Site-to-site OpenVPN without both sides in the same-numbered IP subnet?

[kensey]

I'm trying to set up site-to-site VPN between my office and home, but I have a couple of issues that mean I can't set it up in the config the tutorial article for that uses:

• Office network is not numbered the same as home (192.168.33.0/24 at the office, 192.168.1.0/24 at home). I can't renumber the office network and don't want to renumber home (last time I did that some of our devices had issues for days, I think because they didn't handle DHCP lease changes or ARP or something properly).
• Office network is not directly connected to the Internet (my office has its own subnet, routed from the building';s core network which, just to note, is also not 192.168.1.0/24).

So what I'm trying to set up is:

[192.168.33.0/24] <---> [192.168.19.0/24] <---> (Internet) <---> [192.168.1.0/24]
        ^                                                                ^
        |                                                                |
        +--------------------------- [VPN subnet] -----------------------+

Both routers are Asus -- the home router is an AC3200 and the office is an old N66U, each running latest official Merlin for their respective hardware. (The N66U will probably go to the fork that's continuing support for it soon, but I haven't done that yet.)

My first thought was, just OpenVPN the office router to the home router. That worked, but only one way -- I can access things at home from the office, but not vice-versa, even after setting up routing rules for each side to gateway to the other through the VPN. I can ping the office router's client VPN-side address from home, but not its IP in its own subnet or anything beyond -- those just get dropped. I tried monkeying with the office router's iptables directly to just blanket-allow anything coming from the VPN or the home network, but that didn't work.

1. It seems like the VPN software itself is just dropping connection-opening incoming packets from the other side of the VPN, regardless of iptables rules or anything else.
2. Assuming 1) is correct, is there an option or custom config or something I can set that will allow incoming packets to the office side to get through?
3. If the answer to 2) is "no", what have people done to get past this sort of thing? Running a VPN connection back to the office from home through an SSH tunnel going over the VPN probably would work, but in the same way that driving cross-country in reverse works. I have a DigitalOcean account and I'm not opposed to running VPN traffic through an SSH reverse tunnel from a cloud instance, but that feels like a good way to run up a hefty transfer bill.

 

[martinr]

Did you see this recent post?

https://www.snbforums.com/threads/s...n-between-two-asus-routers.55747/#post-474635

And welcome to the forum

 

[eibgrad]

I'm going to assume you've configured a "routed" (tun) OpenVPN tunnel, and NOT a "bridged" (tap) OpenVPN tunnel.

When configuring for site-to-site, in order for devices behind the OpenVPN server to access devices behind the OpenVPN client, you have to add an iroute directive to the CCD file for that OpenVPN client (based on the common name of the client's cert) that tells the OpenVPN server what network lies behind that particular client (after all, in theory, there could me *many* OpenVPN clients connecting to that server, and the server has no idea what network(s) lie behind any given OpenVPN client). Merlin and similar tomato based routers make this easier to implement by using the "Manage Client-Specific Options" field of the OpenVPN server (enable Advanced Settings). It's there that you specify the network that lies behind the OpenVPN client w/ the specified common name.

 

[maxbraketorque]

Since you already know how to set up a regular OpenVPN connection, then try this:

https://www.snbforums.com/threads/h...i-directional-router-to-router-openvpn.55400/

 

[Martineau]

I'm trying to set up site-to-site VPN between my office and home, but I have a couple of issues that mean I can't set it up in the config the tutorial article for that uses:

• Office network is not numbered the same as home (192.168.33.0/24 at the office, 192.168.1.0/24 at home). I can't renumber the office network and don't want to renumber home (last time I did that some of our devices had issues for days, I think because they didn't handle DHCP lease changes or ARP or something properly).
• Office network is not directly connected to the Internet (my office has its own subnet, routed from the building';s core network which, just to note, is also not 192.168.1.0/24).

So what I'm trying to set up is:

[192.168.33.0/24] <---> [192.168.19.0/24] <---> (Internet) <---> [192.168.1.0/24]
^ ^
| |
+--------------------------- [VPN subnet] -----------------------+

Both routers are Asus -- the home router is an AC3200 and the office is an old N66U, each running latest official Merlin for their respective hardware. (The N66U will probably go to the fork that's continuing support for it soon, but I havenn't done that yet.)

My first thought was, just OpenVPN the office router to the home router. That worked, but only one way -- I can access things at home from the office, but not vice-versa, even after setting up routing rules for each side to gateway to the other through the VPN. I can ping the office router's client VPN-side address from home, but not its IP in its own subnet or anything beyond -- those just get dropped. I tried monkeying with the office router's iptables directly to just blanket-allow anything coming from the VPN or the home network, but that didn't work.

1. It seems like the VPN software itself is just dropping connection-opening incoming packets from the other side of the VPN, regardless of iptables rules or anything else.
2. Assuming 1) is correct, is there an option or custom config or something I can set that will allow incoming packets to the office side to get through?
3. If the answer to 2) is "no", what have people done to get past this sort of thing? Running a VPN connection back to the office from home through an SSH tunnel going over the VPN probably would work, but in the same way that driving cross-country in reverse works. I have a DigitalOcean account and I'm not opposed to running VPN traffic through an SSH reverse tunnel from a cloud instance, but that feels like a good way to run up a hefty transfer bill.

If you add the office 192.168.33.0/24 subnet(s) to your home OpenVPN server does this not work?

 

[kensey]

Great stuff! I don't want to mess with it remotely but as soon as I'm back in the office on Tuesday I'll be checking out what works. Thanks folks!