I actually have used something similar in order to get connection to my home network, from the Internet.
My home network is behind a Carrier Grade Network, so I have to jump through al sets of hoops in order to use VPN.
The downside: Very poor performance, when we are measuring bandwith over VPN vs raw Internet connection.
Hint: I have a 300/300 Mbps connection, but I have measured at most 17 Mbps over VPN.
I use OpenVPN
as my VPN server. Mainly because I need a VPN server that supports TCP packages, since I can't keep a VPN connection alive via UDP.
It is so bad that I need to set my keepalive timer to 10 seconds or shorter, or else the Carrier Grade NAT will drop my VPN connection from my home network to the VPN server. :-(
So my recommondation: If you want the best performance of your VPN connection. Switch to UDP packages if it is a possibility.
DISCLAIMER:
My VPN net is currently inactive, so the information provided below may have a typo here and there, but the general idea should work.
Anyway. Onwards to my setup:
Most of the magic happens on the VPN server.
Each of my client connects to my server using a unique client certificate. I use the provided CommonName from the client certificate to lookup in the client configuation directory for further settings.
My VPN server is hosted in a VPS hosted facility (TransIP.eu), which is located in a completely different country than myself. I choose them because they were cheap and the VPN server has a really fast connection to the Internet (10 Gbps).
You don't need to use my VPS provider. Anyone can do, as long as you have access to configure OpenVPN yourself. :-)
My solution is basically built on this:
OpenVPN multiple clients on routed TUN
The important lines in my server.conf
:
# The actual VPN net.
# Each VPN client connected to the VPN server can ping each other
# on the 192.168.100.0/24 subnet.
server 192.168.100.0 255.255.255.0
# I can't really remember if I need to push the 192.168.100.0/24 subnet
# from the general settings to the client.
#
# All VPN clients gets an IP address from this range.
#
# Comment it out if not needed.
push "route 192.168.100.0 255.255.255.0
ifconfig-pool-persist ipp.txt
# Location of the client specific configuration files.
# It is in the 'ccd/' subfolder.
client-config-dir ccd
# Neccessary so that each VPN client can see each other (aka 'ping').
client-to-client
In my ccd
subfolder I have the following files:
RasberryPi4
MyFriend
The content of the file RasberryPi4
:
ifconfig-push 192.168.100.2 255.255.255.0
push "route 192.168.0.0 255.255.255.0 192.168.100.3 1"
iroute 192.168.1.0 255.255.255.0
The content of the file MyFriend
:
ifconfig-push 192.168.100.3 255.255.255.0
push "route 192.168.1.0 255.255.255.0 192.168.100.2 1"
iroute 192.168.0.0 255.255.255.0
Now this assume that client connect the VPN server with a client certificate that has the CommonName "RasberryPi4", while the other client certificate has the CommonName "MyFriend".
There are no special file for my cell phone, so when it connects to the VPN server it gets assigned an available ip address on the 192.168.100.0/24 subnet, but it cannot reach either the 192.168.0.0/24 or 192.168.1.0/24 subnet.
If I want to reach both subnets and my phone certificate has the CommonName MyPhone
, then I need another file in ccd
subdirectory named MyPhone
with at least these minimum settings:
push "route 192.168.0.0 255.255.255.0 192.168.100.3 1"
push "route 192.168.0.0 255.255.255.0 192.168.100.2 1"
I have also expanded on the configuration above, so I could split a /48 IPv6 subnet from Hurricane Electric so my friend and I had each our own /56 IPv6 subnet at home, which could be accessed by everybody that has an IPv6 address.
... but that is a completely different story. :-)
Hope this helps. :-)