Return to Revisions

Having a remote OpenVPN server at your home and connect to it with the RasPi is a good solution if you cannot use port forwarding on the modem. Here is an example setup for what you have described:

          (dhcp
        from RPi)        bridge      10.8.0.2/24               ┌──────────┐   10.8.0.1/24
           ╱    wifi    ┌───────┐       /       vpn-tunnel     │          │       \
mobile-phone <~.~.~.~.> │(wlan0)│   (tun0) ═════════╗ ╔══════════════════════════ VPN-SERVER
                        │    br0│RPi(ppp0) <-----> MODEM <---> │ INTERNET │
      laptop <────────> |(eth0) │╲      \    usb          wan  │          │
           ╲    wired   └───────┘╱     (dhcp                   └──────────┘
         (dhcp           192.168.4.1   from MODEM)
        from RPi)

The ip addresses from the endpoints of the vpn tunnel must be on the same subnet. Here I use the subnet 10.8.0.0/24, so I give the vpn tunnel the shown ip addresses. These addresses are only used for routing to the vpn tunnel. They are not used by any other interface.

You should setup the VPN router in three steps so you can test each step independently.

1. Setup the modem connection so you get the ppp0 interface and you can ping google.com.

2. Setup the bridge and the internet connection as shown in How can I set my pi 3 up to be WiFi AND ethernet router simultaneously?. In that setup just replace all strings *usb0* with *ppp0*. I don't have a 4G modem so I used USB tethering with my smartphone to test it. Also replace ip address 192.168.4.1 just with that you want to use, e.g. with 192.168.50.1 but have an attention it isn't from the ip range that is used by the modem. When finished then you should have a running setup as shown in the drawing above but just without the vpn tunnel. You should be able to ping everything from everywhere now.

3. Setup your VPN connection. I have used this Simple openVPN with static keys setup to test the configuration. You should be able to ping your remote VPN server with e.g. ping 10.8.0.1.

Now it's all together. All hosts on the local network should be able to get into the internet and connect to the remote VPN server. There is only one issue with routing on the VPN server. It will receive ip packets with source address from subnet 192.168.4.0/24 and it doesn't know where to send back the responses. So we have to set a static route on it. If it is a Linux host then the routing entry looks like this:

vpnserver ~$ sudo ip route add 192.168.4.0/24 via 10.8.0.2 dev tun0 proto static src 10.8.0.1