2

I have several devices running on a network at home. I'd like to be able to access them remotely, specifically OpenHAB and OctoPrint webpages, without exposing any ports on my network or dealing with DNS at home.

I was planning to set up an OpenVPN server remotely on DigitalOcean and connect to it via smartphone. Is there a way to have a single computer (say a Raspberry Pi) expose the entire home network to the OpenVPN server?

Speed is not a major issue, but security is. It seems like something doable but I don't have enough networking background to know the right words to search, this would be my time setting up a VPN server. I do not want to install VPN software on every device at home as that's much more to keep updated and some are just little Arduino boards I'd like to ping. Any device outside the network would have VPN software installed of course.

1
  • If you have a running PC at home, you could use Chrome Remote Desktop, which works without requiring to open ports (or LogMeIn, but there is no more free version)
    – iDevlop
    Sep 21, 2017 at 9:00

1 Answer 1

0

Is there a way to have a single computer (say a Raspberry Pi) expose the entire home network to the OpenVPN server?

Yes, that's a basic function of a router.

  • Both the server and the Raspberry will need IP routing (forwarding) enabled. For example, on Linux that would be the net.ipv4.conf.all.forwarding and net.ipv6.conf.all.forwarding sysctls.

  • The VPN server needs a route to the LAN subnet via the Raspberry Pi's IP address. (Specifically, via its VPN address, not the LAN one, since the route is from the perspective of VPN server.)

    Note: When you're using OpenVPN in the default "tun" mode, this actually needs to be split into two configurations:

    1. a kernel route to home subnet via tun0 (no gateway),
    2. and an OpenVPN iroute option to the same subnet via Raspberry Pi's IP as the gateway.

    In "tap" (Ethernet emulation) mode, a single kernel route would be all you need.

  • Your LAN's primary router (e.g. the ISP-issued "router/modem") needs a route in the opposite direction – to the VPN subnet via the Raspberry Pi's LAN IP address.

    There are alternatives in case you can't configure this, but they're a topic of a separate thread.

  • The Raspberry Pi itself already has all necessary routes (as it's directly attached to both the LAN and the VPN).

  • Finally, your VPN server needs to push a route for the LAN subnet to all other clients (such as your phone), so that they'll know they need to go through the VPN to reach it.

    (This is optional if you're already pushing the "default" route, but I'd recommend it anyway.)

3
  • Great, I'll give that all a go. My ISP's router, Pace 5031NV, doesn't appear to have the ability to customize routes unfortunately. Contacting their support about i or a workaround. I've been thinking about switching providers anyway.
    – mwilliams
    Sep 22, 2017 at 6:01
  • One of your other options would be to configure the same route manually on devices themselves (or even change their 'default' gateway to use the Raspberry). Another would be to use SNAT (masquerade) for VPN→LAN traffic. Both are somewhat ugly. Does your ISP's router have the ability to work in "bridge" mode? Sep 22, 2017 at 7:15
  • I feel silly that I hadn't thought to ask them before. I have a second much more powerful router just working as an AP that I'd rather be using, and it does support custom routes.
    – mwilliams
    Sep 22, 2017 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .