Hey guys
I set up an OpenVPN server on my MT router. All I need is to be able to access the local network at home from a remote PC, located in my office in this case. The remote PC got connected to the VPN, receives a local IP (192.168.1.231),. but can only ping the router (192.168.1.1). Also to the outside world, it has the external IP of my office (203.x.x.x), not of my home network (103.x.x.x) when I check it with “what’s my IP” sites.
I read about adding a masquerade rule in NAT. I did, but not sure if I did it correctly.:
If IP addresses given to VPN clients overlap with LAN subnet, you need to enable proxy ARP on LAN interface. To other LAN devices, they looks as part of local subnet, so they send ARP request and get no reply. With proxy ARP enabled, router will answer on behalf of VPN client.
If you want to route traffic to internet through VPN server, you need to configure client to use it as default gateway.
Thanks, Sob
I tried with some other interfaces before and it didn’t work at all.
Now I can ping the router (192.168.1.1) from the remote PC, but can’t ping any of the internal hosts like 192.168.1.10, nor I can access them in any way. From the router, I can’t ping the remote PC (192.168.2.232). But now Winbox works with the internal address of the router.
Any idea how I can see the other host as well?
The whole idea of this exercise is to be able to access my NAS (192.168.1.10) remotely.
Correct? If so, it should work. It’s not your firewall, it doesn’t block anything. It could be problem on client side, check if it has proper route to 192.168.1.0/24.
I added this one manually for another VPN I use.
But I can see the route in the GUI:
I guess they are dynamic routes?
Should I make a static one?
P.S. One more thing. From the remote client, I can ping the router only if the VPN pool is 192.168.1.x. If it is 192.168.2.x I can’t ping, nor I can use Winbox.
I meant routes on remote PC (VPN client). It needs to know that 192.168.1.0/24 is reachable via VPN. So check that.
And I thought the previous 192.168.2.232 was a typo, I don’t see that address or subnet anywhere in config you posted. If you changed VPN pool to different subnet, it removes the need for proxy ARP. But it can make things more difficult with firewalls on computers, because they often allow access only from local subnet by default.
I tried before with the 192.68.2 subnet, but I chanded the pool to 192.168.1.x now. I also added 192.168.1.0 to the config file of the client, but nothing changed. Still can’t ping beyond the router.
My config file:
client
dev tun
proto tcp-client
remote x.x.x.x 443
nobind
persist-key
persist-tun
cipher AES-256-CBC
auth SHA1
pull
verb 2
mute 3
# Create a file 'user.auth' with a username and a password
#
# cat << EOF > user.auth
# user
# password
# EOF
auth-user-pass user.auth
# Copy the certificates from MikroTik and change
# the filenames below if needed
ca cert_export_MikroTik.crt
cert cert_export_nikolav@MikroTik.crt
key cert_export_nikolav@MikroTik.key
route 192.168.1.0 255.255.255.0
Sorry for late reply, I missed the thread. Check what exactly happens. Either watch for packets using Tools->Torch, or add logging rules to different chains and you’ll see if they are correctly coming from VPN, if they pass through router, if any replies are coming back, where they go, etc. Packet from VPN client should be seen in prerouting first, coming from VPN interface, then in forward, next in postrouting leaving to LAN. And same for replies, only incoming and outgoing interfaces will be swapped. At some step it will break and depending on which one it will be, it will tell your what’s wrong.
I am afraid there may be an issue with the interpretation of the config file at the client. In many cases, the route keyword within OpenVPN configuration just tells the OpenVPN software how to handle some destinations, but you have to tell the operating system separately to use the virtual OpenVPN interface as a gateway to these destinations. I usually see people hitting this in the opposite scenario, when they set the (single) OpenVPN interface of the server as a gateway towards subnets behind some OpenVPN clients, but don’t tell to the OpenVPN server which subnets are behind which clients (using the iroute statement in the client-specific part of server configuration). In client mode there is no ambiquity (there is only one remote end), but I’m still not sure whether OpenVPN running in client mode automatically installs the OS-level routes if it only has them in its local configuration.
In an OpenVPN client setup against a Mikrotik server I’ve got prepared by someone else, there is a separate .bat file to install the route to Windows, whereas if the server is a non-Mikrotik one, and therefore capable of pushing routes to the client, this .bat file is not necessary and the OpenVPN client adds the routes received from the server to the routing table of the OS.
So instead of adding route 192.168.1.0 255.255.255.0 in your openvpn.conf, you may have to run route add 192.168.1.0 mask 255.255.255.0 192.168.1.1 (on Windows) or an equivalent comman on Linux.
I realized I’m actually ABLE to ping most of the internal hosts… But so far I was trying with only one - 192.168.1.10. So I can ping say 192.168.1.101, which is some of my kid’s PCs. I can’t ping/access the only one I care about - 192.168.1.10, which is my NAS and which is behind another VPN client installed on the router - I’m using SaferVPN in that instance. The moment I put 192.168.1.10 outside of the SaferVPN setup I can ping and access it from the internal network.
So, what I need is to access this particular IP (192.168.1.10) when it IS behind the SaferVPN. This is the only reason I need to use the OpenVPN server on the router. Is it actually possible?
PS. Sindy, I tried this, but it didn’t help. I still can’t ping the remote PC from the router.
