Hey guys, how's going? I've just configured my OpenVPN Server to have site-to-site function, so both routers that I own (on in my home and the other in my office) are capable to talk to each other. So far, so good. My current set-up is the following: [b]Home network (server) - OpenVPN in OpenWRT router:[/b] Local Lan IP: 192.168.1.1 (subnet: 192.168.1.0/24) Local OpenVPN IP: 10.8.0.1 (subnet: 10.8.0.0/24) [oconf=Server Config] option server '10.8.0.0 255.255.255.0' option dev 'tun-server' option keepalive '10 120' option topology 'subnet' option port '1234' option ca '/etc/openvpn/CA.crt' option dh '/etc/openvpn/dh2048.pem' option cert '/etc/openvpn/Server.crt' option key '/etc/openvpn/Server.key' option client_to_client '1' option persist_key '1' option persist_tun '1' option proto 'udp' option verb '5' option mssfix '1500' option cipher 'AES-256-CBC' option auth 'SHA512' option keysize '256' list push 'route 192.168.1.0 255.255.255.0' list push 'dhcp-option DNS 192.168.1.1' option route '192.168.31.0 255.255.255.0 10.8.0.1' option log '/tmp/openvpn-server.log' option status '/tmp/openvpn-server-status.log' option client_config_dir '/etc/openvpn/ccd/' option enabled '1' [/oconf] [oconf=CCD File - Office] ifconfig-push 10.8.0.2 255.255.255.248 iroute 192.168.31.0 255.255.255.0 [/oconf] [b]Office network (client) - OpenVPN in OpenWRT Router:[/b] Local Lan IP: 192.168.31.1 (subnet: 192.168.31.0/24) OpenVPN IP set in ccd: 10.8.0.2 So with this current setting, all my clients in both networks can talk to each other. Great! But now I need to set up standalone clients (like android clients using LTE connection), and although I'm able to let them talk to all clients in the server side, I'm unable to let them talk to my office network (192.168.31.0/24), but I can ping the office router if I use the OpenVPN IP (10.8.0.2). This is what it look like: [b]Android client using LTE connection:[/b] Local Lan IP: ????? It's not a router, so it doesn't have a local subnet. OpenVPN IP set in ccd: 10.8.0.3 [oconf=CCD File - Standalone Client - Android Client] ifconfig-push 10.8.0.3 255.255.255.248 [/oconf] How do I make all clients, no matter which one, to be able to see and talk to all clients in all networks where OpenVPN is running, not only those running a subnet (routers)? Besides Android I also have a laptop which I could use a Hotel Wifi for example. Since I don't own the router in the Hotel, I think this "standalone" config would also work here, right? I don't need to expose the client subnet here, since I don't have access to it, but I want to have this client to access all networks exposed in my OpenVPN server, not only the server subnet. Thanks in advance :mrgreen:

OpenVPN Server Site-to-Site for clients without subnet

diegoweb

Hey guys, how's going?

I've just configured my OpenVPN Server to have site-to-site function, so both routers that I own (on in my home and the other in my office) are capable to talk to each other. So far, so good.

My current set-up is the following:

Home network (server) - OpenVPN in OpenWRT router:
Local Lan IP: 192.168.1.1 (subnet: 192.168.1.0/24)
Local OpenVPN IP: 10.8.0.1 (subnet: 10.8.0.0/24)

option server '10.8.0.0 255.255.255.0'
option dev 'tun-server'
option keepalive '10 120'
option topology 'subnet'
option port '1234'
option ca '/etc/openvpn/CA.crt'
option dh '/etc/openvpn/dh2048.pem'
option cert '/etc/openvpn/Server.crt'
option key '/etc/openvpn/Server.key'
option client_to_client '1'
option persist_key '1'
option persist_tun '1'
option proto 'udp'
option verb '5'
option mssfix '1500'
option cipher 'AES-256-CBC'
option auth 'SHA512'
option keysize '256'
list push 'route 192.168.1.0 255.255.255.0'
list push 'dhcp-option DNS 192.168.1.1'
option route '192.168.31.0 255.255.255.0 10.8.0.1'
option log '/tmp/openvpn-server.log'
option status '/tmp/openvpn-server-status.log'
option client_config_dir '/etc/openvpn/ccd/'
option enabled '1'

ifconfig-push 10.8.0.2 255.255.255.248
iroute 192.168.31.0 255.255.255.0

Office network (client) - OpenVPN in OpenWRT Router:
Local Lan IP: 192.168.31.1 (subnet: 192.168.31.0/24)
OpenVPN IP set in ccd: 10.8.0.2

So with this current setting, all my clients in both networks can talk to each other. Great!

But now I need to set up standalone clients (like android clients using LTE connection), and although I'm able to let them talk to all clients in the server side, I'm unable to let them talk to my office network (192.168.31.0/24), but I can ping the office router if I use the OpenVPN IP (10.8.0.2).

This is what it look like:

Android client using LTE connection:
Local Lan IP: ????? It's not a router, so it doesn't have a local subnet.
OpenVPN IP set in ccd: 10.8.0.3

ifconfig-push 10.8.0.3 255.255.255.248

How do I make all clients, no matter which one, to be able to see and talk to all clients in all networks where OpenVPN is running, not only those running a subnet (routers)?

Besides Android I also have a laptop which I could use a Hotel Wifi for example. Since I don't own the router in the Hotel, I think this "standalone" config would also work here, right? I don't need to expose the client subnet here, since I don't have access to it, but I want to have this client to access all networks exposed in my OpenVPN server, not only the server subnet.

Thanks in advance :mrgreen:

TinCanTech

It looks like you understand how to use openvpn. My guess is, just a routing/firewall error.

diegoweb

TinCanTech wrote It looks like you understand how to use openvpn. My guess is, just a routing/firewall error.

I mean.... This is my first time ever using OpenVPN srver, so I'm really not that capable. I don't have that much knowledge in VPN server conf.

I started this server config in december, 2020. At first I didn't know about this CCD stuff, all I could do in the beggining was to have my office clients to connect to my home network, but not the other way around.

Then I had to do some searches in Google and I found this article:
https://openvpn.net/community-resources/expanding-the-scope-of-the-vpn-to-include-additional-machines-on-either-the-client-or-server-subnet/

So then I understood that I would need to use CCD to "merge" those 2 networks. So far it has been working flawlessly.
Now my last step is to make standalone clients (which are not in a subnet that I have control) to be able to be integrated in both networks.

Considering what you could see in my config, is there anything else that I have to set in my OpenVPN server?
I'm kind stuck in this state. I don't mind searching and reading stuff to learn more, the problem is that I don't know how this "standalone" client would be called in the official documentation or in a random tutorial in the web. By the way, this CCD stuff was really hard to find, because, since I'm using OpenWRT, from what I've read, OpenVPN in those devices aren't quite the actual OpenVPN that you can install in a barebone linux machine. So it's quite hard to understand what I was doing because all docs to OpenVPN in OpenWRT wiki were broken (they have been changing stuff in the last year, so most of the stuff is linked to articles that don't exist).

If this is really a Firewall/Routing error, I suppose I would need to dig into my Router config that is running my OpenVPN server, right? Since my office router is pretty much already connected to the VPN and from my home I can access everything there, I think there isn't much I can do in the (openvpn) client side.

If this is the case, I will probably ask for help in the OpenWRT forum....
The only rule in my Firewall that I had to do so far is to allow my VPN ZONE to connect to my LAN ZONE:

Forwarded IPv4, protocol UDP
From VPN, IP 10.8.0.0/24
To lan, IP 192.168.1.0/24

But there isn't anything mentioning my office lan (192.168.31.0/24), and I can still access it from my home network (192.168.1.0/24). So I don't think this is the case, but I will try later today to apply a forward rule, but to any zone (instead of lan ony, since my office lan is not actually a vlan in my home network).

Thanks again!

---EDIT
Yeah, it didn't work... I'm clueless here.