OpenVPN via Point 2 Point?

johnyjj2

Hello,

I have OpenWRT router as server but it looks like there is no direct access to the port due to some ISP configuration. But I can access that computer via TeamViewer. So I though - is there any way to do something similar with OpenVPN?

I have found something like this "Yes, OpenVPN supports peer-to-peer operation via the "mode p2p" directive (which is actually the default)" (https://openvpn.net/archive/openvpn-users/2005-10/msg00254.html) but it's about really old OpenVPN version.

Thank you!

Traffic

See --topology in The Manual v23x

johnyjj2

Thank you! One thing is not clear to me though.
Will it work if my server is behind NAT? If not, what else should I do to make it working?

Traffic

My servers are behind NAT .. just use port-forwarding on your router ..

johnyjj2

Yes, port forwarding would help. But it's port forwarding on ISP side, which means I cannot reconfigure their routers.
If I check eth0.2 and external IP, these two are different, and I don't forward ports. Which means it could be some forwarding done by ISP.

johnyjj2

So is there any alternative to port forwarding, as I cannot reconfigure ISP's routers?

Traffic

If your ISP will not allow you to have incoming packets then you cannot run a server on that node.

Either change ISP or put your server somewhere else ..

Who is your ISP ?

johnyjj2

Traffic wroteIf your ISP will not allow you to have incoming packets then you cannot run a server on that node.

But if I can receive content of websites from the WAN (which is incoming packet with html) or I can use TeamViewer (which is p2p), why cannot I use OpenVPN (or some alternative to it, e.g. n2n)? I mean, OpenVPN also supports p2p mode, but I'm not sure what should be changed to make it working with NAT. If TeamViewer can make it possible, then why OpenVPN wouldn't be able to do the same, in similar way?

Traffic wroteEither change ISP or put your server somewhere else ..

I want to have access to router's shell at home (I have frequent issues with Skype connections so I want to monitor network on both sides, home and place where I'm now). So placing server somewhere else is not an option. This is OpenWRT software for routers. Also choice of ISPs in that area is very limited. It's just that external IP is different than the one router has on 'wan', i.e. eth0.2, so if I understand correctly, it's just ISPs forwarding).

Thank you!

Traffic

johnyjj2 wroteBut if I can receive content of websites from the WAN (which is incoming packet with html) or I can use TeamViewer (which is p2p),

these are all outgoing streams ..

johnyjj2 wrote why cannot I use OpenVPN

this requires an incoming stream.

You need to understand how NAT functions.

johnyjj2 wroteIt's just that external IP is different than the one router has on 'wan', i.e. eth0.2,

which is where you need port-forwarding ..

johnyjj2 wrote so if I understand correctly, it's just ISPs forwarding).

this appears to be your major obstacle .. yes

You could put your server somewhere that supports port-forwarding ..

johnyjj2

Thanks a lot. It really helped me with understanding it better.
How should I understand incoming and outgoing stream? Incoming as something that was initiated outside and outgoing as something initiated inside (from server)? Because both are bi-directional (e.g. with team viewer, computer sends screen image but receives information about how to move mouse).
In that case, is there any way to use openvpn with outgoing stream? If not, any other tool I could possibly use for that?
So I understand it in such a way that I need tool that can run on my router and know my ip, and try to reach me, instead of me trying to reach router.

Pippin

Is this the first time you try to reach home?

Otherwise, this "tastes" like Dual Stack Lite

Is your WAN IP a 10.x.x.x (private) address?
Call your ISP and ask them if you have Dual Stack Lite.
If that`s the case, then ask them for a IPv4 address.
Some give it for free, others not or offer a business account.

Other solutions could be, use IPv6 all the way or find an online portmap service like this one:
http://www.static-access.net/dslite-ipv6-portmapper/general-information/