mjhjmtu

I have a Raspberry Pi with one Ethernet Connection. This ethernet wires up the device to both the internet and the local network. I am trying to allow, via OpenVPN, a connection from outside the local network to access the machines on the local network as the local network itself cannot have a public static IP.

I have set up OpenVPN server successfully and can connect the Pi from another computer via the VPN connection however I am unsure how to then allow network access to the rest of the local network that the Pi is on by routing connections from OpenVPN through to it's local network.

Many tutorials online assume that there are two different interfaces that each respectively connect to the internet and the local network however in this case we have one interface doing both. Is there a way that I can use NAT to route OpenVPN connections to the local network such that connections can be made in both directions, to and from the local network and the OpenVPN connection via a static local ip?

(I'm assuming you are using an L3 VPN.)

The clean (NAT-less) way to do this is to give an IP of your LAN to your OpenVPN client. Let's say your LAN is 192.168.0.0/24, you can statically allocate one IP in this range for your OpenVPN client.

Let's say you give 192.168.0.42 to your OpenVPN client. Nodes on the LAN trying to reach the 192.168.0.42 will do an ARP request on the LAN in order to find the MAC address associated with the IP address. However, your OpenVPN is not on the LAN and cannot answer to the ARP requests: thus the nodes on the remote LAN cannot reach your OpenVPN client.

IP configuration on the server:

ip address add 192.168.0.33 peer 192.168.0.42 dev tun0

IP configuration on the client:

ip address add 192.168.0.42 peer 192.168.0.33 dev tun0

First, we need to ask the OpenVPN server to answer to ARP request on behalf of the client. This is called an ARP proxy:

ip neigh proxy 192.168.0.42 dev eth0

Now, nodes on the LAN trying to reach 192.168.0.42 will get an ARP reply from the OpenVPN server and send the packets to it.

The next step is to enable IP forwarding on the OpenVPN server:

sysctl -w net.ipv4.ip_forward=1

When receiving a packet for 192.168.0.42, the OpenVPN server will now route it to the client.