I want to put an RPi4 unit on a remote network as a backup server. The remote network is at my daughter's home. The RPi will have no user interface connected, only accessible for management via SSH (PuTTY). My goal is for it to automatically connect back to my home network via OpenVPN (I run two OpenVPN servers on my home network). I don't know how to configure the RPi client or the OpenVPN server such that after the RPi has connected to the home network it can be accessible for me from my regular computer on the home network... So how do I configure the RPi4 on the remote network such that it [u]connects automatically[/u] to my home network and then is part of the local home network such that I can transfer the backed up files to the 2TB drive I plan on putting on the RPi4. Is it possible? Do I have to adjust something on my OVPN servers in my own network to make it happen? I know how to go the other way around and use the RPi4 as an OPVN [u]server[/u], which I can connect to from my side, but it involves changing the remote network Internet router with port forwarding to my RPi4 and I don't want to ask for that if not absolutely necessary. I have done this on multiple sites but then I have control over the router too. Please advice.

[quote=TinCanTech post_id=89661 time=1582581663 user_id=37053] One hundred and forty nine posts .. [/quote]Over a time span of 6-7 years.... Maybe a couple of threads a year containing up to 5-10 replies?[quote] You read the Howto, right ? [/quote] Yes, I think I have but I don't think I found my use case there... The closest I got is [url=https://openvpn.net/community-resources/how-to/#expanding-the-scope-of-the-vpn-to-include-additional-machines-on-either-the-client-or-server-subnet]Expanding the scope of the VPN...[/url] Here I found out how to arrange so clients can reach multiple machines on the server network, already done but not the use case here. Also how to let the client machine act as a router for other machines on the client network to reach the server network, not my use case. What I want is to be able to connect [u]only to the client machine[/u] from the [u]server side[/u] LAN, from a different machine than the OpenVPN server itself.... Maybe it is there but not explained such that I could deduce it is my use case after all?

Connecting an RPi4 unit to my network for access both ways

BobAGI

I want to put an RPi4 unit on a remote network as a backup server. The remote network is at my daughter's home.

The RPi will have no user interface connected, only accessible for management via SSH (PuTTY).
My goal is for it to automatically connect back to my home network via OpenVPN (I run two OpenVPN servers on my home network).

I don't know how to configure the RPi client or the OpenVPN server such that after the RPi has connected to the home network it can be accessible for me from my regular computer on the home network...

So how do I configure the RPi4 on the remote network such that it connects automatically to my home network and then is part of the local home network such that I can transfer the backed up files to the 2TB drive I plan on putting on the RPi4.
Is it possible? Do I have to adjust something on my OVPN servers in my own network to make it happen?

I know how to go the other way around and use the RPi4 as an OPVN server, which I can connect to from my side, but it involves changing the remote network Internet router with port forwarding to my RPi4 and I don't want to ask for that if not absolutely necessary.
I have done this on multiple sites but then I have control over the router too.

Please advice.

BobAGI

Question:
If the OVPN server is configured to give the connecting client a tunnel address within the range of the server side LAN itself, then maybe the client would be reachable from the server side LAN?

Before I started using OpenVPN we used Microsoft PPTP VPN and the Windows server handling RRAS and PPTP was using a client side IP address pool inside the range of the server side LAN itself. So the client was given a tunnel address compatible with the LAN.
Then the connected client was appearing just like any other host on the LAN.

Can something like that be used in this case, maybe by using ccd directory handling?
I have used that earlier but with another 10.8.xx.yy address range and IPTABLES to limit access for such a client to the local resources.
But could I use a local address rather than 10.8.xx.yy in an ifconfig-push ccd command?

Edit:
I just checked that the router I am using on my home LAN has DHCP set to the range 192.168.119.130..254
So then addresses could be used in the lower half of the 192.168.119.xxx range without risk of colliding with the router's DHCP range...

TinCanTech

One hundred and forty nine posts ..

You read the Howto, right ?

BobAGI

TinCanTech wrote One hundred and forty nine posts ..

Over a time span of 6-7 years....
Maybe a couple of threads a year containing up to 5-10 replies?

You read the Howto, right ?

Yes, I think I have but I don't think I found my use case there...
The closest I got is Expanding the scope of the VPN...
Here I found out how to arrange so clients can reach multiple machines on the server network, already done but not the use case here.
Also how to let the client machine act as a router for other machines on the client network to reach the server network, not my use case.

What I want is to be able to connect only to the client machine from the server side LAN, from a different machine than the OpenVPN server itself....

Maybe it is there but not explained such that I could deduce it is my use case after all?

TinCanTech

For now, I don't want to spoil the fun you can have reading the howto again.

Look out for that "light bulb" moment :mrgreen:

BobAGI

Hmm,
after thinking a bit I realized that a connected client has connectivity on the server side network, so for talking to it from another server side machine I should be able to do it provided I could set up a route that uses the OpenVPN server as the gateway.
So I made a quick test from my Windows computer by adding a route entry for network 10.8.0.0 255.255.255.0 using the OVPN server as gateway.
So:

route add 10.8.0.0 mask 255.255.255.0 192.168.119.216 metric 28

in an admin terminal on Windows.

Then I checked by pinging 10.8.0.2 (which is what my phone gets when in connects). No response of course.
Then I connected the phone to the VPN server and tried ping again, and now I got a reply! 🙂

So the conclusion seems to be that if I am only looking for "back" connectivity to the machine that has connected by OVPN all I need is:
- The IP address of the tunnel for the connected client
- A route entry to its network using the OVPN server as gateway

I cannot test further than this with my phone, though. I must configure an RPi with the OVPN connectivity and then set it up at another network somewhere in order to test if I can reach the samba share and/or sftp server on the RPi....

BobAGI

TinCanTech wrote For now, I don't want to spoil the fun you can have reading the howto again.
Look out for that "light bulb" moment :mrgreen:

OK done that and replied as a result above.
However,
I also looked at the section setting up your own certificate authority since I had trouble setting up a new OVPN server on an RPi4. It turns out that the how-to describes the method to use with easy-rsa version 2, which is no longer distributed with the openvpn packages at least not on Debian/Raspbian.
I have used easy-rsa 2 for 6 years now and I have scripted the creation of client OVPN files too using the easy-rsa commands shown in the howto.
But these do not map well to the easy-rsa version 3 that is now distributed....

I had to locate a github place where the old version 2 was still available and download it from there so I could use my old procedure.

I think a howto update is in order so that the way to use easy-rsa 3 is also described.

TinCanTech

I suggest you raise your issue with Easyrsa on github.

BobAGI

OK, but I don't have a github account...
My own notes will contain the link to where I can download the old easy-rsa2 for future reference and then the OpenVpn how-to works fine...