168.1.1 from the server. Of course I enabled IP forwarding on the client

sysctl -w net/ipv4/ip_forward=1

and I tried also to configure the iptables on the client:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .