I am planning to build a home lab.

DESCRIPTION: My goal is to be able to access to my homelab from a remote pc (as my laptop). This is what I have in mind.

enter image description here

In order to secure the access from the outside I thought to implement a VPN (using OpenVPN) on my Raspberry Pi.

PROBLEM: However here comes my doubt: if the VPN is installed on the Raspberry Pi, then my traffic will be encrypted only when I connect to it. However, if I wanted to connect to the Storage Server I would bypass the VPN.

QUESTION: how can I make sure that the entire homelab network is accessible via VPN connection? Feel free to suggest alternatives if you think my approach is wrong.

  • Connect the PI to the modem and pass all traffic through it. Best to protect all devices that way.
    – John
    Oct 9 at 20:48

The easiest way is to put the VPN on your router and ensure it pushes (advertises) the internal network route.

Alternatively, you can do the same on the Pi, but you then need to add routes on your router for the VPN via the Pi and have the Pi forward packets. ( note you will have asymetric routing with packets from devices bouncing via the router, with packets from the Pi going direct to PC's)

I further comment that the above uses a routed netowork (tun based). You could convert the vpn and Pi into a bridge (ie a virtual switch) using TAP interfaces, but this approach luts a lot of extra load on the network and is harder to work with.

  • Thanks for the answer. Just one curiosity? How do small businesses do it? Do they put the VPN on the router or is there some alternative which I may not be aware of? Oct 10 at 15:00
  • 1
    In my opinion putting VPN on the router is definitely a standard model and logical solution - even for small businesses. (In support - I have done this myself for small/medium businesses, VPN servers and clients are built into DD-WRT and many higher end SOHO routers, and as the VPN is a virtual connection the logical place to manage Internet connections is on routers). Historically, SME's paid significant money to add expensive CISCO routers to their networks to do this, so yes, I would argue its a best practice.
    – davidgo
    Oct 10 at 20:11

Put the Raspberry PI between the modem and router, so traffic goes modem -> pi -> router.


Let say you have a VPN between the Rasperry and the laptop.

With OpenVPN, you can "push" internal routes from the internal network to the laptop. Then the laptop knows how to join the internal network. You may also have to set routes on the internal nodes telling your laptop is accessible through the VPN. Then all communication will be VPN cyphered.

If you want to bypass the VPN with the Storage Server, let's its normal route on the Storage Server, and make it reachable through a public address (the laptop will communicate to it with this address). This could imply port redirection if the router does network address translatlion (NAT).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.