Sorry for the late answer. This is my configuration, running on a dedicated server (with gigabit connectivity) and my OpenWrt box. I left out all the non-essential stuff, including logging and security options like
ns-cert-type and whatnot.
ifconfig-pool 10.1.3.100 10.1.3.200 255.255.255.0
keepalive 10 120
route 192.168.2.0 255.255.255.0 10.1.3.5
push "route 192.168.2.0 255.255.255.0 10.1.3.5"
10.1.3.5 is my OpenWrt’s VPN IP address
10.1.3.1 is my server’s VPN IP address (not visible in config)
- No bridging is configured
- No NAT is configured (I use IPSec for that now)
- Clients receive a route to my home network’s IP range
- The server has a route to my home network.
This means VPN clients can talk to each other and the server as well as all IPs in my home network (unless otherwise firewalled).
remote vpn.example.com 12345
Additionally, on OpenWrt client (important, I guess):
...to prevent a useless (and potentially troublesome) “route to self” from being created.
Again, no bridging is enabled on the OpenWrt box. Instead, regular routing is used and the firewall is set accordingly.
The “magic” in all this is to push the route to your home network to your clients. Firewalls aside, that’s all to it.