Please Help - OpenVPN Site-to-Site and Remote Access Setup – One Client, Two Servers (Asus RT-AC68U, Merlin 386.14_2)

[bartasmosina]

Hello,


I have two Asus RT-AC68U routers running Merlin 386.14_2, and I would like to set up a VPN connection between them to meet two goals:

Configuration:​

• Router A (mine):
  
  • Model: Asus RT-AC68U
  • LAN: 192.168.2.0/24
  • DDNS: my-domain.ddns.net
• Router B (friend's):
  
  • Model: Asus RT-AC68U
  • LAN: 192.168.3.0/24
  • DDNS: friend-domain.ddns.net

Goal:​

1. Both routers should work as OpenVPN servers to allow remote connections (PCs, laptops, phones) from any location – both to Router A and Router B.
2. Additionally, Router A should act as a permanent OpenVPN client, connecting to Router B to create a permanent site-to-site connection.
3. We need full two-way LAN↔LAN access, meaning:
   
   • When I'm at home, I want to have access to my network 192.168.2.x and my friend's network 192.168.3.x.
   • My friend, when at home, should have access to their network 192.168.3.x and my network 192.168.2.x.
4. After connecting remotely via VPN (to either router), we want to have access to both local networks.

Currently, we have a "cross" connection where both routers connect as clients to each other, but this is not very flexible. We want to simplify it to one direction (A as client → B as server) and properly configured servers on both ends to handle remote clients.

Screenshots:​

I could post screenshots of the server settings, but many options change dynamically depending on the selected function, so not everything is visible at once. However, I can share these if needed. There might be others who have experience with this exact setup (or similar routers) which could help guide me toward a solution.

Background:​

I have been trying various configurations for the last two days, but I haven’t been able to achieve the desired result. Step-by-step guidance on what to configure on each router would be very helpful. If anyone has this setup running, it would be great if you could share screenshots with your private information blurred out.

Questions:​

• How should I configure routing and push route to ensure devices on both networks can see each other?
• Are additional iptables rules necessary?
• How can I ensure that remote OpenVPN clients (phones/PCs) will have access to both networks regardless of which router they connect to?

Thanks in advance for any insights and advice!