OpenVPN as a connector between machines

5zymon

Hello,

I hope that what I need to do is possible. Unfortunately I need to use GSM connection at home as main main source of internet, the providers block all incoming connections and I would like to have access to my house from outside.

Right now I've set it up like this:

Raspberry Pi with GSM modem
VPS with OpenVPN server installed

The openvpn config is set to this server-bridge 192.168.1.0 255.255.255.0 192.168.1.210 192.168.1.220
(I can paste whole config)

When I connect to the OpenVPN I get one of the addresses from 210 and UP. Machines can see each other (because local interfaces are also set to 192.168.1.0 network), everything is good. But as a final solution I would like to have a router (already bought WNDR 4300 Netgear) with openwrt installed. I'll leave the VPS as a connector but I would like my router to connect to the VPS, not receive any address, and when I connect with other machine to VPS I would like my router to give that machine IP address from DHCP pool. To sum it up, I want OpenVPN server to only connect my DHCP server on router with the machine that is going to connect to the openvpn server. Is that even possile? ;-)

WNDR4300 ------ > OpenVPN server <--------- My Phone (for example) that is getting dhcp address from WNDR4300.

Traffic

5zymon wroteI would like my router to connect to the VPS, not receive any address, and when I connect with other machine to VPS I would like my router to give that machine IP address from DHCP pool

I don't think your approach is going to work .. However, openvpn can allow you to connect to your Pi from outside your home with the VPS server.

5zymon wroteThe openvpn config is set to this server-bridge 192.168.1.0 255.255.255.0

Unless you have a specific requirement you probably do not need a bridge. And setting your VPN subnet to 192.168.1.0/24 is a terrible idea ..

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server :!:

While I do not understand your approach you should read this, which explains how to route your client network over the VPN:
HOWTO: Expanding the scope of the VPN to include additional machines

5zymon

Hello,

Thank you for your reply.

Why is my approach wrong? :-) The way I've set up the bridge, was the only way for me to see machines on the other side (of the vpn server) as regular manichnes in the LAN. I know that 192.168.1.0/24 is a very common and I am aware of what conflicts it may cause. I was currently using this subnet in my home network (location A) and I wanted to see the machines in the other network (location B and same subnet), that was all I could figure out :-). This way virtual interface received 192.168.1.210 from openvpn server, and another virtual interface on the other machine got 192.168.1.211 - I was able to connect (even though physical address of the machine in the local network had let's say 192.168.1.3 addres).

Is this very uncommon to use VPS as a "middle-man" to connect to a local network at home for example? I just would preffer to see my router distributing the addresses - I thought it's the correct way of doing it. I am quite new to the whole OpenVPN thing, so maybe I am just looking at the wrong solutions.

Traffic

You might be able to use the DHCP server on your router to pass out IP addresses but it sounds too complicated and unnecessary .. but it is your choice.

If you use 192.168.1.0/24 as your VPN subnet expect network conflicts.

5zymon

Maybe I'll ask differently :-).

I got local LAN network (let's say with 5 machines inside) and a router that can connect to a VPS with OpenVPN server. I want to connect to that network from outside, and feel like I am sitting there with my computer plugged into the switch. I want to see all machines inside that network, and I want that network to see my computer (remember I can't connect directly, only through VPS with OpenVPN Server). Which docs would be best for me to read? Like I said the only way for me to be able to do it was that bridged thing....and I've spent quite some time investigating it. I figured that someone more experienced could suggest a better solution for me and the solution with DHCP distributing addresses was the idea I had - and I have zero experience in the topic so I would be glad to do it *properly* :-).

Traffic

The HOWTO is a good source of information:
HOWTO: For OpenVPN Community Edition

This section explains how to see the machines on your server and client side network:
HOWTO: Expanding the scope of the VPN to include additional machines

A server-bridge in TAP mode will pass all packets. **A server in TUN mode will pass only routable IP packets.

**You could either have all your machines connect to the VPS and simply have a VPN network or you could route via your client side router to the VPN.

As a newbie, I would recommend the simplest** solution first.

5zymon

Some of the machines can't connect to the VPN ( alarm system for example) so I can't do that.

I've played with it for a two days, and I give up :-(. I was able to do somethig with tap interface, but you said as a beginner I should only play with tun :-) so I did.

Here is what I did so far. I've changed configuration to tun as you suggested but I can't make it work with one last step.

OpenVPN server has tun0 interface with 10.8.0.0 network. OpenVPN server has 10.8.0.1 address.

LAN1 has 10.0.0.0 network
LAN2 has 192.168.0.0 (as an example)

My router with OpenWRT (LAN1) is connecting to server, I can ping server now, and server can ping router. Machines inside LAN1 (for example 10.0.0.11) can ping 10.8.0.1, so it's all cool everything is working. Machines in subnet 10.0.0.0 can also see machine swith 10.8.0.0 subnet

I am connecting to OpenVPN server from another machine from outside. I can ping server, I can ping client from LAN1, I can ping anyone within 10.8.0.0 subnet.

Now what I can't do, is get into machines that are within 10.0.0.0 subnet (LAN1). And this is what I am trying to do. I can't make it to work.

I was able to do something similar with tap0 previously but not on openWRT, so I am wondering is this a matter of my lack of configuration knowledge, or should I use tap0 ?

Also when I try to add push route 10.0.0.0 255.255.255.0 into server config, and my router connects to it, obviously everything dies in router (the network I mean).

My server conf:

port 1194
proto udp
;dev tap0
dev tun
server 10.8.0.0 255.255.255.0
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
ifconfig-pool-persist ipp.txt
;route 10.0.8.0 255.255.255.0
;route 10.0.0.0 255.255.255.0
;push "route 10.0.8.0 255.255.255.0"
;push "route 10.0.0.0 255.255.255.0"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 5

I would be really helpful for help! I just need to connect INTO my local network. but with OpenVPN server somewhere in the internet, it's not in my local network.

5zymon

When I enable this on the OpenVPN server

push "route 10.0.0.0 255.255.255.0"

and connect with my router (which has LAN 10.0.0.0) to that OpenVPN network dies, and I can't connect to the router anymore. Or maybe I should set it on the client side not the server side?

Maybe this

Including multiple machines on the client side when using a routed VPN (dev tun)

on the page https://openvpn.net/index.php/open-source/documentation/howto.html is the way I should go?

Traffic

The first thing you have missed is the --client-config-dir on the server
and the subsequent --iroute directives ..

Read this carefully:
HOWTO: Expanding the scope of the VPN to include additional machines