LAN-client to access VPN-client

dweb

Hi Community,

I read through several threads but did not really find a solution to my Goal:
All my LAN members should be able to connect to SMB Shares of all dialed in VPN-Clients.

My Setup:
internal network:
Router 192.168.188.1
Rasperry with OpenVPN Server : 192.168.188.199, OpenVPN set to 10.8.0.0
other LAN-members: NAS: 192.168.188.200

external Network
OpenVPN CLient: BackupServer, gets assigned 10.8.0.2 when VPN connection established

Form OpenVPN client perspective everything is running fine, as I can see all devices that are available on my LAN.
However, my NAS (not dialed into VPN) is not able to access the OpenVPN client's SMB shares.

Could someone explain me if this is possible? Which kind of settings would I need to apply?
I want my BackupServer to establish a VPN Connection to my LAN and then bind its Network drives into my NAS which is not on VPN.

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/name.crt
key /etc/openvpn/easy-rsa/pki/private/name.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3

Pippin

Please read here:
https://community.openvpn.net/openvpn/wiki/HOWTO#ExpandingthescopeoftheVPNtoincludeadditionalmachinesoneithertheclientorserversubnet.

dweb

Thanks pippin,
I was already reading through this part but I still don't fully understand which part of it would help me.
My understanding is:
Including multiple machines on the server side when using a routed VPN (dev tun) :

...clients can reach multiple machines on the server network, rather than only the server machine itself

--> this is already possible, each client can access all machines on my LAN

Including multiple machines on the client side when using a routed VPN (dev tun):

...that any machine on the client LAN can communicate with any machine on the server LAN through the VPN

--> would this also include that any machine on the server LAN can communicate with any machine on the client LAN (without having the server LAN machines connected to VPN)?