Tutorial: Reach OpenVPN Clients Directly from a Private Network

Abstract

How can you reach OpenVPN clients directly from a private network? This tutorial will show you how. Access Server makes it possible with routing.

Overview

This tutorial details how to use Access Server's routing feature to grant access to connected VPN clients.

By default, Access Server uses network address translation (NAT) for packet routing on the VPN. NAT is the easiest way to grant access to resources on the same network as Access Server, such as file or web servers. However, NAT traffic is one-way: OpenVPN clients can reach resources on the private network behind Access Server, but you can't reach clients.

To provide direct contact with connected clients, you set up Access Server's routing.

Routing doesn't use address translation — Access Server forwards traffic coming from a VPN client in the VPN client subnet directly to the target private network. You must make the target network aware of where to reach the VPN client subnet.

You can do this by adding a static route to a gateway or in the target server's operating system.

Follow the steps below to configure routing and add the static route.

Tip

We recommend using routing for Access Server configurations that involve the VOIP protocol. It typically doesn't work with NAT.

Step 1: Change from NAT to routing

Access Server uses NAT by default. To change to routing:

1. Sign in to the Admin Web UI.

2. Click Access Control.

3. Click the Global Access Rules tab.

4. Click Route for Reachable via to enable global routing.

5. Click Save and Restart.

With routing enabled, you now have two-way traffic for Access Server; however, you still need to define the route tables correctly. That's because the target on the private network doesn't know how to respond to traffic from the VPN client subnet.

Step 2: Add static routes

To add static routes:

1. Take note of the VPN client subnet and the Access Server IP address. (For our example, the subnet is 172.16.47.0/24 and the server IP address is 192.168.47.222.)

2. Look up the static route table in the default gateway system on your private network.

3. Add the appropriate static route.

Example 1. Route example

Network 172.16.47.0 with subnet mask 255.255.255.0 to go through gateway 192.168.47.222

Traffic should now flow in both directions, from the VPN client subnet to the private network and from the private network to the VPN client subnet.

Optional: VPN client subnets for cluster setups

If you have a high-availability setup using multiple Access Servers configured as a cluster, the routing and VPN client subnet features are more complicated. For details about using the Group Default IP Address Network to configure routing for a cluster configuration to reach connected clients, refer to Group Default IP Address Networks for Access Server.

Troubleshooting

Whenever you have trouble getting traffic to pass through with Access Server, try to determine the exact spot where things break. To visualize this, we use tools like tcpdump and ping to identify the point where traffic breaks. We describe this in detail on our troubleshooting reaching systems over the VPN tunnel page.