I am trying to find a way to turn on my work PCs remotely via OpenVPN. The PCs are connected to a router which is on the subnet of another router owned by the people who manage our building. When the PCs are powered on, I can access them fine using RDP via my OpenVPN connection.

I can power the PCs on by going into my router management GUI and starting them from there, however I don't want to give my staff access to the router and it is them who I need to give access to.

Is there any way I can power on the PCs when tunnelling through OpenVPN?


Is it possible to WOL via OpenVPN?

Yes it is.

Is there any way I can power on the PCs when tunnelling through OpenVPN?

Yes, you've got following options:

  • use OpenVPN in bridge mode (VPN & LAN share layer 2 segment, TAP device),
  • forward UDP port 9 at your router from VPN side (when using VPN layer 3 subnet with TUN device),
  • forward UDP port 9 at your router form Internet side.

Newbie hints:




Configuring router port forwarding:

Most routers do not allow you to forward to broadcast, however if you can get shell access to your router (through telnet, ssh, serial cable, etc) you can implement this workaround:

$ ip neighbor add lladdr FF:FF:FF:FF:FF:FF dev net0

Source: https://wiki.archlinux.org/index.php/Wake-on-LAN

Enabling Wake On Lan on the network adapter (Linux way):

ethtool -s eth0 wol g

Enable WOL via /etc/networks/interfaces (Debian, Ubuntu, Mint probably too):

$ cat /etc/network/interfaces.d/eth0 auto eth0 iface eth0 inet dhcp ethernet-wol g

Linux tools:

wol -p forwarded_port -i router_IP target_MAC_address

man wol

wakeonlan -i FF:00:00:00:00:30

man wakeonlan

  • Thank you Michael. Our OpenVPN is set up as a tun device, so I guess we would be looking at option 2 or 3. Could you go into a little more detail on either option? – Richard Lapthorn Jun 20 '16 at 15:29
  • I have UDP port 9 forwarded to which is linked to a startup command on my DD-WRT router arp -i br0 -s FF:FF:FF:FF:FF:FF Therefore a MAC address sent to UDP port 9 starts the correct computer. This works perfectly over the internet or on the LAN but not using my OpenVPN tunnel. How should I be attempting to start it from the client end? Should I be sending the packet to the rourter's broadcast iP? Should I use the subnet assigned to the OpenVPN client? I feel like I've tried every possible permutation and I'm now quite confused :( – Richard Lapthorn Jun 20 '16 at 16:30
  • You have to forward 9th UDP port to your LAN broadcast address not the unicast one. – Michal Sokolowski Jun 21 '16 at 9:45
  • So in this case I didn't think that would matter as the D-WRT startup command I mentioned before should make a broadcast address. As mentioned here dd-wrt.com/wiki/index.php/WOL Just to make sure, I have forwarded UDP port 9 to but it still doesn't make a difference. Is there not an issue with the machines being on different subnets? The LAN is 192.168.0.X and the OpenVPN subnet is 10.9.0.X. What address does the client need to send the packets to? – Richard Lapthorn Jun 21 '16 at 11:12
  • 1
    At PC you can use wireshark (program, a tool, freeware, google it), it's a packet sniffer, at your router you probably have command line and tcpdump. That's all you need, you'll find ton of examples in the Net. All headers description (very well written especially by Cisco) you have in my post above. It sounds a little scary - I know, but it's not that hard as you think it is. :) – Michal Sokolowski Jun 21 '16 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.