Asus RT-AC88U OpenVPN: openVPN Subnet and assigning IP to openVPN clients?

[PartisanEntity]

I have stock firmware version: 3.0.0.4.386_48260-gd4c241c

I have configured and enabled an openVPN server on the router.

At the moment in the openVPN configuration under VPN Subnet / Netmask I have: 10.8.0.0/255.255.255.0

Now in the router under LAN > IP Adress (not in openVPN settings) I have: 192.168.1.1 and under Subnet Mask I have: 255.255.255.0

Question 1:

Can I put the openVPN Subnet on the same Subnet as my LAN? Any drawbacks to doing so and is it even possible?

Question 2:

Is it possible to bind a specific IP in openVPN to a specific openVPN client? And if yes, how?

The reason for question 2 is because I have a server at home that is sharing some files over NFS and Samba and I have certain folders that can only be accessed by a specific local IP address.

When I connect to my openVPN server from the office, since my IP number is for example: 10.8.0.6 I am unable to connect to the folders. But if I am going to add IP numbers from the openVPN Subnet then I want them to be fixed for each openVPN client so I don't have to edit configurations all the time.

 

[Gary_Dexter]

No you can’t use the same subnet as your LAN

 

[eibgrad]

1) You could (assuming the stock firmware supports it) create a bridged (TAP) OpenVPN tunnel rather than a routed (TUN) tunnel. That would allow the OpenVPN client to be assigned an IP on the remote network, just as if that same client was wired to the home router's switch. You could even create static leases based on the MAC address of the client's virtual adapter.

However, the problem w/ bridged tunnels is that most mobile devices don't support it. Not unless you're willing to use untrusted sources and apps, or jailbreak it (as the case may be). But it is the closest thing to "being there" when it comes to using OpenVPN.

2) This was discussed recently on the DD-WRT forums. Regardless of firmware, the various solutions are the same, although using stock firmware will probably make it more difficult, if not impossible, to implement in some cases.

 

[RMerlin]

Client specific IP should be possible with Asuswrt-Merlin, not sure about stock firmware however. Can be done by enabling Client-specific Options, then look the OpenVPN documentation on how to use CCD.

 

[PartisanEntity]

Thank you all for the responses.

 

[PartisanEntity]

Client specific IP should be possible with Asuswrt-Merlin, not sure about stock firmware however. Can be done by enabling Client-specific Options, then look the OpenVPN documentation on how to use CCD.

Is it possible to switch to Asuswrt-Merlin while keeping all my current settings from the stock firmware? Just wondering how much work it would be to switch.

 

[RMerlin]

Is it possible to switch to Asuswrt-Merlin while keeping all my current settings from the stock firmware? Just wondering how much work it would be to switch.

Yes provided the firmware releases aren't too far apart, however anything related to VPN will need to be reconfigured, since we have different implementations.