Routing the client's local network to the VPN network witch change of addressing

Installing and Using OpenWrt Network and Wireless Configuration
1

Hey,

I am in the process of configuring the my virtual network. At the moment, clients and the server see each other. Here are my assumptions:

20.0.0.1       Server (Linux)
20.0.0.10-254  Static single clients
20.0.1.1-254   DHCP clients
20.1.X.X       Local network 192.168.0.1 in place 1
20.2.X.X       Local network 192.168.0.1 in place 2
20.3.X.X       Local network 192.168.0.1 in place 3

In the server configuration (20.0.0.1) I have, among others, such entries:

dev tun
topology subnet
ifconfig 20.0.0.1 255.0.0.0
client-config-dir /path/to/dir
push "route 20.0.0.0 255.255.255.0"
push "route 20.0.1.0 255.255.255.0"
push "route 20.1.0.0 255.255.0.0"
push "route 20.2.0.0 255.255.0.0"
push "route 20.3.0.0 255.255.0.0"

client-config-dir for place 1

ifconfig-push 20.1.0.1 255.252.0.0
iroute 20.1.0.0 255.255.0.0

client-config-dir for place 2

ifconfig-push 20.2.0.1 255.252.0.0
iroute 20.2.0.0 255.255.0.0

client-config-dir for place 3

ifconfig-push 20.3.0.1 255.252.0.0
iroute 20.3.0.0 255.255.0.0

On the example of place 2 (20.2.0.1) I have the following local network:

192.168.0.1  TL-MR3420 with OpenWRT as client VPN Server
192.168.0.11 Client 1
192.168.0.12 Client 2
192.168.0.13 Client 3

I would like each of the three 192.168.X.X local networks to be visible in the tunnel at 20.NR_PLACE.X.X

For example:

Place 1 - Client 1 - 192.168.0.11 as 20.1.0.11
Place 1 - Client 2 - 192.168.0.12 as 20.1.0.12
Place 2 - Client 1 - 192.168.0.11 as 20.2.0.11
Place 2 - Client 2 - 192.168.0.12 as 20.2.0.12
Place 3 - Client 1 - 192.168.0.11 as 20.3.0.11
Place 3 - Client 2 - 192.168.0.12 as 20.3.0.12

It seems to me that I should perform address routing on every VPN client in these three places.

How can I solve my problem?

2

You must not use public IP-range for private networking.

Why do you need that?
If there's no strong reason, you'd better forget it, because the result is not worth the effort.

Of course, it's not impossible:

However it's still better to separate those local networks and utilize plain routing.

3

Addressing 20.X.X.X will be changed to 10.X.X.X in the final mode.

I need this because in these three places I intend to provide servers and other network devices. Although I can install another client on the server, it would be difficult to install a vpn client on eg. IP camera or network switch with official software. I understand that this configuration should be done on the router in these three places?

4

If you mean NETMAP, logically it should be used on the way of transit traffic and shouldn't contradict the routing, so remote VPN-client looks like the right place.

5

My changed assumptions of this network:

20.0.0.1        Server (Linux)
20.0.0.100-199  Static single clients
20.0.0.20X      Static router address of the selected place
20.0.1.X        DHCP clients
20.1.X.X        Local network 192.168.0.1 in place 1
20.2.X.X        Local network 192.168.0.1 in place 2
Further network later...

Place 1 - Local server network (no connection to VPN):

192.168.0.1 - to 20.0.0.201
192.168.0.0/16 - to 20.1.0.0/16

Place 2:

ifconfig-push 20.0.0.202 255.0.0.0 
iroute 20.2.0.0 255.255.0.0

Place 1 (Linux Server 192.168.0.10)

iptables -t nat -A PREROUTING -d 20.1.0.0/16 -i tun0 -j NETMAP --to 192.168.0.0/16

Place 2 (Router OpenWRT 192.168.0.1)

iptables -t nat -A PREROUTING -d 20.2.0.0/16 -i tun0 -j NETMAP --to 192.168.0.0/16

Current problems:

  • Nobody sees the local server network (20.1.X.X)
  • Place 1 (from the server 20.0.0.1) does not see its 20.1.X.X
  • Place 1 (from the server 20.0.0.1) does not see windows 20.2.X.X machines (android and linux only)
  • Place 2 (20.2.X.X) does not see its own network (the router itself and clients of the local network)

What am I doing wrong?

6

The level of complexity of your network requires comprehensive troubleshooting.
So you should study appropriate instruments, such as traceroute, tcpdump and iptables.
Then collect diagnostics data on the way of your traffic and based on that make a conclusion where the problem is.