Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure my home server to run a VPN service other than openVPN and need some advice on how best to configure it here is a brief description of my network and what I would like to do.

  • Static IP from ISP of 92.x.x.x
  • Router/gateway IP
  • Centos home server IP inside DMZ (eth0, it only has 1 network card)
  • NAS IP
  • DHCP clients (phone,tv,laptop,printer etc)

My home server is DMZed so that if I am outside of my home network I can access the service via the static IP (92.x.x.x).

I would like to be able to access my NAS via a VPN from an unsecured network work (say a coffee shop free wifi) and for the client dialing in to be assigned an IP (preferably via DHCP) on my home network ( and to use my as it's gateway.

Is there a way I can configure StrongSwan or other VPN so that I can dial into my local network via the static IP? I have looked at the examples on the StrongSwan site and most of them are for servers with 2 network devices (eth0 and eth1). Is it possible to use a virtual network adapter (tap0) on my linux server then just use a config like

Any advice or links would be more than welcome.

share|improve this question

The dhcp and farp plugins for strongSwan provide functionality for a setup like this.

With the dhcp plugin enabled strongSwan requests IP addresses from your DHCP server to assign to VPN clients. And the farp plugin will fake ARP replies for these IPs so that VPN clients seem to be part of the same subnet as the other LAN hosts.

This only works, of course, if your other hosts can access the Linux server (not sure if that's the case as you wrote that the Linux server is inside a DMZ).

The wiki page Introduction to strongSwan provides links to example configurations for different client systems and there is also a page with details about IP forwarding and split-tunneling.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .