OpenVPN without win firewall modification

[Rooby]

Helllo,

I have two RT-AC66U router configured for OpenVPN.
One is configured as server and the other one for client.
Everything works well but I have no connection between both LANs behind without modifying or disabling the windows firewall on both PC connected to the routers.

IP range config is:
LAN Server 192.168.1.0/24
LAN Client: 192.168.2.0/24
OpenVPN: 10.0.1.0/24

When I disable the windows firewall on the PCs behind the server and client LAN then I can access the shared drives, remotec ontrol the PC etc.
But I do not want to modify the firewalls.
Is it possible via iptables configuration in both routers for SNAT or masquerade to overcome this issue?
I have tried different configs but I anly could get a ping but not shared drives or remote desktop.
Has anyone such a config or any ideas?

Thanks

 

[RMerlin]

Make sure you do have "Create NAT on Tunnel" enabled on the OpenVPN client webui.

 

[wiz]

then you still have to alter the windows firewall as the tunnel net address differs from the lan address( 10.0.1.0/24 versus 192.168.2.0/24).

Only thing you can do is configure your vpn with a tap interface so if you connect with the vpn server your tunnel endpoint is in the lan address space, then you don't have to alter the windows firewall, if you trust local traffic that is...

 

[Rooby]

OK, but is it not possible to do somehow a NAT to the local LAN IP range that the firewall will accept it?

Make sure you do have "Create NAT on Tunnel" enabled on the OpenVPN client webui.

Yes it is enabled.

 

[Rooby]

Has someone any idea ?
Unfortunately the win 7 firewall does not allow to export/import a single rule.
So I have to manually add an entry on each PC to get a OpenVPN connection between the PCs behind the two routers on their subnets.
But I still want to use a TUN device.

 

[wiz]

there's no way you will be able to use a tun interface and have it have its entpoint in the lan network. In order to do so you need to use the tap interface.

 

[Rooby]

But I still have the hope to do somehow a NAT on the router to he local subnet and hide the real source address.
I guess the firewall will allow it if the source adress is in the same subnet.