1

I want to have access to my office LAN from my private server

I have successfully set up a VPN tunnel between my private server and my computer at my office using this link.

I can for instance ping both my server from my computer and my computer from my server. I use then 10.9.8.[1-2] IPs (1 for the client, 2 for the server).

Now, my office lan is in a 172.24.x.x/16 network.

I have create a route on my server side (route add -net 172.24.0.0/16 gw 10.9.8.1 (the IP of my computer at work) dev tun0 And enable the ip_forwarding on my computer at work.

However, nothing is routing when from my server I ping a random IP on my work-LAN.

Nothing in syslog and the packet is not received by my computer.

Does anyone have any clue to help me with this issue?

Many thanks for helping

Improve this question
1
  • Need moar info. Perhaps OpenVPN configs, and addressing for your network. As with most routing problems your answer can usually be find by correct using of tcpdump + traceroute.
    – Zoredache
    Jan 25, 2012 at 18:50

2 Answers 2

Reset to default
2

Aside from enabling IP forwarding and setting the route to 172.24.0.0/16 on your client computer (which is done with the push route directive in your OpenVPN server's config), the hosts in your office LAN 172.24.0.0/16 need to know the route back to the VPN network 10.9.8.0/24. If you can't or don't want to change the back routes, you might resort to NAT at the OpenVPN server:

 iptables -t nat -A POSTROUTING -i tun0 -o eth0 -j MASQUERADE

This would allow connections from your OpenVPN client to your office LAN, but not vice versa.

Improve this answer
1
  • Thanks. The rule iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE solved my issue :)
    – philippe
    Jan 26, 2012 at 21:55
2

To access your work-LAN from your VPN client, you'll need:

  1. net.ipv4.ip_forward=1 in the VPN endpoint's sysctls.
  2. The VPN endpoint should be the default gateway for the work-LAN
  3. push "route 172.24.0.0/16" must be in the server config for your VPN client to access that network from home

If the VPN endpoint is not the work-LAN router, it's possible to do it but it's a bit different.

Improve this answer
3
  • Thanks a lot for your answer. 1 and 3 are set up, but the VPN endpoint is not the default gateway. I have thought that the packets would go between the tun0 and the eth0 interface (thanks to net.ipv4.ip_forward=1), but obviously this is not the case. Could you please tell me more about how to set it up, without having the VPN endpoint as the work-LAN Router? Thanks again
    – philippe
    Jan 25, 2012 at 20:06
  • In that case, the packets will get routed correctly from your client to the destination computer. For example, a ping will get there from your VPN client. But the reply will be sent to the default gateway and then it gets lost. Are you responsible for the default gateway?
    – Luis Bruno
    Jan 25, 2012 at 21:33
  • I am not responsible for the default gateway hence I can not change it :/ However, I have set up the iptables iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE and get it working :) Thanks for your answer
    – philippe
    Jan 26, 2012 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .