2

Having successfully set up my home office network for remote access via OpenVPN, I would now like to do the same thing at work, however I am double natted.

There is a central router maintained by the company that run our building, with Ethernet cables in each office. We have then connected our DD-WRT router, but obviously we only have a 192. Private ip address.

Our router has an OpenVPN server built in. To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router? Or is it potentially more complicated than that?

Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router and then forwarding the same port on our router to the ip address of the pc we want to remotely control on our subnet?

Finally, is ddns going to be a challenge with this setup? Or should it work as expected providing we use their public ip address and relevant ports, ie 1194 or 3389?

Cheers Rich

2

To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router?

Yes.*

Or is it potentially more complicated than that?

No.*

Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router and then forwarding the same port on our router to the ip address of the pc we want to remotely control on our subnet?

It's safer to access RDP server through VPN. Don't leave any other doors to your network, it will work if your ISP'd forward that port too.

Finally, is ddns going to be a challenge with this setup?

It depends if your ISP uses static or dynamic public address, if it's static, then you use address provided by your ISP. It can be simply your outside NAT address as well, you can check it for instance here. If dynamic, then there are some options too.

*assuming that your ISP does simple (P)NAT.

  • The public IP address going to the external router is definitely dynamic, so I will need to use Dynamic DNS for this to work. I currently have a DDNS account set up and directed towards the external router. I have asked the people that manage the router to forward UDP port 1194 to my IP address. Should that be enough? – Richard Lapthorn Jun 16 '16 at 17:52
  • You can use no-ip.com for instance - it's more or less reliable. Yes, that should be it. – Michal Sokolowski Jun 17 '16 at 14:13
  • 1
    Ok, so it was as simple as getting port 1194 forwarded from the external router to my routers local ip address 192.168.1.194. DDNS was no problem. I simply directed it to the public IP of the external router and the port forwarding did the rest. I have taken the advice given by other members here and will use this port for my encrypted OpenVPN connection and then Remote desktop through that. This should be the most secure way of doing things. Thanks for everybody's help :) – Richard Lapthorn Jun 18 '16 at 14:39
0

The real answer is : Publish a vpn endpoint. This can be behind building NAT (it is better in a publicly visible endpoint).

From remote, you vpn to your network and then rdp over the vpn.

Making RDP publicly accessible is a bad bad idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.