Client Access to LAN Subnet over Internet w/o VPN

ashtonjackson

In my configuration (see the "drawing" below), a client needs to be able to access a web server in the remote private LAN without having to establish a VPN connection to anything. The EdgeRouter Lite dynamic WAN address can be behind a NAT firewall which we have no control over, so a dynamic DNS is not an option. The VPN connection between the ERL and OpenVPN server is working perfectly. Clients on the Internet who do connect a VPN to the OpenVPN server have full access to the remote client LAN (as they should).

What I'm missing is how to configure the OpenVPN server to allow a client without a VPN connection access to only the Web Server in the remote private LAN (port 80). Any advice is greatly appreciated!
__________________
________ @@@@@@@@@@@ | OpenVPN Server |
| Client |---------@ Internet @-------| Eth0: 1.2.3.4 |
------- @ @ ---------------
@@@@@@@@@@@
|
|
| _______________________
| | EdgeRouter Lite |
|---| Eth0: Dynamic WAN |
| |
|--- | Eth 1: 192.168.1.1 |
| -------------------
|
|
------------------------
|Remote Private LAN |
|Web Server: 192.168.1.21 |
------------------------

As a sidenote, I've tried adding this to the iptables config to no avail:
sysctl -w netipv4.ip_forward=1
iptables -t nat -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j DNAT --to-dest 192.168.1.21:80
iptables -t nat -A POSTROUTING -d 192.168.1.21 -p tcp --dport 80 -j SNAT --to-source 192.168.1.1

Any help is greatly appreciated. Thanks!!

Traffic

ashtonjackson wroteWhat I'm missing is how to configure the OpenVPN server to allow a client without a VPN connection access to only the Web Server in the remote private LAN

You want to know how to allow Web clients access to your Web server ?

TiTex

i don't really understand your diagram

how is your vpn server connected to the EdgeRouter ? , i only see one NIC on your VPN server which is not on the same LAN as you router
do you have connectivity with 192.168.1.21 from you vpn server ?
do you have connectivity with 192.168.1.1 from your vpn server ?

ashtonjackson

My apologies... that diagram did NOT come across as it was expected to and I can't seem to add an attachment with a drawing!

To answer your questions and explain what my diagram was supposed to show:
A client, an OpenVPN Server (w/ Eth0 1.2.3.4), and an EdgeRouter (w/ Eth0 = a dynamic WAN) are all connected to the Internet.
Eth 1 of the EdgeRouter has IP 192.168.1.1, and is connected to a remote private LAN (192.168.1.0/24). On this LAN is a web server w/ IP 192.168.1.21.

Yes - I want to know how to allow Web clients to access the Web server without having to initiate a connection to a VPN, including the OpenVPN Connect tool.

Thanks for responding despite my jumbled post!

ashtonjackson

My image should be visible on the UBNT forum (see link).

http://community.ubnt.com/t5/EdgeMAX/Client-Access-to-LAN-Subnet-w-o-VPN/m-p/1293400#M70731

ashtonjackson

TiTex wrotehow is your vpn server connected to the EdgeRouter ?

The ER has a tun interface that maintains a constant connection w/ the OpenVPN server. Right now I can successfully connect to 192.168.1.21 and 192.168.1.1 from the OpenVPN server. Ideally, I want to be able to connect to TCP ports on those addresses by going to 1.2.3.4:x or 1.2.3.4:y.