I just upgraded my aging Netgear router to DD-WRT, and I'm wanting to use the built-in OpenVPN Server component to service my home's private single subnet.

So I have this setup: [public-Internet]----[dynamic dns host]<---ISP--->[DD-WRT/OpenVPN-Server router with home private subnet clients]

I want to be able to securely use my home Internet connection and securely access my home private subnet machines when I am out on public Internet or unsecured Wifi.

My DD-WRT has the ability to be an OpenVPN server.

So far, many of the guides I've read seem to want the OpenVPN clients to have a private IP that is different than my single private subnet's address. A lot of them appear to want to point you to something like 10.x.x.x for client IPs.

Is that actually a requirement for this to work?

Is that 10.x.x.x type network an actual physical subnet that I must have a second router for, or is that a virtual subnet that my DD-WRT's OpenVPN Server would 'create' for itself?

Or can I do all of this with the single private subnet that I physically have?

Thanks, in advance, for your insight into my initial foray into setting up an OpenVPN.


The openVPN IP address must be different from your home network's IP range, otherwise you will get in trouble.

On the other hand, the openVPN IP address will only be used between the openVPN server and the connecting device, e. g. your laptop. So your laptop might be assigned, and your openVPN server has Both IP addresses (basically) only exist within the VPN tunnel. Reason is that openVPN will create a virtual network interface (e. g. tun0) on the server as well as the client and assign those IP addresses to it. There is no "physical" network to configure.

You can configure openVPN (server or client) to know the route to your home IP range, so that you

  • connect your VPN
  • your laptop will be assigned for the VPN tunnel
  • you can open your browser, SSH, or Microsoft Terminal Services
  • and point it to 192.168.0.x

Your openVPN server/router itself will be known by two IP addresses: and

The corresponding statements for the routes are

push "route"

on the server and


on the client respectively. You only need one of them; in your scenario it is a matter of taste in which configuration file you put it. Together with IP masqerading in your iptables (which, I assume, openWRT already has), it will allow you to connect to your home network from remote, and also browse the internet from remote. Simple example:

Your laptop -> unencrypted, public WIFI -> internet

will then be

Your laptop -> encrypted VPN -> openWRT -> internet.

So the unencrypted, puclic WIFI provider or sniffers within that WIFI will not be able to read your traffic.

If you want to run openVPN server on a different port, e. g. to protect you from port scanning, script kiddies or similar, use port 9411 as an example.

(Edit: added questions and answers from the comments below this answer into this answer.)

  • Thank you for that - so just to be clear, the 10.8.x.x segment is completely virtual, in the mind of the DD-WRT/OpenVPN-Server itself. I don't need to have a second physical network segment for 10.8.x.x. Is that correct?
    – Tim
    Jun 22 '16 at 18:45
  • Yes, this is correct. You do not need to have a second physical network segment. It is completely virtual, because the openVPN server as well as the client will create a virtual tunnel interface (e. g. tun0), and assign the 10.8.0.x IP addresses to them. In other words: all you need is openVPN client software, two configuration files and the keys and certificates. No network config needed.
    – stueja
    Jun 22 '16 at 18:53
  • And this also allows me to securely use public Wifi hotspots, because I'm a part of my home-internet VPN, right?
    – Tim
    Jun 22 '16 at 19:11
  • Yes, it does. I am using it that way. Prerequisite is that IP masquerading is configured in iptables, but I am almost sure that this is already done on the openWRT router.
    – stueja
    Jun 22 '16 at 19:21
  • Great, the template I'm considering is this nice write-up that I found, that does use masquerading in the rules: stj.me/2016/02/17/openvpn-ddwrt.html
    – Tim
    Jun 22 '16 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.