3

I have setup OpenVPN on Win2K12R2 on AWS. I want MyOffice LAN network to be accessible from MyHome PC.

See the diagram

Client Subnet - 10.8.0.0/24
MyHome Subnet - 192.168.1.0/24
MyOffice Subnet - 192.168.2.0/24

I will connect from MyHome to OpenVPN Server and also connect MyOffice to OpenVPN Server. Once this connection is successful i want to communicate with other devices in MyOffice LAN from MyHome.

Both Client Config

client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:/Program Files/OpenVPN/keys/ca.crt"
cert "C:/Program Files/OpenVPN/keys/client-Myxxxx.crt"
key "C:/Program Files/OpenVPN/keys/client-Myxxxx.key"
remote-cert-tls server
cipher AES-256-CBC
verb 3
mute 20

Server Config

port 1194
proto udp
dev tun
ca "C:/Program Files/OpenVPN/keys/ca.crt"
cert "C:/Program Files/OpenVPN/keys/server.crt"
key "C:/Program Files/OpenVPN/keys/server.key"
dh "C:/Program Files/OpenVPN/keys/dh2048.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
client-config-dir ccd
route 192.168.2.0 255.255.255.0
client-to-client
push "route 192.168.2.0 255.255.255.0"
;duplicate-cn
persist-key
persist-tun

Kindly suggest.

1

You have to make sure your office PC has a static vpn 10.8.0.x IP (use ccd directory for this, although generally pool persist should be ok).

You have to allow IP forwarding on your office PC (depends on OS how you do that).

Then create a route for 192.168.2.0/24 that has your office PC VPN IP as gateway (not you VPN server!)

client-to-client is enabled so you should ok

Edit:

Create a file in your ccd directory having name of your office pc client name

In this file add this line:

iroute 192.168.2.0 255.255.255.0

You can see more info about this on the following page

https://community.openvpn.net/openvpn/wiki/RoutedLans

  • Hi, Thanks for the response. Yes MyOffice PC have static IP 10.8.0.8 and MyHome PC have 10.8.0.6. I have already enabled IP Forwarding from registry on both machines, both are Windows. Where do i have to create a route for 192.168.2.0/24 GW 10.8.0.8 ? Yes, client-to-client is enabled. Kindly Suggest – Danish Jun 17 '17 at 21:23
  • Edited my answer – Triantafyllos Jun 18 '17 at 6:13
  • Hi, When i have edited the push route as per above i get message "Route: Waiting for TUN/TAP interface to come up..." and at last "MANAGEMENT: >STATE:1497793023,CONNECTED,ERROR,10.8.0.6,xxx.xxx.xxx.xxx,1194,,". Tunnel Comes up but when i route print there is no route for 192.168.2.0/24 network. – Danish Jun 18 '17 at 13:41
  • I edited my answer again to explain another solution. (remove the office IP from your push route that I suggested on the previous answer) – Triantafyllos Jun 18 '17 at 15:24
  • Hi, Yes i had did the same and it was not working earlier. May be due to the file had .txt in extension. Later i removed extension of the file and its working now. However i still have push route in place. I also see very high latency almost 600ms. I have very high bandwidth at all the nodes. Is it due to encryption in place ? – Danish Jun 18 '17 at 17:02

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.