I'm trying to install a VPN between my laptop and my network at home, and all my computers (except my AsusTor NAS) use Windows 10 (I know it would be easier with Linux but I've got no choice). So far, I can communicate with the Windows machine where the OpenVPN server is, but I can't reach my other computers.
Here are my network plan, and my ovpn config files:
server.ovpn
port 1194 proto udp dev tun ca "P:\\Serveurs\\OpenVPN\\config\\ca.crt" cert "P:\\Serveurs\\OpenVPN\\config\\server.crt" key "P:\\Serveurs\\OpenVPN\\config\\server.key" dh "P:\\Serveurs\\OpenVPN\\config\\dh1024.pem" tls-auth "P:\\Serveurs\\OpenVPN\\config\\ta.key" 0 topology subnet server 10.8.0.0 255.255.255.0 push "route 192.168.63.0 255.255.255.0" ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 cipher AES-256-CBC persist-key persist-tun status openvpn-status.log verb 3 explicit-exit-notify 1aa-laptop.ovpn (client):
client dev tun proto udp remote dns.perso.fr 1194 resolv-retry infinite nobind persist-key persist-tun ca "C:\\Program Files\\OpenVPN\\Config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\Config\\AA-LAPTOP.crt" key "C:\\Program Files\\OpenVPN\\Config\\AA-LAPTOP.key" remote-cert-tls server tls-auth "C:\\Program Files\\OpenVPN\\Config\\ta.key" 1 cipher AES-256-CBC verb 3
As you see, I can connect my laptop and my server with OpenVPN, and when it's done I can access my server shares by typing \\10.8.0.1 and \\192.168.63.4, the two methods work, that's great! But I can't reach anything else in my home LAN, neither my computer with \\192.168.63.2 nor my NAS \\192.168.63.7.
It might be a server-side missing-config-param problem or a bridgy-thing, I don't know. But the only piece of help I found use route add gw linux commands which obviously can't work on Windows.
Thanks for advance for your help !
Regards,
44 Answers
You can do this very simply with a single line in OpenVPN using its route command, no need for a .bat file.
To show an example using your client.ovpn:
client
dev tun
proto udp
remote dns.perso.fr 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\Config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\Config\\AA-LAPTOP.crt"
key "C:\\Program Files\\OpenVPN\\Config\\AA-LAPTOP.key"
remote-cert-tls server
tls-auth "C:\\Program Files\\OpenVPN\\Config\\ta.key" 1
cipher AES-256-CBC
verb 3
# Add this line here
route 192.168.63.0 255.255.255.0 192.168.63.1That's it! You just add route 192.168.63.0 255.255.255.0 192.168.63.1 to the client .ovpn. For other network setups, the syntax is as follows:
route SUBNET SUBNET-MASK GATEWAY
So, if you use the CIDR range 192.168.0.0/16, and 192.168.1.1 is your gateway, you would do:route 192.168.0.0 255.255.0.0 192.168.1.1
Importantly, and helpfully, it will (internally) use whatever commands are native to the client's system to actually implement that, so for Windows, it would execute route ADD 192.168.0.0 MASK 255.255.0.0 192.168.1.1, Linux/OSX would be their built-in routing methods. It makes the file more portable this way.
As you might have figured out, since push just sends a setting to the client, you were incredibly close with your original server .ovpn:
push "route 192.168.63.0 255.255.255.0" is missing the gateway.
If you had added 192.168.63.1 to the end, it would've worked. You can do it either from the client-side, or server-side, but I think that it's better to do it on the client-side, as it would be easier to edit the client .ovpn if you needed to access files on a different network, with a different subnet, for instance, but it does depend on the deployment environment.
What you've done is create a new virtual network card in your Windows 10 box, given it an IP address, and made a remote system ping it. This is all standard stuff, but in software instead of e.g. plugging an Ethernet adapter into a USB port.
The problem now is routing, which only Microsoft's Server products support natively. There are methods such as Internet Connection Sharing (select the VPN adapter instead of the Hosted Virtual in that article) which turns your Windows 10 system into a mini Internet Router. It unfortunately won't allow your LAN devices to initiate connections to a VPN client, but otherwise works rather well.
Another alternative is very dodgy, and enables native routing in your Windows 10 client by very low-level changes directly in the registry. Proceed with caution. In fact, probably don't do that at all.
If you really want flexibility, look into a buying low-cost router with DD-WRT or OpenWRT, both of which support OpenVPN and native routing, with nice graphical interfaces. You can get by with a $40 device like the TP-Link WA-901ND, but check the supported devices list on their websites.
If you're feeling adventurous and really want to get to grips with Linux, a Raspberry Pi will do extremely well.
The added benefit is these low-power devices don't need to be on constantly.
1Federico Galli answered my question, in addition to a correct OpenVPN configuration, I needed to launch :
route ADD 192.168.63.0 MASK 255.255.255.0 192.168.63.1Personally, I made a routage.bat file launched at Windows startup because the route is not persisted.
Again, thank you a lot Federico Galli, it's working perfectly now !
2route ADD -p parameter adds permanent. no need to made bat file
1
