Hi,
I'm doing a small hobby project for which I need external Internet user to connect to my device which is inside home VPN.
First of all, sorry for my ignorance, I am not a network administrator in any stretch of imagination, this is not my domain. For that reason, it is very hard for me to simply "look at the man page" or "look at the forum example" because I do not know what to look for. For the same reason, anything I write (or draw) might be wrongly worded or even fundamentally wrong. Apologies for that in advance.
So this is my network topology:
My use-case is that I want random user (on the left) to be able to access HTTP server running on the mobile phone (right). This user will not be part of the VPN.
Mobile phone with web server is connected to the Internet over 3G. It has OpenVPN Connect installed and is successfully joining the VPN network hosted on the home server (middle). For that I had to set up port forwarding on home router (ISP provided) so that phone can reach VPN server (port 1194 -> 192.168.1.10:1194). I can successfully access http server from home server by using 10.8.0.2:8080.
The problem (and a question) arises when user on the left needs to access my http server on the right. I can not access it by its telecom assigned IP because it is private IP behind the telecom router. On the other hand, if I would like to access it with its VPN IP then my issue is how to do port forwarding on home router because as I understand it, my home router is not aware of the VPN and I can't just set up forwarding to VPN IP inside my VPN network (e.g. Port 8080 -> 10.8.0.2:8080). Even if that would work, my home router allows me to have only one LAN subnet (192.168.1.x). I tried to configure my VPN to run on the same subnet but it still didn't work and even my local network started to break (as I understand it is caused by conflicting subnets).
So what I figured is that OpenVPN itself provides some configuration means for traffic forwarding (iptables and route) but this is where I get completely mindblown as those command require lots of attributes which I do not know how to interpret. I believe I would need to set up port forwarding on home router to route traffic to home server local IP (not VPN) 192.168.1.10 and from there on VPN server would somehow take over and forward the traffic to VPN client 10.8.0.2. It would also need to manage traffic translation when traffic is coming from VPN client (10.8.0.2) to home VPN server (10.8.0.1) so that traffic can successfully reach originating smartphone (user on the left).
I would really appreciate your help!
Is there any example or tutorial specific for my usecase?
Is my usecase even managable?
Do I need to attach my current config? I am not experiencing any specific issues with my config, just asking how to proceed.
How to connect to VPN network from Internet?
Moderators: TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
-
- OpenVpn Newbie
- Posts: 3
- Joined: Thu May 04, 2017 8:09 am
-
- OpenVPN Protagonist
- Posts: 11137
- Joined: Fri Jun 03, 2016 1:17 pm
Re: How to connect to VPN network from Internet?
You may need a better router.Patothief wrote:my home router allows me to have only one LAN subnet (192.168.1.x).
What you want is not difficult but it also has very little to do with openvpn itself.
You need:
- A public presence for the external user to connect to. eg. DNS name
- A port forwarded on your router .. to the target VPN host HTTP server.
- Necessary routing between the router .. and the VPN host HTTP server.
- A suitable* openvpn setup. (* See below)
Time to step-up and get googlingPatothief wrote:I am not a network administrator in any stretch of imagination
Posting your current server config* would give us some idea of how far you have come and where to look next ..Patothief wrote:Do I need to attach my current config? I am not experiencing any specific issues with my config, just asking how to proceed
-
- OpenVpn Newbie
- Posts: 3
- Joined: Thu May 04, 2017 8:09 am
Re: How to connect to VPN network from Internet?
Thanks a lot for response!
Replacing it with another router might be a problem because this is a leased pre-configured router for fiber access and I wouldn't want to invest into another one plus even if I would I wouldn't know how to configure it for Internet access. I'm not sure that my ISP would share the config with me.
Does that mean that I will not be able to achieve my setup with current router?TinCanTech wrote:You may need a better router.
Replacing it with another router might be a problem because this is a leased pre-configured router for fiber access and I wouldn't want to invest into another one plus even if I would I wouldn't know how to configure it for Internet access. I'm not sure that my ISP would share the config with me.
Done that with NoIp free service. I just didn't want to complicate my presentation here with that.TinCanTech wrote:[*]A public presence for the external user to connect to. eg. DNS name
That would be: Port 8080 -> 10.8.0.2:8080 in my example?TinCanTech wrote:[*]A port forwarded on your router .. to the target VPN host HTTP server.
What would this mean for my setup?TinCanTech wrote:[*]Necessary routing between the router .. and the VPN host HTTP server.
Ok, will include it.TinCanTech wrote:[*]A suitable* openvpn setup. (* See below)[/list]
Definitely! But I just can't stretch myself any more since my project includes web programming, android programming, electronics and mechanical engineering (basically it is a remote controlled robot).TinCanTech wrote:Time to step-up and get googling
Here it is:TinCanTech wrote:Posting your current server config* would give us some idea of how far you have come and where to look next ..
Server Config
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 4
explicit-exit-notify 1
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 4
explicit-exit-notify 1
Client Config
client
dev tun
proto udp
remote x.x.x.x xxxx
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert samsung.crt
key samsung.key
verb 3
dev tun
proto udp
remote x.x.x.x xxxx
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert samsung.crt
key samsung.key
verb 3
-
- OpenVPN Protagonist
- Posts: 11137
- Joined: Fri Jun 03, 2016 1:17 pm
Re: How to connect to VPN network from Internet?
I don't know .. all I know is what you posted and that suggests your ISP provided router may not be suitable.Patothief wrote:Does that mean that I will not be able to achieve my setup with current router?
As for your current configs .. you have not read and learned enough yet, start here:
HOWTO: For OpenVPN Community Edition
Specifically : Expanding the scope ..
Please do not post the public IP of your server. (now removed)
-
- OpenVpn Newbie
- Posts: 3
- Joined: Thu May 04, 2017 8:09 am
Re: How to connect to VPN network from Internet?
To rephrase my question: is it possible to access client inside the VPN tunnel from client that is not inside the VPN network?
Client A, which is not inside VPN network sends packet to VPN server and VPN server encapsulates it into VPN tunnel and sends it to destination VPN client private IP. Then VPN client sends response to VPN server which extracts packet from tunnel and forwards it back to non-VPN client.
I do not want split-channel because I really want the communication between the VPN client and VPN server to flow through the VPN. I am not using VPN for security but rather just for connectivity. The reason is that my HTTP server is running on a smartphone which has private IP address and I wouldn't be able to see it without the VPN tunnel.
Client A, which is not inside VPN network sends packet to VPN server and VPN server encapsulates it into VPN tunnel and sends it to destination VPN client private IP. Then VPN client sends response to VPN server which extracts packet from tunnel and forwards it back to non-VPN client.
I do not want split-channel because I really want the communication between the VPN client and VPN server to flow through the VPN. I am not using VPN for security but rather just for connectivity. The reason is that my HTTP server is running on a smartphone which has private IP address and I wouldn't be able to see it without the VPN tunnel.
-
- OpenVPN Protagonist
- Posts: 11137
- Joined: Fri Jun 03, 2016 1:17 pm
Re: How to connect to VPN network from Internet?
Yes it is .. that section of the how to is a guide to get you started.Patothief wrote:To rephrase my question: is it possible to access client inside the VPN tunnel from client that is not inside the VPN network?