0

I have a VPN setup using OpenVPN and an OpenWrt/LEDE router.

Everything works fine, except when I'm at home (it's my main office) where I have the same setup network wise.

Here's the setup shared by both LANs:

OpenVPN using Tunnelblick client on Mac OS X

Router:    10.0.0.1
Mask:      255.255.255.0
DNS:       10.0.0.1

Doing a tunnel makes that both networks now share the same subnet, which is a bad thing and nothing resolves. Sharing my cellular data works as it's out of the LAN.

Now, I've been looking around for a way to make all VPN IPs masked as 10.0.1.* instead of their real local IPs. Didn't find any quick solution to this.

This way it maps like so:

10.0.1.5 > goes through VPN > 10.0.0.5
10.0.0.5 > stays local      > 10.0.0.5

Maybe there's a setting in the OpenVPN client config file I could use to mask all remote IPs to another subnet?

pycvalade
  • 338
  • 2
  • 9

1 Answers1

1

There is no simple solution other then the correct one you appear to want to avoid - You really don't want to be doing this as having the same IP in 2 places in a network breaks things. Unfortunately the correct solution is to move 1 network to a different range.

Depending in exactly how the network is set up, there are some tricks you can use. Unfortunately these solutions are messy and difficult to debug. First the general stuff:

You can use netmask to route traffic. A more specific netmask will take precident over a more general one. Thus you can advertise individual IPs across the VPN link so the router knows to prefer that.

This leaves the problem that, while the router will know how to direct the traffic, the traffic won't get to the router because it's on the LAN. You can fix this by putting static routes for particular IPs with the router gateway on your workstations or move OpenVPN to the workstation. It will also mean that an overlap of IP addresses in your LAN means where the IP is identical on both sites your VPN won't work. You can solve this on a per host basis using source routing if supported by the host. Easy to say, hard to do, not sure that Windows can do it out the box.

An alternative is to use port mapping and have the VPN server translate your request. IE you request something from 100.0.0.1 and the VPN server uses NAT to rewrite the packet to 10.0.0.1. This is a lot easier but means forsaking DNS or running solution DNS.

davidgo
  • 73,366