0

I have a router with IP 192.168.1.1 subnetting 192.168.1.0/24.

On that subnet, a Synology NAS has an IP of 192.168.1.181 and is running a VPN server using subnet 192.168.2.0/24.

When I connect a client to that server from outside both networks, I get assigned 192.168.2.6. From that client I can ping machines on 192.168.1.0/24 (192.168.1.17 & 192.168.1.181 for example) and 192.168.1.1 & 192.168.2.1.

From machines already on 192.168.1.0/24, I can ping the VPN client (192.168.2.6) after adding a static route of route add 192.168.2.0 mask 255.255.255.0 192.168.1.181 (windows).

Before adding the redirect-gateway line to the client config, I would be able to access the internet while on the VPN but was unable to access local web services like a router service or the Synology NAS web service (running within 192.168.1.0/24). I thought this was maybe because the external IP (whatmyip.org) from a VPN client showed the same external address as if I was not connected to the VPN.

After adding the redirect-gateway line to the client config, I verified I had the correct external IP (matches the 192.168.1.0/24 clients external IP) when connected but could not access external sites (google.com) but could access internal web services (192.168.1.1's & 192.168.1.181's).

What am I missing?


Weird observation, not sure why but the client (192.168.2.6) gets a DHCP & gateway server of 192.168.2.5 which as far as I know, isn't anything that exists. I can't ping it. 192.168.2.1 is definitely the VPN server and I can access it's web service (192.168.1.181 on 192.168.1.0/24).

Connected client ipconfig /all:

Description . . . . . . . . . . . : TAP-Windows Adapter V9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.2.6(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Lease Obtained. . . . . . . . . . : Thursday, August 13, 2015 11:55:43 AM
Lease Expires . . . . . . . . . . : Friday, August 12, 2016 11:55:42 AM
Default Gateway . . . . . . . . . : 192.168.2.5
DHCP Server . . . . . . . . . . . : 192.168.2.5
DNS Servers . . . . . . . . . . . : 192.168.2.1
NetBIOS over Tcpip. . . . . . . . : Enabled
0

You must make sure your router has an outbound NAT entry for the VPN 192.168.2.0/24 network and that DNS has been set.

See this: https://openvpn.net/index.php/open-source/documentation/howto.html

You must redirect the gateway: push "redirect-gateway def1"

Make sure the client has DNS set or push it with openVPN using push "dhcp-option DNS x.x.x.x"

The final step as mentioned above is that your router must have outbound NAT configured for your VPN network, otherwise you won't get out onto the internet.

  • How does the push "redirect-gateway def1" ? What is def1? I fiddled with dhcp-option DNS 192.168.2.1 in the client config. Not sure which DNS address I should be pointing to though. – Enigma Aug 13 '15 at 16:08
  • 1
    From the OpenVPN docs "def1 -- Use this flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway." You can choose any DNS you want, public or internal. Have you checked out the NAT on your router? – tomstephens89 Aug 13 '15 at 16:15
  • That's a pretty huge howto link. Are there particular parts you could point me to that could help me set up an oubound NAT? Searched for outbound and got nothing. – Enigma Aug 13 '15 at 16:15
  • Outbound NAT has nothing to do with OpenVPN itself, it is a feature of IP networking that allows a router to translate addresses on one network, to an address on another. It will be a configuration option on your router somewhere and you must tell it to NAT your VPN range to your public IP. Be warned though, I have never seen an option to add additional outbound NAT set ups in any 'domestic/home' routers I have used. – tomstephens89 Aug 13 '15 at 16:18
  • So is the idea that http requests coming from 192.168.2.6 will get redirected to an IP on 192.168.1.0 ? Hmm... So I have a farily new model of a verizon router but it is still very much a domestic/home router. It has static routing capabilities though. – Enigma Aug 13 '15 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.