2

Having successfully set up my home office network for remote access via OpenVPN, I would now like to do the same thing at work, however I am double natted.

There is a central router maintained by the company that run our building, with Ethernet cables in each office. We have then connected our DD-WRT router, but obviously we only have a 192. Private ip address.

Our router has an OpenVPN server built in. To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router? Or is it potentially more complicated than that?

Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router and then forwarding the same port on our router to the ip address of the pc we want to remotely control on our subnet?

Finally, is ddns going to be a challenge with this setup? Or should it work as expected providing we use their public ip address and relevant ports, ie 1194 or 3389?

Cheers Rich

Improve this question

2 Answers 2

Reset to default
2

To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router?

Yes.*

Or is it potentially more complicated than that?

No.*

Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router and then forwarding the same port on our router to the ip address of the pc we want to remotely control on our subnet?

It's safer to access RDP server through VPN. Don't leave any other doors to your network, it will work if your ISP'd forward that port too.

Finally, is ddns going to be a challenge with this setup?

It depends if your ISP uses static or dynamic public address, if it's static, then you use address provided by your ISP. It can be simply your outside NAT address as well, you can check it for instance here. If dynamic, then there are some options too.

*assuming that your ISP does simple (P)NAT.

Improve this answer
3
  • The public IP address going to the external router is definitely dynamic, so I will need to use Dynamic DNS for this to work. I currently have a DDNS account set up and directed towards the external router. I have asked the people that manage the router to forward UDP port 1194 to my IP address. Should that be enough?
    – Richard Lapthorn
    Jun 16, 2016 at 17:52
  • You can use no-ip.com for instance - it's more or less reliable. Yes, that should be it.
    – Michal Sokolowski
    Jun 17, 2016 at 14:13
  • 1
    Ok, so it was as simple as getting port 1194 forwarded from the external router to my routers local ip address 192.168.1.194. DDNS was no problem. I simply directed it to the public IP of the external router and the port forwarding did the rest. I have taken the advice given by other members here and will use this port for my encrypted OpenVPN connection and then Remote desktop through that. This should be the most secure way of doing things. Thanks for everybody's help :)
    – Richard Lapthorn
    Jun 18, 2016 at 14:39
0

The real answer is : Publish a vpn endpoint. This can be behind building NAT (it is better in a publicly visible endpoint).

From remote, you vpn to your network and then rdp over the vpn.

Making RDP publicly accessible is a bad bad idea.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .