haertig
Hi everyone -
First post as a newbie here. Unfortunately it's kind of long. What I am looking for is a validation of my planned setup below, or suggestions of better ways to accomplish what I want.
Thanks in advance!
===
Desired setup:
(A) VPN server will be a Linksys WRT54GL router running Tomato by Shibby firmware, which implements OpenVPN server. iptables is also implemented in the Tomato by Shibby firmware. This router will control VPN access to my home LAN.
(B) VPN client #1 will be my Linux laptop, which should route ALL network traffic over the established VPN, and have access to every IP address/port on my home LAN. I have already installed OpenVPN on this laptop.
(C) VPN client #2 will be my daughters Windows laptop, which will have access to only a few specific ports (both tcp and udp) on one specific IP address within my home LAN. This specific IP and ports relate to a media server, specifically PLEX. Access to this media server which will be via HTTP. All other network traffic should NOT route over the VPN. I will be installing OpenVPN on this laptop at some time in the future.
(D) VPN client #3 will be an Apple iPad, which will have the same access and restrictions as VPN client #2. This tablet will only be accessing the media server via HTTP, same as VPN client #2. I have already installed OpenVPN on this tablet.
(E) VPN client #4 will be my son's Buffalo WHR-G54S router running Tomato firmware by Shibby, which implements OpenVPN client. All IP's on my son's LAN behind this Buffalo router will have the same access and restrictions as VPN client #2. Things on my son's LAN will be accessing only the media server, but in two ways - via HTTP and also via DLNA. Things on his LAN include a Windows 8 laptop, XBOX-360's, XBOX-ONE's, a Roku, an audio receiver capable of network streaming, etc.
None of the VPN clients should be able to communicate with each other, they only need to individualy communicate with my home LAN.
In the case of client #4, my son's LAN, my home LAN does NOT need to initiate communication to his LAN, he will initiate all communication. Only the media server on my LAN needs to respond back to connections initiated from his end.
The reason I want to restrict access for clients #2-#4 is because I do not directly control those. Who knows what malware may exist there, so when allowing them connection to my home LAN I want to limit access as tightly as possible,
The reason I don't want clients #2-#4 to route all traffic over the VPN, is because I don't want them wasting MY bandwidth for internet access they can do on their own. I'll grant them bandwidth to access my media server, but no more than that.
===
Here is my plan on how to implement the above:
(1) I am using a routed VPN over udp port 1194.
(2) I have ccd directories setup on the VPN server so that I may assign a fixed IP address to each client.
(3) I plan to create firewall rules based on the assigned IP client addresses (fixed) to implement the access/restrictions for each client individually.
(4) The ccd directory will allow me to push different things to each client, since one client will be directed to route all traffic over the VPN (my laptop) and all the other clients should NOT route all traffic over the VPN, only the traffic needed for media server access.
(5) For client #1, my laptop that will have full access to my home LAN and route all traffic over the VPN, I plan this: push "redirect-gateway def1" (this will be in the ccd file for the laptops CommonName)
(6) For all other clients, which will have restricted access and should NOT route all traffic over the VPN, I plan this: push "route 10.192.168.0 255.255.255.0" (this will be in the appropriate ccd CommonName files). As you can guess, my home LAN is 10.192.168.0/24. My son's LAN is 10.0.0.1/24. I don't know what my daughters LAN IP address is, but I'm guessing it's probably something on 192.168.0.0/24. I will find that out next time I see her.
(Note: I have had some problems with this "push route" command in my testing. It is not working as I would expect. I will detail those findings in a followup post.)
I'll skip detailing my plans for the iptables rules because that's a different topic, not one necessarily for the OpenVPN forums.
===
Other notes:
The Tomato firmware on my home router supports two independent VPN server instances. I thought of using my Linux laptop client #1 on one VPN instance, and all other clients on the second instance. Then I could set up firewall rules based on which tun interface was used rather than basing them on the IP address. But I abandoned that idea because it really doesn't add anything that I can't do by assigning fixed IP's to each client. Also, I can now reserve that second VPN instance to run on something like tcp port 443, which could be used as a secondary VPN for my laptop should I run into a strict firewall that blocks udp/1194. Chances are, even a strict firewall would allow tcp/443.
haertig
No, my local LAN is 10.192.168.0/24 not 192.168.0.0/24 I did that on purpose, specifically to avoid routing conflicts. But thanks for pointing that out though. I'm sure there are many who might make that exact mistake of using a too common subnet for their LAN.
haertig
BTW, I got everything working just as I want it while waiting for my forum thread to get approved by moderators and posted (that took quite a while, I was surprsed). So I am good to go now. It all works perfectly. Thanks.
