Can't access client side LAN from Server or Server LAN

nzav

Hi I am trying to setup up Open VPN whereby remote clients connect to the server network and from the server network I can access the Lan of the client network. (Almost like a reverse VPN)

Both Open VPN server and client are raspberry Pi's sitting behind routers. The server is at my home where I want the clients to connect to so I can remotely support devices on the network at the clients.

I can get the client to connect to the server but what I am having issues with is trying to ping any device on the client lan from the server or from any device on the server lan.

Home ip subnet is 192.168.200.0
Router is 192.168.200.254
OpenVPN server is 192.168.200.250

Client subnet is 192.168.1.0
Router/gateway 192.168.1.1
Open vpn client 192.168.1.102

I have enabled IP forwarding on both the client and the server.
I have added the following to the server conf file:

push "route 192.168.200.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
route 192.168.1.0 255.255.255.0

I am not even sure if i need the line

push "route 192.168.200.0 255.255.255.0"

as I dont want devices on the client lan side to access devices on the server lan side.

I have made a file with the same name as the client and added it to the ccd directory with the following entry:

iroute 192.168.1.0 255.255.255.0

I have added a static route to my home router 192.168.1.0 to go to 192.168.200.250

When I run a trace route on a pc in my home to anything on the 192.168.1.0 subset it reaches the openvpn server and then can't go anywhere from there.

Am I missing any settings? Do I have to add a static route in the router of the client network, bearing in mind I don't want devices on that network to connect to the serverside lan only the other way around. By the way I cant add a static route to that router as it is the cheap ISP supplied 4g router.

Thanks, let me know if you require any more info.

nzav

Server route table:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.200.254 0.0.0.0         UG    202    0        0 enxb827eb5d81d5
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 tun0
192.168.1.0     10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.168.200.0   0.0.0.0         255.255.255.0   U     202    0        0 enxb827eb5d81d5

nzav

Client routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.1        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    202    0        0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
128.0.0.0       10.8.0.1        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0
192.168.200.0   10.8.0.1        255.255.255.0   UG    0      0        0 tun0

nzav

Server routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.200.254 0.0.0.0         UG    202    0        0 enxb827eb5d81d5
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 tun0
192.168.1.0     10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.168.200.0   0.0.0.0         255.255.255.0   U     202    0        0 enxb827eb5d81d5

TinCanTech

nzav wrote bearing in mind I don't want devices on that network to connect to the serverside lan only the other way around

That is not how it works .. :roll:

nzav

TinCanTech wrote
nzav wrote bearing in mind I don't want devices on that network to connect to the serverside lan only the other way around
That is not how it works .. :roll:

Thank you TinCanTech for the feedback. Would I be better to have a separate server hosted outside my home that I connect to as a client from my support PC? So that full access to my home lan is not accessible from the other client networks?

Ideally, I have the server hosted at home. Could I block the server side lan and just setup my pc to as a separate client to the vpn. That way only my single pc is connected to remote network and not my whole house?

I own the remote network, but I don't want staff to be able to connect back through to my house. (Client network is a food truck with POS, CCTV and digital/display menus that I need to be able to view/edit. The food truck's router is a 4G router that sits behind the ISP additional subset so no chance of VPN directly in, hence the need for client network to "call home").

I think I am not even close to this yet though as my server can't even ping the client or client lan (yet the client can ping the server and server lan devices - ie it is working opposite to how I want it to work).

It would be great to know if the static route in the client gateway/router is needed to be able to access deveices on the client lan.

Any help is greatly appreciated.

ecrist

What you're likely running in to is the client LAN devices not knowing how to route to the VPN, or your server LAN. Basically, the packet makes it from your server LAN to the VPN client, out to the remote PC on the client LAN, but the client PC routes the packet back out the default gateway, since it doesn't know that the VPN is routing through a different network endpoint.

The easiest solution for this is to setup NAT on the client VPN so that any traffic routing out the client VPN uses the LAN IP on the client side.

I hope this helps.