I want to set up an OpenVPN-based private VPN so I can access my home LAN while on the road. I'm looking to have these capabilities:
- Remote clients should be on a separate subnet (which seems to be the easiest way to set up OpenVPN)
- Remote clients can "see" and interact with all the devices on my home LAN;
- Home clients can "see" and interact with remote clients;
- All "non LAN" traffic from the remote clients should use the remote client's existing internet connection (i.e., I don't want remote clients to access the internet by routing through the OpenVPN server and my home LAN's own internet connection)
That last requirement, if I'm understanding things correctly, involves setting up a split tunnel.
Here's a picture which may help illustrate what I'm trying to achieve:
The OpenVPN server is running under Debian Buster. Most, but not all, of the various remote and client machines are Windows- or iOS- based.
The VPN subnet is 192.168.5.0/24. My home LAN's subnet is 192.168.1.0/24. My home LAN's internet gateway is 192.168.1.254.
I have been able to create remote connections which appear to be split tunnels. From my iPhone I can successfully create a link to the OpenVPN server and the iPhone is assigned an IP address from the VPN subnet but I am still able to surf the web (which I believe means the "non LAN" traffic is being routed to the iPhone's internet connection).
The iPhone can ping either the client side of the VPN server (192.168.5.1) or a device from the home LAN side (192.168.1.5, which is the home LAN address of the VPN server) But I cannot establish an SSH or RDP connection from the client side from the iPhone. Sometimes pinging just isn't enough :).
Here is my OpenVPN server.conf file:
port **redacted**
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/mycroft-server.crt
key /etc/openvpn/server/mycroft-server.key
dh /etc/openvpn/server/dh.pem
topology subnet
server 192.168.5.0 255.255.255.0
client-to-client
push "route 192.168.1.0 255.255.255.0 192.168.5.1"
push "dhcp-option DNS 192.168.1.5"
push "dhcp-option DOMAIN localnet"
push "block-outside-dns"
cipher AES-256-CBC
tls-version-min 1.2
tls-crypt /etc/openvpn/server/ta.key
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-$
auth SHA512
auth-nocache
keepalive 10 60
persist-key
persist-tun
compress lz4
daemon
user nobody
group nogroup
status /etc/openvpn/openvpn-status.log
status-version 3
log-append /var/log/openvpn.log
verb 3
Here is my client ovpn file, minus the various cryptographic elements:
client
dev tun
proto udp
remote moose.zapto.org 37639
route 192.168.1.0 255.255.255.0 192.168.5.1
cipher AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-$
resolv-retry infinite
compress lz4
nobind
persist-key
persist-tun
mute-replay-warnings
verb 3
Additional Info
I should've included this but forgot. Here's the output of route -n run on the OpenVPN server:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.254 0.0.0.0 UG 202 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
192.168.5.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
The last entry is apparently created by OpenVPN.
I tried adding a route from to the VPN subnet from my home LAN's subnet with this command:
sudo ip route add 192.168.5.0/24 via 192.168.1.5 dev tun0
but it produces the following error:
Error: Nexthop has invalid gateway.
Ping and Traceroute
From my iPhone I can ping both the client-side of the VPN server (192.168.5.1) and the machine the VPN server is running on (i.e., from its "LAN side": 192.168.1.5).
From the client side tracert 192.168.1.5 succeeds with a single hop.
