Adding a remote PC to LAN via VPN

rikisa

Hi all,

I just started using OpenVPN and am a bit baffled. Pleas be kind 😉

Some friends an me sometimes meet up for LAN Parties, but naturally there are always one or to who can't make it but want to join via a remote connection. We tried some commercial solutions (Tunngle, hamachi) but are somewhat repelled.

After diving into the topic we found several possible solutions for our problem (Masquerading, Forwarding, changing topology) and settled for bridging the VPN and the LAN, using TAP.

Our LAN consists of several Computers with IP from 192.168.2.0/24. The LAN is behind a router 192.168.2.1, which is also the Internet Gateway and DHCP Server. Unfortunately it is a cheap piece so no changes possible here besides port forwarding. The OpenVPN Server is behind the router. Now we want to connect a remote Computer, such that the remote computer is accessible in the same address space than all the other LAN Computers. I've drawn a picture which hopefully clarifies what we want to achieve (btw please excuse my poor English)

All computers run Win7/8/10, the VPN-Server runs Linux though.

What we tried so far is set up a simple VPN server (Tunneling) and connect to it remotely, which worked like charm. But the VPN connection had an other address space than the LAN Computers.

After further reading we decided for using a (server-)bridge and TAP. So we setup the bridge with bridge-utils, configured the gateway for the bridge (route add) and than started the VPN Server. Now the remote computer couldn't join at all.
I think we are missing something, but then again most of our efforts are copy and paste from different tutorials...

I attached the configs and logs. Thanks for reading! Also if there is a better approach, we are keen to learn something new!

start-script

#!/bin/bash

# iptables for propagating packages through all networks
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

# define iface names
br="br0"
tap="tap0"

# define network to be bridged
eth="eth0"
eth_ip="192.168.2.108"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.2.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

# create bridge between eth0 and tap0
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
    brctl addif $br $t
done

# make interfaces promiscure to send packages to kernel (but mainly because a tutorial told us to)
for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done
ifconfig $eth 0.0.0.0 promisc up

# configure bridge with correct address space and add route for gateway
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw 192.168.2.1 $br

# basicly the same as service openvpn start (I removed it from init.d/upated rc to prevent autostart on boot)
./openvpn-init start

server.conf

local 192.168.2.112

port 1194

proto udp

dev tap0

ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key  # This file should be kept secret
dh ./easy-rsa2/keys/dh1024.pem

ifconfig-pool-persist ipp.txt

# as far as we understood, we tell the VPN server where to listen, and which subnet to use for
# ip for clients
server-bridge 192.168.2.112 255.255.255.0 192.168.2.200 192.168.2.210

# we want everyone to have access to all resources be it LAN or VPN resource
client-to-client

# using it just for debugging
duplicate-cn

keepalive 10 120
comp-lzo
user openvpn
group openvpn
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 4

client.ovpn

client
dev tap

# name of TAP adapter is changed accordingly
dev-node EmsterTAP
proto udp
resolv-retry infinite
nobind
user openvpn
group openvpn
persist-key
persist-tun
ca "keys\\ca.crt"
cert "keys\\kuebelwagen.crt"
key "keys\\kuebelwagen.key"
ns-cert-type server
comp-lzo
verb 4

Traffic

rikisa wroteSo we setup the bridge with bridge-utils, configured the gateway for the bridge (route add) and than started the VPN Server. Now the remote computer couldn't join at all.

Can the client ping the OpenVPN server ?

Traffic

Please post your client log file of the failed connection.

rikisa

Traffic wrotePlease post your client log file of the failed connection.

Hi, thanks for the fast answer. I can't access the vpn server right now. We'll try pinging tonight. Also I'll post the logs of the connection attempt. Thanks!

btw: I found a mistake in my original post: the ip of the VPN-Server is - as stated in the server.conf - 192.168.2.112 and not the one shown in the image.
Also the remote computer is behind a router as well. But this shouldn't be a concern, as long as we soley want to add the remote computer itself, right?

rikisa

Okay, we did some testing today. Turns out I made a mistake on the serverside. I mixed up IP and fixed it.

The remote computer could join the via VPN and was added to the LAN, wohoo! We were able to share files via shared networkfolders on both in both directions. The remote computer was even able to print a page on the LAN attached printer.

We moved on and tested some lan gaming. The remote computer hosted some games (AoE 2, CS 1.6, BF 1942) and I could join his games with a LAN computer.
However, when I hosted the same games, the remote computer wouldn't find the LAN games. I already figured there might be a routing issiue but have no idea to solve the problem.

Pastebin links to the logs:
server.log
client.log

Traffic

If the game host is also the VPN host then you are taking a huge chunk of configuring out of the equation.
Otherwise, you are going to need to implement all this correctly and I cannot guarantee it will work for your games.
HOWTO: Expanding the scope of the VPN to include additional machines

Simple answer Host the games on the VPN server.

rikisa

I want to do it the hard way... the simple solution is still a fallback 😉 We really want the VPN server to just sit there silently in a corner and do it's job

If I am not mistaken we have to implement only the following steps, because we ar using TAP (I

You must bridge the client TAP interface with the LAN-connected NIC on the client.
You must manually set the IP/netmask of the TAP interface on the client.
You must configure client-side machines to use an IP/netmask that is inside of the bridged subnet, possibly by querying a DHCP server on the OpenVPN server side of the VPN.

which means:

1. On the client we need to bridge the TAP and Ethernetadapter. The bridge IP will be set up, that allows for connecting with the internet (same IP range as remote router and router as gateway).
2. the TAP interface IP is setup to match the VPN IP range. (is this even possible for a bridged device?)
3. the local IP subnet needs to be the same as the remote one

I still wonder why I can join a game from the LAN when the VPN-client is server but not vice versa. Seems like the client talks to the LAN as whole.

Traffic

rikisa wrotewhich means:
1. On the client we need to bridge the TAP and Ethernetadapter

Typically, it is theOpenVPN Server network [tap/eth] which is bridged not the client. See:
https://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html

rikisa wroteI want to do it the hard way

Good luck :ugeek: