help with routing (and VPNs!)

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › help with routing (and VPNs!)

tanivula

998 posts

Ultimate Geek
+1 received by user: 158

Lifetime subscriber

#198766 21-Jul-2016 16:02

Hey, hopefully someone kind can help me or point me in a right direction.

Putting together a proof of concept to access a mobile bit of kit when it's out on the road for diagnostic purposes. Have a 3g router, unfortunately due to CGNAT, accessing the router (and anything on it's LAN) via WAN wasn't going to work without a VPN (correct me if I'm wrong?).

Anyway.. this is roughly how the gear is setup.

Primary Router (running OpenVPN server) on 192.168.1.x (yes, I know this isn't ideal!) with DynDNS service to get WAN IP

3G router, connecting to Primary router via VPN Client config - lan is 192.168.0.x - receives 192.168.1.200 from VPN server

other laptops connecting to the Primary router via VPN - 192.168.45.x - receives 192.168.1.201 from VPN server

I am having trouble accessing the 192.168.0.x network as another VPN Client (192.168.45.x). Accessing the 192.168.0.x network is fine from the 192.168.1.x - so provided you're not connecting via VPN, you can access the VPN clients. 192.168.1.201 can access 192.168.1.200 (brings up the 3g router login pages, same as accessing 192.168.0.1, however accessing 192.168.0.1 does not work)

I have enabled client - client in the OpenVPN settings. so scratching my head, I believe I need to put some static routes inplace - but not sure if this needs to be in the Primary router or the 3g router, or both? Any help would be appreciated!

I have already done this on the main router:

Destination Gateway / Next Hop SubnetMask Metric Interface

192.168.0.1 192.168.1.200 255.255.255.0 0 br0 (LAN)

Dynamic

4016 posts

Uber Geek
+1 received by user: 1853

ID Verified

Trusted

Lifetime subscriber

#1596384 21-Jul-2016 16:08

Have you got the APN for the cellular network set to direct ? Currently it is likely set to internet which will in most cases geta CGNAT address - fine for browsing and email but not fine for VPNs and incoming port forwarding.

This should get you a real public IP address. We frequently have to do this for client VPNs from devices using the cellular network.

“Don't believe anything you read on the net. Except this. Well, including this, I suppose.” Douglas Adams

tanivula

998 posts

Ultimate Geek
+1 received by user: 158

Lifetime subscriber

#1596513 21-Jul-2016 21:16

Thanks, yeah, might have to bite the bullet and get a spark sim and change the APN to get a public IP on the 3g router.

Seems Vodafone don't do it anymore?

Doing it this was is going to be a more elegant end product too. Hmm

chevrolux

4962 posts

Uber Geek
+1 received by user: 2638
Inactive user

#1596521 21-Jul-2016 21:35

If I'm understanding correctly you aren't having any trouble getting the remote (3g) router to connect to your core router? If it was an APN issue then the VPN shouldn't even establish (like on 2degrees for example).

Also, you say you have no problem accessing the remote subnet from your core? But only have an issue when connecting to the core via vpn and then trying to go on to the remote subnet.

I think your issue will come down to your route table not having the correct routes in place.

insane

3325 posts

Uber Geek
+1 received by user: 1006

ID Verified

Trusted

2degrees

Subscriber

#1596526 21-Jul-2016 21:40

Just setup a reverse SSH tunnel, then the remote end always phones home so to speak, and it doesn't matter where it's sitting behind, CGNAT or not.

tanivula

998 posts

Ultimate Geek
+1 received by user: 158

Lifetime subscriber

#1596699 22-Jul-2016 10:06

chevrolux: If I'm understanding correctly you aren't having any trouble getting the remote (3g) router to connect to your core router? If it was an APN issue then the VPN shouldn't even establish (like on 2degrees for example).

Also, you say you have no problem accessing the remote subnet from your core? But only have an issue when connecting to the core via vpn and then trying to go on to the remote subnet.

I think your issue will come down to your route table not having the correct routes in place.

Yep exactly, just not sure what else needs to be there on the route table.

insane:

Just setup a reverse SSH tunnel, then the remote end always phones home so to speak, and it doesn't matter where it's sitting behind, CGNAT or not.

VPN tunnel is working fine, its getting another VPN client talking to the clients behind the remote 3G client (if that makes sense).

Spyware

3818 posts

Uber Geek
+1 received by user: 1366

Lifetime subscriber

#1596701 22-Jul-2016 10:16

https://openvpn.net/index.php/open-source/documentation/howto.html#scope

Spark Max Fibre using Mikrotik CCR1009-8G-1S-1S+, CRS125-24G-1S, Unifi UAP, U6-Pro, UAP-AC-M-Pro, Apple TV 4K (2022), Apple TV 4K (2017), iPad Air 1st gen, iPad Air 4th gen, iPhone 13, SkyNZ3151 (the white box). If it doesn't move then it's data cabled.

Geekzone

Want to support Geekzone and browse the site without the ads? Subscribe to Geekzone now (monthly, annual and lifetime options).

tanivula

998 posts

Ultimate Geek
+1 received by user: 158

Lifetime subscriber

#1602100 1-Aug-2016 11:16

Thanks for your help and advice. Ended up getting the Spark Sim and using direct.telecom.co.nz + VPN server on the remote device. It's the far better way to do it!