I have an OpenVPN server running on a DD-WRT router. I can connect to this server from several machines and have it setup to redirect internet traffic to VPN. This is working on a Windows desktop and Windows 8 laptop. The desktop is hardwired to the network and has access to the internet. When connected to the VPN, all internet traffic is routed through the VPN. When the VPN is disconnected, all internet traffic is routed through the network.
As this is a corporate network, there are several subnets (local: 192.168.4.x and WAN:10.x.x.x). The VPN is on 192.168.3.x. The local network is on 192.168.4.x, so I had to add a route on the physical NIC to the 191.168.4.1 gateway for the 10.0.0.0 subnet when the VPN is connected. All this works great! I can access local resource and route internet through VPN on the desktop.
Since there is no WI-FI, I have setup a hosted network using the desktop's built in WI-FI. I set it up so the VPN adapter shares it's internet, so when the laptop is connected to this hosted network, all internet traffic is routed through the desktop's VPN connection (works great!).
Here is were my problem is. While the laptop has internet access, it cannot access local network resources. I can ping any public IP and the WI-FI host gateway (192.168.137.1), but I cannot ping any local IPs (192.168.4.1, 10.x.x.x). The desktop is connected to the VPN and the laptop is not. I have tried adding routes on the desktop to connect the two subnets, but I cannot figure out what routes to add
Here is my setup:
+------------------------+
+--------------+ | Desktop |
| Laptop | |------------------------|
|--------------+----+Hosted WI-Fi+----+192.168.137.1 WI-FI Host|
|192.168.137.81| |192.168.3.200 VPN |
+--------------+ |192.168.4.45 Network |
+------------+-----------+
|
|
|
+----------------+ +-----------------+ |
|Network Resource| |Corporate Network| |
|----------------+------+-----------------+---------+
| 10.x.x.x | | 192.168.4.1 |
+----------------+ +-------+---------+
|
+---+----+
|INTERNET|
+---+----+
|
|
|
+----+------+
| VPN |
|-----------|
|192.168.3.1|
+-----------+
Here is my server OpenVPN config:
mode server
proto udp
port 1194
dev tap0
# Gateway (VPN Server) Subnetmask Start-IP End-IP
server-bridge 192.168.3.1 255.255.255.0 192.168.3.200 192.168.3.220
cipher aes-256-cbc
keepalive 10 120
daemon
log /tmp/openvpn.log
verb 3
client-to-client
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
Here is my desktop client config:
remote vpn.xxx.com 1194
client
dev tap
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
redirect-gateway
ca ca.crt
cert xxx.crt
key xxx.key
cipher aes-256-cbc
ns-cert-type server
This is the server firewall
iptables -A INPUT -i tap0 -j ACCEPT
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -A FORWARD --src 192.168.3.0/24 -j ACCEPT
iptables -A FORWARD -i br0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o br0 -j ACCEPT
And here is the desktop route tables:
===========================================================================
Interface List
29...00 ff 8e 7f 99 3e ......TAP-Win32 Adapter V9
15...10 0b a9 7b 5d 35 ......Microsoft Virtual WiFi Miniport Adapter
14...10 0b a9 7b 5d 34 ......Intel(R) Centrino(R) Advanced-N 6205
13...9c 8e 99 d2 46 6c ......Intel(R) 82579LM Gigabit Network Connection
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
12...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.200 30
10.0.0.0 255.0.0.0 192.168.4.1 192.168.4.45 200
10.0.0.0 255.0.0.0 192.168.4.1 192.168.137.1 200
10.0.0.0 255.0.0.0 192.168.4.1 192.168.3.200 200
75.xx.xx.xxx 255.255.255.255 192.168.4.1 192.168.4.45 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.3.0 255.255.255.0 On-link 192.168.3.200 286
192.168.3.200 255.255.255.255 On-link 192.168.3.200 286
192.168.3.255 255.255.255.255 On-link 192.168.3.200 286
192.168.4.0 255.255.255.0 On-link 192.168.4.45 276
192.168.4.45 255.255.255.255 On-link 192.168.4.45 276
192.168.4.255 255.255.255.255 On-link 192.168.4.45 276
192.168.137.0 255.255.255.0 On-link 192.168.137.1 281
192.168.137.1 255.255.255.255 On-link 192.168.137.1 281
192.168.137.255 255.255.255.255 On-link 192.168.137.1 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.137.1 281
224.0.0.0 240.0.0.0 On-link 192.168.3.200 286
224.0.0.0 240.0.0.0 On-link 192.168.4.45 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.137.1 281
255.255.255.255 255.255.255.255 On-link 192.168.3.200 286
255.255.255.255 255.255.255.255 On-link 192.168.4.45 276
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
13 276 fe80::/64 On-link
13 276 fe80::b969:97c1:cba8:df7e/128
On-link
1 306 ff00::/8 On-link
13 276 ff00::/8 On-link
===========================================================================
Any help getting this working is greatly appreciated.
Thanks
