OpenVPN IPv6 configuration?

DomPerignon123

Hello.

I am running an OpenVPN server (PiVPN) on a Raspberry Pi 3B+ which is inside my home network. I want to be able to connect to devices in my home network from the outside using this OpenVPN connection. I've successfully established connections to the RPI-OpenVPN-server from the outside but the the problem is that I end up in a different subnet than where all my physical devices are. My home devices all reside in the 192.168.100.xxx -range and my client device ends up with the address 10.8.0.2.

My etc/openvpn/server.conf is configured as follows:
dev tun
proto udp6
port <REDACTED>
ca /etc/openvpn/<REDACTED>.crt
cert /etc/openvpn/<REDACTED>.crt
key /etc/openvpn/<REDACTED>.key
dh none
<REDACTED>
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS my-own-address.my-ddns-provider.com"
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
client-config-dir /etc/openvpn/ccd
keepalive 15 120
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/<REDACTED>.key
cipher <REDACTED>
auth <REDACTED>
user <REDACTED>
group <REDACTED>
persist-key
persist-tun
crl-verify <REDACTED>
status <REDACTED> 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
#duplicate-cn
# Generated for use by PiVPN.io

I tried changing the server 10.8.0.0 255.255.255.0 to server 192.168.100.5 255.255.255.0 (current IPv4 local address of my RPI3B+) but I lost the ability to SSH into the RPI from a device physically inside my home network. So my question is: How should I configure the server properly in my scenario?

The important thing is that everything needs to happen completely and only using IPv6 at every part of the chain (RPI, router, client) only as my router does not support IPV4 port forwarding.

TinCanTech

Your config is fine but you forgot to use NAT on the server firewall.

https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

DomPerignon123

TinCanTech wrote Your config is fine but you forgot to use NAT on the server firewall.

https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

I tried adding the lines

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
push "dhcp-option DNS 10.8.0.1"

to server.conf but then I lost connection to the VPN server. How am I supposed to edit the file to make it work?

Is such a scenario possible where my client computer X (outside LAN) would gain access to my home network and see every device there as if it was physically present in LAN and all the devices in my home network saw X as a computer in LAN as any other device?

Btw: Can I use link-local IPV6-addresses to connect other devices through the VPN?

TinCanTech

DomPerignon123 wrote I tried adding the lines

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
push "dhcp-option DNS 10.8.0.1"

to server.conf

Try reading the Howto again .. and again .. and again .. :roll: