I have finally setup my VPN server on my router (Netgear R7000 running Asua Merlin WRT). I am able to connect from my Openvpn client (laptop for now - later I will setup another R7000 as a client). However, I am unsure whether I am really running all my traffic through the tunnel - maybe I don't need to - but here are my goals:
1. My VPN-server is here in Denmark and I want to let my brother in USA connect to the VPN, so he obtains a Danish IP that can be used to access news and tv-shows that are restricted for Danish people. After connection the VPN client seems to have the same public IP, so I am unsure that my brother will avoid the country restrictions
2. I can access the router admin page where the VPN server is located but I am unable to access any other machines on the home LAN from the client. I would like to "trick" the client into seeing one of the machines behind the routher/VPN as being part of the client LAN. Is this possible without TAP? The reason is that this would make it possible for my brother to install hdhomerun drivers on his client in USA and use my tv-tuner in Denmark to watch Danish TV from my LAN. I have tried installing the drivers on the client but the hdhomerun software is unable to find the tv-tuner on my LAN.
3. Unrelated bonus question: Should I be running on UDP instead of TCP? Or does this article not concern me? :?
http://sites.inka.de/~bigred/devel/tcp-tcp.html
I have a fixed public IP 62.107.xx.xx and my VPN and router is running on 192.168.2.1
server config:
# Automatically generated configuration
daemon
topology subnet
server 10.8.0.0 255.255.255.0
proto tcp-server
rcvbuf 0
sndbuf 0
port 1194
dev tun21
cipher AES-128-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.2.0 255.255.255.0"
duplicate-cn
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
# Custom Configuration
Client config
client
;dev tap
dev tun0
;dev-node MyTap
;proto tcp
proto tcp
remote 62.107.xx.xx 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
;tls-auth ta.key 1
cipher AES-128-CBC
comp-lzo
verb 3
;mute 20
IPtables
iptables -I INPUT 1 -p tcp –dport 1194 -j ACCEPT
iptables -I FORWARD 1 –source 10.8.0.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
