I can successfully connect from my workplace or mobile network, from both iPhone (using OpenVPN Connect) and MacBook (using Viscosity). I can access the Edgerouter itself, and also browse the web fine. If I Google "what is my IP?" then my home public (static) IP address is displayed, so I know I'm browsing via the tunnel.
However, I cannot access other devices on my home LAN, except for the Edgerouter itself.
The router and OpenVPN server IP is 192.168.2.1. My home LAN subnet is 192.168.2.0/24.
My NAS, which I'd like to access via the VPN, IP is 192.168.2.50.
My OpenVPN (virtual) client subnet is 10.8.91.0/24.
I have used port-forwarding and opened up firewall rules for port 1194-UDP.
I've configured OpenVPN using the Edgemax EdgeOS system (based on a forked Vyatta), so don't have a config file per se - but here is my config as shown in the router:
Code: Select all
openvpn vtun1 {
local-host 192.168.2.1
local-port 1194
mode server
openvpn-option --tls-server
openvpn-option --comp-lzo
openvpn-option "--user nobody --group nogroup"
openvpn-option --persist-key
openvpn-option --persist-tun
openvpn-option --persist-local-ip
openvpn-option --persist-remote-ip
openvpn-option "--keepalive 8 30"
openvpn-option "--verb 3"
openvpn-option --client-to-client
openvpn-option "--ifconfig-pool-persist /config/auth/openvpn/vtun1_ipp.txt"
openvpn-option "--push redirect-gateway def1"
openvpn-option "--push dhcp-option DNS 192.168.2.1"
openvpn-option "--cipher AES-128-CBC"
openvpn-option --float
openvpn-option "--tls-auth /config/auth/openvpn/keys/ta.key 0"
openvpn-option "--tls-cipher DHE-RSA-AES256-SHA"
protocol udp
server {
push-route 192.168.2.0/24
subnet 10.8.91.0/24
topology subnet
}
tls {
ca-cert-file /config/auth/openvpn/keys/ca.crt
cert-file /config/auth/openvpn/keys/server.crt
dh-file /config/auth/openvpn/keys/dh2048.pem
key-file /config/auth/openvpn/keys/server.key
}
}
Code: Select all
...
nobody 1590 1 0 10:56 ? 00:00:26 /usr/sbin/openvpn --daemon --verb 3 --writepid /var/run/openvpn-vtun1.pid --status /var/run/openvpn/status/vtun1.status 30 --dev-type tun --dev vtun1 --mode server --tls-server --topology subnet --keepalive 10 60 --local 192.168.2.1 --lport 1194 --ca /config/auth/openvpn/keys/ca.crt --cert /config/auth/openvpn/keys/server.crt --key /config/auth/openvpn/keys/server.key --dh /config/auth/openvpn/keys/dh2048.pem --management /tmp/openvpn-mgmt-intf unix --push route 192.168.2.0 255.255.255.0 --server 10.8.91.0 255.255.255.0 --client-config-dir /var/run/openvpn/ccd/vtun1 --tls-server --comp-lzo --user nobody --group nogroup --persist-key --persist-tun --persist-local-ip --persist-remote-ip --keepalive 8 30 --verb 3 --client-to-client --ifconfig-pool-persist /config/auth/openvpn/vtun1_ipp.txt --push redirect-gateway def1 --push dhcp-option DNS 192.168.2.1 --cipher AES-128-CBC --float --tls-auth /config/auth/openvpn/keys/ta.key 0 --tls-cipher DHE-RSA-AES256-SHA
...
Code: Select all
admin@ubnt:~$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
I - ISIS, B - BGP, > - selected route, * - FIB route
K>* 0.0.0.0/0 is directly connected, pppoe0
C>* 10.7.91.0/24 is directly connected, vtun0
C>* 10.8.91.0/24 is directly connected, vtun1
C>* 10.9.91.0/24 is directly connected, vtun2
C>* 127.0.0.0/8 is directly connected, lo
C>* 192.168.2.0/24 is directly connected, eth1
C>* 195.166.128.192/32 is directly connected, pppoe0
admin@ubnt:~$
Code: Select all
client
dev tun
tls-client
proto udp
remote MYDOMAINNAME 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert matt-mbp.crt
key matt-mbp.key
tls-auth ta.key 1
ns-cert-type server
cipher AES-128-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
comp-lzo
verb 3
reneg-sec 0
I've tried to follow the How-To guide as far as I can, but I'm struggling to see why it's not working.
But I found another solution this morning, before I saw your post: adding a 'static route' in my NAS's Network config (easy to do through my NAS's GUI), pointing my OpenVPN subnet to my router/server.