0

I just upgraded my aging Netgear router to DD-WRT, and I'm wanting to use the built-in OpenVPN Server component to service my home's private single subnet.

So I have this setup: [public-Internet]----[dynamic dns host]<---ISP--->[DD-WRT/OpenVPN-Server router 192.186.0.1 with home private subnet 192.168.0.0/24 clients]

I want to be able to securely use my home Internet connection and securely access my home private subnet machines when I am out on public Internet or unsecured Wifi.

My DD-WRT has the ability to be an OpenVPN server.

So far, many of the guides I've read seem to want the OpenVPN clients to have a private IP that is different than my single private subnet's address. A lot of them appear to want to point you to something like 10.x.x.x for client IPs.

Is that actually a requirement for this to work?

Is that 10.x.x.x type network an actual physical subnet that I must have a second router for, or is that a virtual subnet that my DD-WRT's OpenVPN Server would 'create' for itself?

Or can I do all of this with the single private subnet that I physically have?

Thanks, in advance, for your insight into my initial foray into setting up an OpenVPN.

Improve this question

1 Answer 1

Reset to default
1

The openVPN IP address must be different from your home network's IP range, otherwise you will get in trouble.

On the other hand, the openVPN IP address will only be used between the openVPN server and the connecting device, e. g. your laptop. So your laptop might be assigned 10.8.0.2, and your openVPN server has 10.8.0.1. Both IP addresses (basically) only exist within the VPN tunnel. Reason is that openVPN will create a virtual network interface (e. g. tun0) on the server as well as the client and assign those IP addresses to it. There is no "physical" network 10.8.0.0 to configure.

You can configure openVPN (server or client) to know the route to your home IP range 192.168.0.0/24, so that you

  • connect your VPN
  • your laptop will be assigned 10.8.0.2 for the VPN tunnel
  • you can open your browser, SSH, or Microsoft Terminal Services
  • and point it to 192.168.0.x

Your openVPN server/router itself will be known by two IP addresses: 10.8.0.1 and 192.168.0.1.

The corresponding statements for the routes are

push "route 192.168.0.0 255.255.255.0"

on the server and

route 192.168.0.0 255.255.255.0

on the client respectively. You only need one of them; in your scenario it is a matter of taste in which configuration file you put it. Together with IP masqerading in your iptables (which, I assume, openWRT already has), it will allow you to connect to your home network from remote, and also browse the internet from remote. Simple example: 

Your laptop -> unencrypted, public WIFI -> internet

will then be

Your laptop -> encrypted VPN -> openWRT -> internet.

So the unencrypted, puclic WIFI provider or sniffers within that WIFI will not be able to read your traffic.

If you want to run openVPN server on a different port, e. g. to protect you from port scanning, script kiddies or similar, use port 9411 as an example.

(Edit: added questions and answers from the comments below this answer into this answer.)

Improve this answer
9
  • Thank you for that - so just to be clear, the 10.8.x.x segment is completely virtual, in the mind of the DD-WRT/OpenVPN-Server itself. I don't need to have a second physical network segment for 10.8.x.x. Is that correct?
    – Tim
    Jun 22, 2016 at 18:45
  • Yes, this is correct. You do not need to have a second physical network segment. It is completely virtual, because the openVPN server as well as the client will create a virtual tunnel interface (e. g. tun0), and assign the 10.8.0.x IP addresses to them. In other words: all you need is openVPN client software, two configuration files and the keys and certificates. No network config needed.
    – stueja
    Jun 22, 2016 at 18:53
  • And this also allows me to securely use public Wifi hotspots, because I'm a part of my home-internet VPN, right?
    – Tim
    Jun 22, 2016 at 19:11
  • Yes, it does. I am using it that way. Prerequisite is that IP masquerading is configured in iptables, but I am almost sure that this is already done on the openWRT router.
    – stueja
    Jun 22, 2016 at 19:21
  • Great, the template I'm considering is this nice write-up that I found, that does use masquerading in the rules: stj.me/2016/02/17/openvpn-ddwrt.html
    – Tim
    Jun 22, 2016 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .