I have a home network with two gateways on it. GW1 is an ASUS RT-N18U router with FTTH WAN access. GW2 is a D-Link DWR-921. Some devices on the LAN use GW1, some use GW2. GW1 is used for general internet access, GW2 is required to use a specific application which works only on mobile network.

I've successfully setup OpenVPN server on the ASUS router. When I'm not at home, I'm able to login from my Windows notebook to my VPN. When I log in, my VPN client accesses the internet through GW1 (the ASUS router).

I'm looking for a solution to use the GW2 for my VPN client instead of GW1. So I'm still logging in from the internet through GW1 to the VPN server, but then access the internet on the logged in client through the GW2.

Is there any way to create such configuration?


By default, OpenVPN connections are layer-3 point-to-point tunnels, which do not allow this – as there is no layer-2 header (i.e. the packets have no MAC addresses or equivalent), the client cannot specify which device to send the packets to. There's only one host they could go: the other end of the tunnel. In other words, it means the VPN server has to be the first gateway.

Though it perhaps would be possible to configure GW1 itself to forward specific packets to GW2, instead of forwarding them through the WAN link. If your mobile application talks to known destinations (i.e. you can obtain a list of IP addresses), then standard routing might do the job. Another feature available in Linux and some Linux-based routers (such as OpenWRT) is "policy routing" which can select the gateway based on other properties, e.g. the ASUS GW1 could route packets from VPN users via GW2, but everything else via WAN.

But that's complex, and I couldn't even begin to provide instructions for doing so on an ASUS router. (It's doable on bare Linux though.)

The other option, somewhat simpler, is using OpenVPN's "tap" mode (which emulates an Ethernet link). Such a "layer-2" VPN can then be bridged to your physical LAN, making it appear as if both groups of devices simply are on the same Ethernet segment. With this, a VPN client would be able to directly specify any LAN host as its gateway – including GW2.

The downside is that the layer-2/tap/ethernet mode is only compatible with the "full" OpenVPN client on Windows and Linux – it won't work with Android/iOS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.