Hey Everyone, I hope someone can help me. I have softether running on windows server on a VPS. I have successfully setup up server and clients and can connect via PC and the 4G LTE Routers (Teltonika RUT240 ) and can access siemens s7-1200 PLC. I have a NAT setup on VPN server with 192.168.5.1 and have given PLC static IP of 192.168.5.10 and Have set static IP on TAP Interface on PC with 192.168.5.15 and have Installed virtual ethernet adapter (microsoft loopback) and assigned a satic IP of 192.168.5.20 and bridged the connections in softether server to the virtual hub. This now gives me access from server to PLC ( I can ping PLC from Server and Engineering PC ) I can connect to the PLC from PC fine.
The Problem I now have Is I have a lot of PLCs at remote sites already set up and they all have the same subnets and they can not be changed (connected to other devices in the network I have no control over) I have thought about setting up individual NATs on the routers I will be installing but it seems the OpenVPN TAP client in the router is bridged to the local lan and can't be altered.
The other issue I see is the SCADA software running on the server needs to access these PLC ( I set the PLC IP address in the software for which one they connect to) I now have an issue as they all have same IP so I was possibly thinking about setting PLC IP in the software as the NAT ip set on the Router and then create static route to the PLC on the router.
If I need to access PLC network from Engineering PC I will just connect to server and set the TAP IP to the NAT the PLC is on and may need to cascade the connection to that particular virtual VPN Hub.
I'm also having trouble setting up NAT and removing Tap fro Eth, I was thinking of creating VLAN with IP of 192.168.100.25 and bridge the Tap0 to that interface and then route that subnet to the local lan subnet or something along those lines, Is this achievable or a better more simple way to do this?
I will link a diagram for a better understanding
If anyone has any better ideas or ways of achieving this would be great
It is a bit of a long shot to get some help here, as we don't know exactly what alterations have they done in their image.
Anyway your problem is more of designing the network, rather than configuration. But post here your configuration to have a look.
Use preformatted text </> when you paste. uci show network; uci show dhcp; uci show firewall; uci show openvpn; cat /etc/openvpn/*
I hope this all looks normal and not altered to much. I have gone back to 192.168.2.1 for my testing, but devices installed will be on 192.168.5.1 subnet
I have been through the documentation a lot and rechecked all client configurations and can't find any issues and debug log doesn't help much unfortunately
It's much harder to set up a service and perform troubleshooting relying on unverified documentation, rather than using a tested and working approach.
In addition your configuration contains so many modifications that it might be faster to back up, reset and start from scratch, than wasting time trying to isolate the cause of the issue.
I'm happy to start from scratch again, have already done this a few times. I have done a hard reset on the router multiple times and still no luck connecting via Tun, I have a feeling it may be a bug in the firmware as I can't see anything wrong with client configuration. I have you got any ideas on what to do if I start from scratch again? Or is OpenVPN not a good solution for what i'm doing?
Honestly I don't think it is a matter of restarting from scratch or rebooting.
You are trying to solve a problem consisting of terrible planning, a SoftEther VPN server, some openwrt-based routers and OpenVPN in wrong mode, in a forum dedicated to something close to one of the elements of the problem... These solutions should be designed end to end by some integrator, with equipment tested for interoperability.
Try with Wireguard. At least it supports only routed mode, so you can't go wrong with that.
I have successfully created vlan eth0.1 and bridged tap0 to that instead of local lan. The vlan shares same ip as server virtual lan/nat, server ip 192.168.3.12 engineering pc 192.168.3.15 and rut240 vlan 192.168.3.3 and I can ping between all 3 from each point perfectly fine. So all I need to figure out now is how to create NAT or Bridge the eth0.1 to eth0 (vlan to lan) in the rut240 and this should then allow access to anything on the local lan hopefully.
<Engineering PC 192.168.3.15>----------------<Server VLAN 192.168.3.12>------------<RUT240 192.168.3.3>-------------<PLC 192.168.2.5>
So I just need to gain access to the PLC now, I did create some static routes and ended up locking myself out of router and had to do hard reset so I either got it wrong or not the way to do it.
If all these sites weren't existing already I would just have every device on it's own subnet and would not be an issue, but that can't be done. There are other devices out there such as eWON and few others that use OpenVPN for remote access to PLC etc and they don't have issues with subnets etc so it must be possible to achieve, i'm just not very experienced with networking and vpns etc
Most likely, there's no one who can help you troubleshoot SoftEther VPN.
And using TAP, you are looking for even more troubles, which you can simply avoid with TUN.
So, it would be much easier if you use the official OpenVPN or WireGuard client and server software.
All I have to do now is get access from the RUT240(openwrt) routers vlan to the local lan... surely this is achievable? Been looking at wireguard and looks like it's udp and layer 2 just like the openvpn tap which is layer 2. I can't find any examples of wireguard client to client.
<client-----<Server-----<client
but it may just work without additional configuration. The problem is if I try to use wireguard the rut240 does'nt natively support it so would have to install and use it in the background of the router. Are there any other options such as software-defined networks that work with openwrt?
How will Tun be less trouble? You have to set up static routes on all clients and push routes from server etc where the Tap just seems to work. I don't have any issues with SoftEther to trouble shoot, that's working just fine. Windows can connect to softether in tun or tap with same configurations I have on rut240, so much be a bug or something wrong with the rut240 to not connect in tun. I even tried another server I have that's openvpn via pfsense and everything connects to that fine except tun on the rut240... I had raspberry pi connect fine to both server in tun and tap so I have nailed it down to an issue with the rut240. I would have thought what i'm doing isn't super complicated but is out of scope for what most people use VPNs for. Thanks for all your help so far
I don't quite follow the terminology "natively" and "background", but all VPN instances run as a service, or in the background if you prefer. Only if you are troubleshooting something you run the server in the foreground.
Keyword is "seems", otherwise we wouldn't be arguing now.
In your case you need broadcast domain segregation. You can achieve that with tun protocol. Tap creates a broader broadcast domain. As simple as that.
Most likely you've been looking at the wrong place. Wireguard is L3 and we have many topics here covering that. For example.
I have been having a good look in to wireguard and have set it up on my windows server vps and just win 10 pc and access to local networks pretty quick and easy. The one problem I see is you can not have multiple servers running at the same time, when you activate second server it drops the running one. I would need server per device with it's own tunnel and that way I can connect engineering pc to which ever server the end device/plc I need connecting to at the time. I don't think I could have all peers connecting to the one server, all the peers would have the same allowed IP address since all the PLC have same IP and then there would be no way for the engineering pc to know which PLC is which unless i'm missing something.
First of all you can have as many instances as your physical server can handle. You obviously need to have a dedicated IP/port for each instance.
Second, the tunnel will be setup from the 4g routers, where there is NAT applied, and they have different IPs from what I see in the diagram. So I don't see the issue there.
