0

I already went through all the answers, but I cannot make my VPN configuration work. My goal is this:

I want my client to connect to his win/remote disk via VPN from home, but allow him to connect without VPN while he is in the office (NAT 192.168.10.x). Currently, I use two domains: vpn.my-domain.com and office.my-domain.com. This works, but is unconfortable, because the client needs to have several disk units connected.

I use Mikrotik as a router and OpenVPN windows client. Here is the config:

client
dev tun
proto tcp
remote office.my-domain.com 1194

//// recently tried these lines - no difference
allow-pull-fqdn
route office.my-domain.com 255.255.255.255 net_gateway
route-nopull
//////


resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth sha1
auth-user-pass
verb 3

Is it even possible considering DNS names caching in Windows?

4
  • I don't understand your problem here. Why do you use two domains? What are they for?
    – Lacek
    Jan 15, 2020 at 12:09
  • @Lacek I want user to access windows disk through VPN when they are outside the office and without VPN when they are in the office. Nothing else than two domains worked. Jan 16, 2020 at 10:05
  • I still don't get it. If the Windows server exporting the disks is in the office, then it should be accessible from the office without VPN. From outside, it should be accessible provided the proper routes are set up. What do I miss?
    – Lacek
    Jan 16, 2020 at 11:03
  • @Lacek my VPN server is on Mikrotik router, not on the win server. Jan 16, 2020 at 11:31

1 Answer 1

1

With route no-pull & route office.my-domain.com 255.255.255.255 net_gateway you are actually specifying that it will definitely use the VPN when it's officedomain IP. So in any case local or outside it will use VPN to connect to office.

The solution you are asking to exclude office VPN while inside office network. There's no such openvpn config for this. User's can manually use OpenVPN only while outside the office network.

For this kind of case, you should use OpenVPN Access Server. Since it's not a technical details, rather a product to use, I am not explaining any further.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .