192.168.0./24?

[mrf0ster]

Hello all, now please go easy on me, I try to understand this as much as I can, but sometimes no matter how much as I read, things just go over my head.

So I have a router that I have installed Merlin onto. I am just trying to understand rules when it comes to setting up WAN and OVPN1 settings. I think I understand that if my first rule is (please forgive me if I have this wrong) 192.168.0.1/24 WAN then all ip addresses on my router go through the (Iface) WAN via my ISP. However, if I have a rule on the VPN director that also has, for example the second line, Study PC 192.168.0.178 (Iface) OVPN1 along with 4 other (Iface) OVPN1 IP Addresses, is there a preferred order in which I should put this?

So for example, should my first rule in VPN director be ALL 192.168.0.1/24 (Iface) WAN and all following rules be individual rules for VPN such as Study PC 192.168.0.178 (Iface) OVPN1, or does it not matter what order the rules are in as they would work as directed anyways?

The only reason I ask is that I have, (probably like all of you with many devices on WIFI etc), far more devices going to WAN than I have personally set in VPN director. Is there like a strict or conventional way this should be set up? Or can I just setup the IP's I want to route through VPN rather than going 192.168.0./24 and then having 4 IP addresses going to OVPN1.

So I guess, can I basically dispense with the the 192.168.0.1/24, and only make rules for the clients I want to go through the VPN?

Cheers Mark

 

[drinkingbird]

First, you would need to use 192.168.0.0/24, as 0.1/24 is not a valid subnet.

But if you want just certain IPs to hit the VPN, then just create entries for those and leave off the /24. The default when a rule isn't matched is to go to the WAN and bypass VPN.

If you wanted to simplify it a bit you can give the VPN clients DHCP reservations in a subnet, for example 192.168.0.192 through 254, then just create a single rule for 192.168.0.192/26 pointed to OVPN1.

If you go the subnet route, make sure your standard DHCP range doesn't overlap, i.e. have it stop at .191 (or 1 IP before the subnet you choose).

 

[mrf0ster]

Thanks mate much appreciate.