Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to allow users to connect to my home network through my DD-WRT router using a VPN tunnel.

I want the users to be able to access a specific IP on my local network freely ( I dont want clients to be able to browse internet through the VPN tunnel.

Anyone know how to set this up?

share|improve this question

migrated from Apr 22 '12 at 15:23

This question came from our site for system and network administrators.

What are you shooting for here? What is on your home network that you want outside people to connect to? A computer? A file server? A media server? – JohnThePro Apr 20 '12 at 20:30
I want to expose a remote desktop and a NAS to a few select people. I could expose all of them directly to the internet but would prefer to go through a VPN tunnel first. But at the same time I dont want these people to be able to "hide" behind my internet through the VPN. – wokawaka Apr 20 '12 at 20:47

Configure your firewall to only allow the VPN the access they need. The device is likely tun0. DD-WRT should be using an iptables based firewall. Depending on memory you could look at installing shorewall or shorewall-lite.

In your case you likely want a REJECT policy for the device and rules to accept

  • related and established traffic.
  • incoming connections to your NAS
  • incoming connections to your remote desktop
  • incoming connections to your DNS if you push DNS servers
  • access to the Internet for everything, or limited access if you prefer

If you only push a route to your network from the VPN users Internet access should be via their existing connection and you won't need to allow them access. However, this may allow access to your services via a proxy on the connecting servers. It is up to you to assess the risk.

share|improve this answer

Okay, if you configure the VPN within the dd-wrt, as long as you know the username and password, I believe by default all things on your internal network are now accessible to you.

The server is no longer directly facing the internet, and it's inherently more secure. Once the tunnel is established, IF dd-wrt access restrictions work correctly you basically have this:

  1. A VPN tunnel with a specific subnet of IPs assigned to it (192.168.3.x or whatever)
  2. An access restriction feature on your router that disables internet on specific IPs/ranges.
  3. A secure tunnel that allows traffic in, assigns an IP that is not allowed internet access, but because of the VPN should still be able to communicate with hosts inside the network.
share|improve this answer
I have a win2008 server that I want to access, I have currently exposed the rdp port to the internet so I can access it from anywhere. But I want to change that so I have to be on the VPN to access the server through RDP (the less interfaces exposed the better and all that). – wokawaka Apr 20 '12 at 20:44

I ended up not using DD-WRT to accomplish this.

There seems to be a problem/bug with doing this in the dd-wrt build I have. Firmware: DD-WRT v24-sp2 (08/07/10) std

Not sure what the problem is but after two days of trying I could not get it to accept connections. There are also a few threads where people have seemingly configured it correctly without getting it to work (cant post more links or I would)

I instead solved this by setting up a dedicated VPN server running on my Hyper-V machine.

I used this guide to set it up under Windows server 2008

Got it to work right away, forwarded TCP port 1723 from DD-wrt to the server.

As a side note: My DHCP router uses and my VPN users get addresses from This allows the VPN users access to the network without any NAT translation on the server and by not having any NAT translation they are also blocked from the internet :)

share|improve this answer
As a side note, I blocked internet traffic for all connected users by simply not setting up any NAT translation on the server, – wokawaka Apr 22 '12 at 13:47

You must log in to answer this question.