[resolved] Accessing office network from home

Das

Good evening everyone,

I want to setup a "reverse VPN" scenario: office PC should connect to my home PC through the Internet allowing me to use office network when I need to work from home. Office PC is behind a firewall, and company does not provide a proper corporate VPN solution. I have admin access on the office PC, but no enterprise admin access (i.e. not able to configure office routers).
Trying to achieve this by setting up point-to-point static key routed connection from my office PC to home PC. Configs are below (simplified - I also use DynDNS, compression, reconnect and several dhcp-connect options).

Home PC (a.k.a. server, Windows machine, port forward set up on router):

dev tun
ifconfig 10.8.0.1 10.8.0.2
secret static.key
route 192.168.0.0 255.255.255.0

Office PC (a.k.a. network-sharing client, Windows machine, IP forwarding enabled in the registry, IP 192.168.0.100, subnet mask 255.255.255.0):

dev tun
remote <home router address> 1194
ifconfig 10.8.0.2 10.8.0.1
secret static.key
route 192.168.0.0 255.255.255.0

OpenVPN successfully establishes the connection, and I'm able to ping 10.8.0.2 from the home PC. However, I'm not able to ping 192.168.0.100. I'm also not able to ping any servers in the office network - which is what I'm basically trying to achieve.
I guess the usage scenario is pretty common, so I'm probably missing something obvious.

What did I miss? Will bridged connection work better for this scenario?

Any advise would be greatly appreciated.

Mimiko

Read this: https://forums.openvpn.net/topic9465.html

Das

Hi Mimiko,

Thanks a lot for the reply and for the guide, quite an interesting reading. It seems only method 4 is feasible in my case. As far as I understand, it requires:

disabling Windows firewall - never used it;
enabling IP forwarding - done;
route in the OpenVPN config - done;
iroute in the OpenVPN config - is it required for p2p configurations? Or should I switch to server/client configuration to be able to use this method?
some NAT software to perform IP masquerading - could you advise some? Isn't Windows built-in ICS (Internet Connection Sharing) supposed to perform this?

Mimiko

iroute in the OpenVPN config - is it required for p2p configurations? Or should I switch to server/client configuration to be able to use this method?

It's not a p2p config. "iroute" is needed to add routes to remote sites to the OpenVPN's internal routing table, same way as "route" adds the routes to the systems routing table.

some NAT software to perform IP masquerading - could you advise some? Isn't Windows built-in ICS (Internet Connection Sharing) supposed to perform this?

ICS may be used for enabling forward and masquerading, just share the local LAN interface with the TAP device. But I didn't mencioned ICS, as it is very unpredictible in what will happen, and also ICS modifies the TAP interface IP to have the last byte equal to 1, which we don't whant. The same, if the ICS is already enabled on some 3rd interface for some different role?

Das

It finally worked. I had to switch from using p2p (ifconfig) to server/client configuration with client-config-dir/iroute, and enable ICS.
You're right, when enabling ICS Windows attempts to set a static IP to the TAN interface. However you can after that manually update the TAN interface to use dynamic IP, and only then start OpenVPN connection.

Thanks a lot for your help.