OpenVPN Server - route back to client

[mekabe remain]

I am running OpenVPN server on my Asus RT-AX88U
On another location I have a Keenetic router which has OpenVPN client.
The client connects to VPN server on AX88U
I tried both with TAP and TUN configuration.
But I want to be able to access clients behind the Keenetic router.
So I need to route back subnet 192.168.1.0/24 (which is the LAN of the Keenetic router) back to the VPN client on Asus router.

How can I route back a subnet to a vpn client ?

Also which type of VPN (TAP/TUN) is suitable for this operation ?

thanks

 

[eibgrad]

You route from the OpenVPN server and back to the LAN behind the OpenVPN client by configuring the Manage Client-Specific Options section of the OpenVPN server. It's there you define the subnet(s) available behind the OpenVPN client based on the CN (Common Name) in the OpenVPN client's cert (iirc, named "client" if using the build-in certs and keys of the ASUS router).

As far as tun (routed) vs tap (bridged) tunnels, 99% of the time you use the former, since having two different IP networks between the two sides is typical. The latter usually only makes sense when both sides are using the same IP network *and* are logically part of the same enterprise. For example, a company that has two offices on either side of the street would typically use a bridged tunnel since the fact they are physically separated is merely due to happenstance (e.g., they didn't have enough room within the one building).

The one exception I can imagine for the home user using a bridged tunnel is when the OpenVPN client is the *only* device acting as the client. IOW, it's NOT acting as a gateway for other devices behind it. That would allow the OpenVPN client to participate in the remote LAN as a *full* member, just as if it had been plugged into the switch of the remote network, w/ all the same privileges, access to network discovery, no firewall, etc. A very powerful configuration, but also potentially dangerous if such access should fall into the wrong hands.

Note: With a bridged tunnel, you do NOT need to configure Manage Client-Specific Options since that only applies to routed configurations.