Not sure what kind of OpenVPN setup I need but mine's not it

sorny

I have a Raspberry Pi and I recently setup OpenVPN on it at home.

Forwarded ports, followed directions (http://readwrite.com/2014/04/10/raspberry-pi-vpn-tutorial-server-secure-web-browsing), and got it working.

While at work I can dial up to the VPN, connect successfully and access my devices on my LAN and all my Internet traffic is routed through my home router.

My problem is I don't want it setup this way but I'm not sure what I need to setup.

I want to be able to connect to the VPN at home and access all the machines in my home subnet but still be on my work network as normal. I don't want Internet traffic going through my router at home. I want 99% of my connection here at work to be the same but when I access anything on my home network (192.168.200.0/24) I can get to it.

What do I need to do? Setup up OpenVPN in bridge mode or keep it in routing and change something?

I appreciate any help. I've googled for 2 days and just gotten more confused reading about bridging because it sounds like what I want except that I'd then lose access to my work network.

sorny

Sorry, here is my server.conf:

local 192.168.200.50 dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/raspberrypi.crt
key /etc/openvpn/easy-rsa/keys/raspberrypi.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.200.50 255.255.255.0"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

----
I tried commenting out the push "redirect-gateway def1" because I thought that would do it and it didn't.

Here's my /etc/openvpn/easy-rsa/keys/default.txt, which I thought was the client config:

client
dev tun
proto udp
remote xxx.dnsdynamic.com
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20

---
Not sure if this matters but the instructions I followed online had me change /etc/sysctl.conf to add/uncomment the line:

net.ipv4.ip_forward=1

Hope this is what you meant by telling me to see the forums rules.

sorny

Thanks, I removed the push "redirect-gateway def1" line but didn't touch anything else.

Now when I connect I can't ping anything on the 192.168.200.0/24 subnet (home) while at work.

I *CAN* ping stuff in the 10.8.0.0 subnet like 10.8.0.1 and 10.8.0.6 (.6 is my PC at work I believe).

I did a "route add 192.168.200.0 mask 255.255.255.0 10.8.0.1" as I'm on Windows. That didn't help but thought it couldn't hurt.

My client on my PC at work displays this message after connecting:
Fri Aug 01 09:07:21 2014 Warning: address 192.168.200.50 is not a network address in relation to netmask 255.255.255.0

I can login to 10.8.0.1 using SSH and it's my pi. So it's just like it's not rounting to my 192.168.200.0/24 home network.

Is there something else I'm missing?

sorny

Thank you! That did it!

I changed the push route to 192.168.200.0 instead of 192.168.200.50 and it now works as I needed.

I thought the .50 seemed out of place because I figured I'd route the whole subnet but thought oh well that's what the howto page said on the raspberry pi site.

Thanks for all your help.