Tutorial: Configure Client-Side Subnet Routing in Access Server

Abstract

Effectively route client-side subnets through your business VPN with Access Server's user permissions and routing settings.

Overview

This tutorial explains routing specific client-side subnets through a host, such as a router, configured through Access Server's user permissions. This setup enables other end users to access their local network behind the host while connected to the VPN. Proper user permissions and network routing configuration are essential to facilitate this functionality. The steps outlined can ensure that the desired client-side subnets are correctly routed through Access Server for seamless connectivity.

Prerequisites

• An installed Access Server.

• Admin Web UI access.

• Basic understanding of IP addressing, subnetting, and routing.

• The static IP address for your host device.

Step 1: Configure user permissions for the host

1. Sign in to the Admin Web UI.

2. Click Users.

3. If there is no entry for the host user account, add one by clicking Add New User and providing a username and assigning the user to a group. (For example: "Branch Network Gateway.")

4. Configure the following settings for the host user account:

   • Enable Allow Auto-login.

   • Set IP addressing to Static.

   • Enter the static IP address in the IPv4 field.

   • Enable Configure VPN gateway.

   • Enter the client-side subnet in the Network on the VPN client side field.

5. Click Save and Restart.

Step 2: Configure the host device for static routing

1. Enable static routing on your host device (this depends on your device, so refer to your router documentation, etc., for specifics).

2. Access the router's configuration interface.

3. Add a static route for the VPN subnet.

Step 3: Enable IP forwarding (if using a Linux client as the gateway)

If you're using a Linux client as the gateway, enable IP forwarding:

1. Connect to the terminal.

2. Run this command to enable IP forwarding, allowing it to route traffic between networks:

   sudo sysctl -w net.ipv4.ip_forward=1

Example scenario

Consider the following scenario to illustrate the setup:

• User: Fred connects to the VPN from his home.

• Network Setup: Fred's home PC has two network interfaces—one connected to the internet via DSL and another to a test network (192.0.2.0/24).

• Objective: Allow other users on the VPN to access the test network.

Fred connects to the VPN using a VPN client on his main PC. After following the steps above, you can make the test network accessible to other VPN users, including users on a back-end network in the office.