0

I have a LAN at home. It is behind a NAT and externally uses dynamic IP addresses. Inside my home LAN, I use 192.168.1.x IP addresses.

Further, I have a VPS, which has a IP 185.x.x.x address. What I would like to do now is to use OpenVPN to set up a tunnel between my home LAN and the VPS, such that the VPS can access shared files in my home LAN.

I already have set up OpenVPN and all certificates etc. using OpenSSL. When I run

openvpn --config server.conf

on the VPS and

openvpn --config client.conf

on a PC in my LAN, a VPN connection is established and both the VPS and the PC get a TUN device having a 10.8.x.x IP address. So far OK, it seems that these two computers are connected, and I don't see any error messages.

However, I don't know how I shall proceed.

This is my server.conf:

server 10.8.0.0 255.255.255.0
verb 3
key /etc/openvpn/server/server.key
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
dh /etc/openvpn/server/dh.pem
keepalive 10 120
persist-key
persist-tun
comp-lzo
route 192.168.1.0 255.255.255.0

dhcp-option DNS 192.168.1.1

user nobody
group nobody

proto udp
port 1194
dev tun1194
status openvpn-status.log

and this is my client.conf:

client
nobind
dev tun
redirect-gateway def1 bypass-dhcp
remote 185.x.x.x 1194 udp
comp-lzo yes

redirect-gateway def1

key /etc/openvpn/client.key
cert /etc/openvpn/client.crt
ca /etc/openvpn/ca.crt

How should I configure the client and the server, such that I can send traffic on the VPS into my LAN? (e.g. mount a SMB/CIFS share like 192.168.1.2 on the VPS)

Ideally, the VPN connection would use the router at my home as DHCP server, if that's possible. I tried that using the dhcp-option, but it didn't have an effect. It also seems like it does not route traffic from the VPS to my LAN, e.g. I cannot do a ping 192.168.1.2 on my VPS (which I would expect should be possible).

Further, is it possible to connect a further PC from the interner to the VPN server running on the VPS, and the third PC can also access my home LAN? Like so:

Some PC on the internet <---> VPS <---> VPN tunnel <---> Home LAN
0

To establish routing between subnets you need to advertise these subnets. Look into using the push "route 192.168.1.0 255.255.255.0" option. See the OpenVPN documentation, expecially https://community.openvpn.net/openvpn/wiki/BridgingAndRouting.

The IP adresses in use by the client and server OpenVPN tun interfaces on a site-to-site OpenVPN tunnel (=point-to-point with routing) are just what you declare them to be.

0

I made a bit of progress. Using this config on the server

server 10.8.0.0 255.255.255.0
verb 3
key /etc/openvpn/server/server.key
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
dh /etc/openvpn/server/dh.pem
keepalive 10 120
persist-key
persist-tun
comp-lzo

route 192.168.1.0 255.255.255.0

push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"

push "redirect-gateway def1 bypass-dhcp"

user nobody
group nobody

proto udp
port 1194
dev tun1194
status openvpn-status.log

and

client
nobind
dev tun
redirect-gateway def1 bypass-dhcp
remote 185.x.x.x 1194 udp
comp-lzo yes

redirect-gateway def1

#iroute 192.168.1.0 255.255.255.0

key /etc/openvpn/client.key
cert /etc/openvpn/client.crt
ca /etc/openvpn/ca.crt

on the client, I get following routing tables after the OpenVPN connection is established:

server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway.netcup. 0.0.0.0         UG    100    0        0 ens3
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun1194
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun1194
185.x.x.x       0.0.0.0         255.255.252.0   U     100    0        0 ens3
192.168.1.0     10.8.0.2        255.255.255.0   UG    0      0        0 tun1194

client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
default         gateway         0.0.0.0         UG    0      0        0 eth0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
link-local      0.0.0.0         255.255.0.0     U     1118   0        0 eth0
185.x.x.x       gateway         255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

however, it is still not possible to ping 192.168.1.1 from the server. Of course I enabled IP forwarding on the client

sysctl -w net/ipv4/ip_forward=1

and I tried also to configure the iptables on the client:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.