Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to configure my home server to run a VPN service other than openVPN and need some advice on how best to configure it here is a brief description of my network and what I would like to do.

  • Static IP from ISP of 92.x.x.x
  • Router/gateway IP 192.168.100.1
  • Centos home server IP 192.168.100.100 inside DMZ (eth0, it only has 1 network card)
  • NAS IP 192.168.100.101
  • DHCP clients (phone,tv,laptop,printer etc) 192.168.100.20-99

My home server is DMZed so that if I am outside of my home network I can access the service via the static IP (92.x.x.x).

I would like to be able to access my NAS via a VPN from an unsecured network work (say a coffee shop free wifi) and for the client dialing in to be assigned an IP (preferably via DHCP) on my home network (192.168.100.20-99) and to use my 192.168.100.1 as it's gateway.

Is there a way I can configure StrongSwan or other VPN so that I can dial into my local network via the static IP? I have looked at the examples on the StrongSwan site and most of them are for servers with 2 network devices (eth0 and eth1). Is it possible to use a virtual network adapter (tap0) on my linux server then just use a config like http://www.strongswan.org/uml/testresults/ikev2/ip-pool.

Any advice or links would be more than welcome.

share|improve this question

1 Answer 1

The dhcp and farp plugins for strongSwan provide functionality for a setup like this.

With the dhcp plugin enabled strongSwan requests IP addresses from your DHCP server to assign to VPN clients. And the farp plugin will fake ARP replies for these IPs so that VPN clients seem to be part of the same subnet as the other LAN hosts.

This only works, of course, if your other hosts can access the Linux server (not sure if that's the case as you wrote that the Linux server is inside a DMZ).

The wiki page Introduction to strongSwan provides links to example configurations for different client systems and there is also a page with details about IP forwarding and split-tunneling.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.