View original (French)

Access equipment via a vpn

Alain0522 Posted messages 43 Registration date   Status Member Last intervention   -  
Alain0522 Posted messages 43 Registration date   Status Member Last intervention   -

Hello, I'm reaching out to you because I want to access a device from outside. I would like to set up a VPN connection with Wireguard. I should mention that I have a simple box that does not offer any built-in VPN service. I only have two laptops running Windows on which the Wireguard software is installed. One laptop will be used from outside, while the other remains inside the local network. The laptop within the local network is a standard workstation used for everyday routine operations (internet browsing, office work...). The device I want to access has a different IP address on my local network and is accessible via a web page (it’s an administration page for the device). I know how to set up the VPN connection between PC 1 and PC 2. What I can't do is how to access the administration interface of the device in question. Can you help me? Best regards

7 answers

  1.
    avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511
     

    Hello,

    This is simply a matter of routing; you need to ensure that the routing table of the VPN client (the laptop you're taking outside) routes the target IP through the VPN server.

    I assume that:

    • you are using the VPN "properly," that is, in "split tunnel" mode (selective routing).
      ---
    • PC 1 is the one that stays at your place
    • The local network on the PC 1 side is 192.168.1.0/24 with 192.168.1.1 as the gateway
    • PC 1 takes the IP 192.168.1.2 within its local network
      ---
    • PC 2 is the one you take outside
    • The local network on the PC 2 side is 192.168.0.0/24 with 192.168.0.1 as the gateway
    • PC 2 takes the IP 192.168.0.2 within its local network
      ---
    • The VPN IP range is 10.8.0.0/24
    • PC 1 takes the IP 10.8.0.1 within the VPN
    • PC 2 takes the IP 10.8.0.2 within the VPN

    That's a lot of assumptions, but without more information from you...

    In split tunnel, PC 2 (outside) probably already has its routing table set up as follows:

    • 192.168.0.0/24 via its physical network interface
    • 10.8.0.0/24 via the virtual network interface
    • default via 192.168.1.1

    All you need to do is add a route:

    • 192.168.1.0/24 via 10.8.0.1

    On the PC 1 side (at your place), you need to allow packet forwarding from the virtual interface to the physical interface and vice versa.

    Then, I assume that the 10.8.0.0/24 network is unknown at the gateway 192.168.1.1.

    Clean solution: add a static route "10.8.0.0/24 via 192.168.1.2" on the gateway 192.168.1.1.
    Solution to avoid: enable masquerading on PC 1 so that all outgoing traffic via the physical interface appears to come from 192.168.1.2.

    I made an assumption that is not always true: the local networks on the PC 1 and PC 2 sides are not the same. If you are in a case where both local networks overlap their IP ranges, you'll need to fiddle a bit more.

    2
  2. Alain0522 Posted messages 43 Registration date   Status Member Last intervention   1
     

    Hello,

    @avion-f16 StatusContributor: Does your 2) correspond to the step I performed by saying: "I completed the port forwarding on the administration interface of the box."?

    Indeed, in the administration interface of my box > network v4 > NAT, I had performed the following forwarding:

    external_port | UDP | PC_int's IP address | internal port (wireguard PC_int is configured to listen on this port)

    However, this morning, for a reason I don't know, it "worked". Perhaps by restarting wireguard, some blocked settings were taken into account.

    Note that I successfully accessed the administration interface of my device at address 192.168.1.20.

    On the other hand, I cannot access the administration interface of the box (192.168.1.1). Perhaps this relates to what @brucine StatusMember wrote a bit earlier in this post?

    How does the box know I'm coming from outside, since I'm going through a VPN and landing inside the network?

    Best regards

    1
    1. brucine Posted messages 24834 Registration date   Status Member Last intervention   4 166
       

      Hello,

      Access to the local network administration page is activated or not depending on the models on this page for the local network.

      For example, see here a discussion about this regarding SFR boxes: they are coded to not accept a connection from an IP address that is not in the local network (which of course does not include remote control from one of the local network stations from which you can do whatever you want).

      I don't know to what extent a VPN can "fool the enemy" by masquerading as a local address; I also assume that, under certain circumstances, the operator's maintenance can take control of this page, I don't know, and if so, I don't know by what means.

      https://la-communaute.sfr.fr/t5/installation-et-param%C3%A9trage/acc%C3%A8s-au-param%C3%A9trage-de-la-box-par-le-198-168-1-1/td-p/2352442

      0
  3. madmyke Posted messages 52304 Registration date   Status Moderator Last intervention   12 485
     

    Hello
    A VPN establishes an encrypted connection between point A and point B. The VPN does nothing more.

    If you want to access the device management page on your LAN through the VPN, which is already done, I think the simplest way is to control machine B at home remotely from PC A, and from there you can do exactly what you want, launch the browser on B, etc., while keeping the "secure" part.

    Best regards

    0
  4. Alain0522 Posted messages 43 Registration date   Status Member Last intervention   1
     

    Hello everyone, and thank you for your feedback.

    Please excuse my delayed response, I couldn't revisit this issue until this weekend.

     you are using the VPN "properly", that is, in "split tunnel" (selective routing).

    I'm sorry, I don't know what "selective routing" or "split tunnel" is. I'm rather new to this.

    First, here is a bit more information about my goal:

    The PC that will be outside will be in "roaming" mode, I will be using my smartphone as a modem. It will therefore not be behind a router.

    My goal:

    • to connect to the administration interface of the equipment in question which is on a fixed IP (192.168.1.20);
    • to access the administration interface of my router (192.168.1.1).

    This weekend, I installed WireGuard on both PCs, so:

    PC_ext:

    IP in the VPN tunnel: 10.0.0.10

    PC_int:

    IP in the local network: 192.168.1.30

    IP in the VPN tunnel: 10.0.0.20

    I have performed port forwarding on the administration interface of the router.

    Finally, I followed this tutorial to enable IP routing on PC_int (Windows 10):

    Easy Ways to Enable IP Routing on Windows 10: 5 Steps (wikihow.com)

    After setting this up, I conducted a test: it turns out that communication seems to have been established since WireGuard on PC_int has found the IP address of my smartphone, even though it hadn't been explicitly provided (which makes sense). Additionally, packets are sent and received on each of the PCs (PC_int and PC_ext). I can see this as there is a line in the WireGuard software interface that shows this information live.

    However, when I enter the IP address 192.168.1.20 (of the equipment) or that of my router in the browser of PC_ext, I get an error message stating that it was unable to find the page.

    That's where I'm stuck.

    Best regards

    0
    1. brucine Posted messages 24834 Registration date   Status Member Last intervention   4 166
       

      Hello,

      Please note that some Boxes prohibit access to their administration page from outside for security reasons.

      -1
    2. avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511
       

      Hello,

      I indeed forgot a step:

      The packets sent from IP_ext to 192.168.1.20 through the Wireguard tunnel take 10.0.0.10 as the source IP...

      As a result, 192.168.1.20 will try to respond to 10.0.0.10 but it doesn't know a route to this IP, nor does its gateway.

      Two solutions (choose one or the other):

      1) Add a static route on the box to route 10.0.0.0/24 via 192.168.1.30

      2) Enable NAT (masquerading) so that all outgoing traffic from PC_int to the local network (including 192.168.1.20) takes 192.168.1.30 as the source. The reverse path then becomes possible.

      1
  6. Alain0522 Posted messages 43 Registration date   Status Member Last intervention   1
     

    Hello,

    @avion-f16 StatusContributor: Does your 2) correspond to the step I took by saying: "I performed the port forwarding on the administration interface of the box."?

    Indeed, in the administration interface of my box > network v4 > NAT, I had set up the following forwarding:

    external_port | UDP | PC_int IP address | internal port (wireguard PC_int is configured to listen on this port)

    However, this morning, for some reason I don’t know, it "came back" online. Perhaps by restarting wireguard, some blocked settings were taken into account.

    It is worth noting that I managed to access the administration interface of my device at the address 192.168.1.20.

    On the other hand, I was unable to access the administration interface of the box (192.168.1.1). Maybe this relates to what @brucine StatusMember wrote a bit earlier in this post?

    How does the box know that I am coming from the outside, since I am going through a VPN and landing inside the network?


    Best regards

    0
    1. avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511
       

      Hello,

      No, these are two different things.

      The port transfer/redirection configured on the box allows you to modify the destination of the packets sent to the public IP, to the local IP (this is DNAT).

      The NAT/masquerade I’m talking about concerns the traffic between the VPN network and the local network, with the PC_int computer acting as a router between these two networks.

      Even if it "worked" by chance, this NAT/masquerade rule that I omitted in my first message remains necessary (unless a static route is defined).

      If access to the device works from the PC_ext via the VPN, the administration of the box should also work; there’s no reason it shouldn’t, since the access is from the LAN of the box. The box doesn't know it's coming from the inside; surely the response doesn't reach the target because the source is unknown (as I mentioned in the previous reply). After creating this NAT/masquerade on the VPN server, there’s a good chance the box will be accessible via the VPN.

      0
  7. Alain0522 Posted messages 43 Registration date   Status Member Last intervention   1
     

    Good evening,

    Okay, I wasn't there at all.

    I can confirm that with a static route, it doesn't work either.

    As for NAT/masquerade, this is the first time I've heard of this thing.

    After some research, from what I understand, it allows multiple devices to communicate under a single IP address, similar to what a router does (our devices go online with the IP address of the router).

    I've read quite a bit of documentation on it. I can't grasp where to make the configuration. On some sites, they do it in the OS, others in the firewall.

    Is it in the WireGuard configuration file?

    Do you have a tutorial?

    Regards

    0
    1. avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511
       

      Hello, it's on the machine that serves as the VPN server that this needs to be configured. This machine also acts as a router between the LAN (physical) network and the virtual network (VPN). The goal is to make your LAN believe that traffic coming from VPN clients is coming from the VPN server.

      Wireguard creates a virtual interface for the VPN network, but the routing and firewall are still managed by the OS. The NAT configuration is done exactly as if you had a router with two physical network interfaces. Therefore, you need to apply a NAT (masquerade) rule on the outgoing traffic through the physical interface.

      0
  8. Alain0522 Posted messages 43 Registration date   Status Member Last intervention   1
     

    Hello,

    Thank you for your reply. I will take a look at that.

    I have the impression that under Windows it's not called NAT / "masquerade"

    I will keep you updated.

    Thanks again

    0