I am trying to find a way to turn on my work PCs remotely via OpenVPN. The PCs are connected to a router which is on the subnet of another router owned by the people who manage our building. When the PCs are powered on, I can access them fine using RDP via my OpenVPN connection.

I can power the PCs on by going into my router management GUI and starting them from there, however I don't want to give my staff access to the router and it is them who I need to give access to.

Is there any way I can power on the PCs when tunnelling through OpenVPN?

1 Answer 1


Is it possible to WOL via OpenVPN?

Yes it is.

Is there any way I can power on the PCs when tunnelling through OpenVPN?

Yes, you've got following options:

  • use OpenVPN in bridge mode (VPN & LAN share layer 2 segment, TAP device),
  • forward UDP port 9 at your router from VPN side (when using VPN layer 3 subnet with TUN device),
  • forward UDP port 9 at your router form Internet side.

Newbie hints:




Configuring router port forwarding:

Most routers do not allow you to forward to broadcast, however if you can get shell access to your router (through telnet, ssh, serial cable, etc) you can implement this workaround:

$ ip neighbor add lladdr FF:FF:FF:FF:FF:FF dev net0

Source: https://wiki.archlinux.org/index.php/Wake-on-LAN

Enabling Wake On Lan on the network adapter (Linux way):

ethtool -s eth0 wol g

Enable WOL via /etc/networks/interfaces (Debian, Ubuntu, Mint probably too):

$ cat /etc/network/interfaces.d/eth0 auto eth0 iface eth0 inet dhcp ethernet-wol g

Linux tools:

wol -p forwarded_port -i router_IP target_MAC_address

man wol

wakeonlan -i FF:00:00:00:00:30

man wakeonlan

  • Thank you Michael. Our OpenVPN is set up as a tun device, so I guess we would be looking at option 2 or 3. Could you go into a little more detail on either option? Jun 20, 2016 at 15:29
  • I have UDP port 9 forwarded to which is linked to a startup command on my DD-WRT router arp -i br0 -s FF:FF:FF:FF:FF:FF Therefore a MAC address sent to UDP port 9 starts the correct computer. This works perfectly over the internet or on the LAN but not using my OpenVPN tunnel. How should I be attempting to start it from the client end? Should I be sending the packet to the rourter's broadcast iP? Should I use the subnet assigned to the OpenVPN client? I feel like I've tried every possible permutation and I'm now quite confused :( Jun 20, 2016 at 16:30
  • You have to forward 9th UDP port to your LAN broadcast address not the unicast one. Jun 21, 2016 at 9:45
  • So in this case I didn't think that would matter as the D-WRT startup command I mentioned before should make a broadcast address. As mentioned here dd-wrt.com/wiki/index.php/WOL Just to make sure, I have forwarded UDP port 9 to but it still doesn't make a difference. Is there not an issue with the machines being on different subnets? The LAN is 192.168.0.X and the OpenVPN subnet is 10.9.0.X. What address does the client need to send the packets to? Jun 21, 2016 at 11:12
  • 1
    At PC you can use wireshark (program, a tool, freeware, google it), it's a packet sniffer, at your router you probably have command line and tcpdump. That's all you need, you'll find ton of examples in the Net. All headers description (very well written especially by Cisco) you have in my post above. It sounds a little scary - I know, but it's not that hard as you think it is. :) Jun 21, 2016 at 20:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .