iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
To connect a private LAN to a VPS, run OpenVPN as a server on the internet-reachable VPS and as a routed client on an always-on router or Linux host inside the LAN. Use three non-overlapping networks, advertise the LAN route to OpenVPN, install return routes on the LAN and VPS-side gateways, and allow forwarding through both firewalls. NAT is a workable shortcut when only LAN-initiated traffic is required; use routed forwarding when hosts on both sides must initiate connections.
What a site-to-site OpenVPN tunnel actually does
A site-to-site deployment joins two IP networks rather than connecting one user’s laptop. The VPS is the OpenVPN server because it has a public IP address or a DNS name reachable from the internet. A router or always-on Linux machine at the branch, home, or office runs the OpenVPN client and forwards packets between its physical LAN interface and the tunnel interface.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe tunnel creates a third, virtual network. A packet from a host on the VPS-side network is routed to the OpenVPN server, encrypted across the internet, delivered to the connector, and then forwarded to the destination host on the LAN. Replies must follow the reverse path. A successful TLS handshake or a ping to the VPN endpoint proves only that the tunnel exists; it does not prove that either LAN can reach the other.
The example in this guide uses these illustrative networks:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
| Segment | Example network | Purpose |
|---|---|---|
| Branch LAN behind the connector | 10.0.60.0/24 | Private hosts at the home or branch site |
| VPS-side or headquarters LAN | 192.168.70.0/24 | Private resources reachable through the VPS site |
| OpenVPN virtual network | 172.16.0.0/20 | Addresses assigned to the tunnel endpoints |
These values come from an Access Server site-to-site example and are not defaults to copy blindly. The OpenVPN Community sample instead starts with a routed TUN interface, UDP port 1194, and a 10.8.0.0/24 virtual pool. Substitute ranges that are unused in your environment.
Plan the networks before installing anything
Reject overlapping address ranges
The branch LAN, any VPS-side LAN, and the VPN virtual network must all be distinct. If both sites use 192.168.1.0/24, a router cannot tell whether 192.168.1.25 is local or remote, so it will choose an ambiguous route and the tunnel will appear unreliable or unusable. Check every VLAN and any networks that might later be added through the tunnel.
Record gateways and interfaces
- Write down the branch LAN CIDR and its normal gateway address.
- Record the connector’s LAN address and the name of its LAN interface, such as
eth0. - Record the VPS public address or DNS name, the VPS tunnel interface, and any private interface connected to a headquarters network.
- Choose a VPN pool that is not used by either site. The Community sample’s 10.8.0.0/24 and the Access Server example’s 172.16.0.0/20 are merely starting patterns.
Decide which hosts should be reachable
You may route an entire branch subnet, only selected VLANs, or a narrow set of service addresses. Define that scope before writing routes and firewall rules. A broad route is easier to operate but increases the number of systems exposed to the other site.
Prepare the VPS OpenVPN server
Install the server and expose the listener
Install OpenVPN Community or Access Server on the VPS. Give the VPS a stable public IP address or DNS name. Permit the selected protocol and port in all layers: the VPS operating-system firewall, the provider’s security group, and any upstream firewall. The Community sample uses UDP 1194. TCP can be used when UDP is not practical, but the client and server protocol settings must match.
Keep the VPS operating-system updates current and restrict administrative access separately from the VPN listener. Do not expose an administrative interface to the entire internet just because UDP 1194 is open.
Use a routed TUN design for normal site-to-site IP traffic
A TUN interface carries layer-3 IP packets and is the usual choice for connecting different subnets. TAP carries layer-2 Ethernet frames and is appropriate only when you have a specific bridging requirement; it adds broadcast traffic and a larger failure surface. Whatever you choose, the server and every client must use the same dev and proto settings.
Recommended Free Tools
Community configuration pattern
Directive names and defaults can change between OpenVPN releases, so validate this pattern against the documentation installed with your version. A minimal routed server configuration has the following roles:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0
client-config-dir /etc/openvpn/ccd
route 10.0.60.0 255.255.255.0The server line allocates tunnel addresses. The route line tells the server that the branch subnet is reachable through an OpenVPN client. In a per-client configuration file named for the branch certificate’s common name, add the corresponding internal route:
iroute 10.0.60.0 255.255.255.0The global route and the client-specific iroute serve different purposes: the former places the destination in the server’s operating-system routing view, while the latter associates that destination with the correct client session. Use one unique client identity for this connector.
Access Server workflow
Access Server uses its administrative interface rather than a hand-written Community configuration. Create the site-to-site client and enable routing for the private subnet owned by that client. Enter the VPS-side or headquarters subnet as a remote network where the product asks which private networks should be reachable. The exact labels and menu locations vary by release; verify them in the version-specific interface. The official example uses HQ 192.168.70.0/24, VPN 172.16.0.0/20, and branch 10.0.60.0/24.
Create certificates and the client profile
Issue a distinct identity for every connector
Use one certificate authority for the deployment and create a unique certificate and private key for each site-to-site client. Do not copy one client profile to several routers. Duplicate credentials make revocation difficult and can cause connection instability when the server treats simultaneous uses as the same client.
Protect private keys with file permissions appropriate to the OpenVPN service account. Store a recovery copy in an encrypted location, but do not place keys in a shared ticket, public repository, or ordinary email.
Match the endpoint and transport settings
A typical client profile contains the following essential values; add the certificate, key, and CA material required by your deployment:
client
dev tun
proto udp
remote vpn.example.net 1194
Replace vpn.example.net with the VPS address or DNS name. The server’s dev and proto values must match. If the branch connector must reach a headquarters network at 192.168.70.0/24, the client needs a route for that network, either pushed by the server or declared locally according to your design.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
route 192.168.70.0 255.255.255.0Do not add a route for the connector’s own LAN as though it were remote; that subnet is already connected to the connector’s physical interface.
Turn the LAN device into a router
Use an always-on connector with two forwarding domains
The connector needs one interface on the branch LAN and a tun interface created by OpenVPN. A consumer router, firewall appliance, or Linux host can fill this role. It must remain powered on, have a stable LAN address, and be able to reach the VPS over the ordinary internet gateway before the VPN starts.
Enable IP forwarding
On Linux, enable IPv4 forwarding using the distribution’s persistent network configuration. A temporary test setting is:
sudo sysctl -w net.ipv4.ip_forward=1Persist the setting through your operating system’s normal sysctl configuration so a reboot does not silently break the site-to-site path. IPv6 requires separate forwarding and firewall policy; do not assume an IPv4 tunnel carries IPv6 traffic.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install the return route on the connector
The connector must know that the VPS-side network belongs behind the VPN. In the example, its route for 192.168.70.0/24 points to the tunnel interface. OpenVPN can install this route from a pushed route, or you can define it in the client profile or operating-system routing configuration. Confirm the resulting route with the platform’s routing-table command.
Advertise the branch LAN to OpenVPN
The server needs an explicit association between 10.0.60.0/24 and the branch connector. In Community configurations, place route 10.0.60.0 255.255.255.0 in the server configuration and the matching iroute in that client’s configuration-directory file. In Access Server, enable routing for the private subnet assigned to the site-to-site client.
Advertise only networks that the connector actually owns. If you later add a VLAN, add its route on the connector, its OpenVPN association, its gateway return route, and its firewall policy as one change.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Install return routes on both sites
Branch gateway route
Hosts on the branch normally send non-local traffic to the branch gateway, not directly to the VPN connector. Add a static route on that gateway for the VPN pool and every VPS-side network, using the connector’s LAN address as next hop. With a connector at 10.0.60.2 and a branch gateway at 10.0.60.1, the conceptual routes are:
172.16.0.0/20 via 10.0.60.2(or the Community pool10.8.0.0/24).192.168.70.0/24 via 10.0.60.2.
Use your gateway’s actual static-route interface; the notation above describes the destination and next hop, not a universal command.
VPS-side gateway route
If the VPS itself is the gateway for 192.168.70.0/24, it can forward directly to the tunnel. If another router owns that network, add routes there for the branch subnet and, where needed, the VPN pool, pointing to the VPS private address. Without this return path, a packet can arrive at a branch host while the reply exits through the ordinary headquarters gateway.
Choose routed forwarding or NAT
| Decision point | Routed forwarding | NAT on the connector |
|---|---|---|
| Connections initiated from the VPS-side network to branch hosts | Supported when return routes and firewall rules are correct | Generally not available as direct host-to-host initiation unless additional mappings are created |
| Source address visible to the destination | Original host address remains visible | Destination sees the connector’s translated address |
| Static routes | Required on gateways that are not already aware of the tunnel | Can avoid changing an upstream branch gateway for outbound sessions |
| Policy and troubleshooting | More observable and easier to control per subnet or host | Simpler initially, but logs and access policies lose the original source identity |
| Best fit | Two-way applications, monitoring, file services, and administration | Branch clients reaching a few remote services when gateway changes are impossible |
When NAT is appropriate
NAT is a pragmatic choice when branch clients only need to initiate connections and you cannot add a route to the branch gateway. The connector translates the branch source address as traffic enters the tunnel, so replies naturally return to the connector. The remote side cannot reliably initiate a new session to an individual branch host because that host’s original address is hidden.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A Linux connector might use a masquerade rule scoped to the branch and remote networks, for example:
sudo iptables -t nat -A POSTROUTING -s 10.0.60.0/24 -d 192.168.70.0/24 -o tun0 -j MASQUERADETreat this as an example, not a universal rule. Confirm the tunnel interface name, restrict the destination ranges, and implement the equivalent policy in your firewall system. NAT does not remove the need for forwarding permissions.
When routed forwarding is the right answer
Use routing when both sites must initiate connections, when security logs must show the real client address, or when applications depend on direct subnet reachability. It requires correct routes on every gateway along the path, but it avoids hidden addresses and makes firewall policy more precise.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Build firewall policy for the listener and the data path
Opening UDP 1194 (or your selected port) only permits the tunnel handshake. The operating-system and network firewalls must also permit forwarding between the VPN interface and the LAN interface in both directions required by your policy.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Allow the OpenVPN listener from the internet only on the chosen protocol and port.
- Allow established and related return traffic.
- Permit VPN-to-LAN forwarding for the specific branch networks and services required.
- Permit LAN-to-VPN forwarding for the remote networks and applications required.
- Block unrelated VPN-to-LAN traffic by default, especially administrative ports.
- If using NAT, permit forwarding before translation and keep the masquerade rule limited to the intended destinations.
Firewall syntax differs among Linux distributions, router platforms, and cloud security groups. Check counters or flow logs after each test; a rule that exists but never increments is often attached to the wrong interface or direction.
Validate the tunnel in layers
- Confirm the process. Check that the OpenVPN service is running and that its log reports a completed connection rather than repeated reconnects.
- Check tunnel addresses. Verify that the server and connector have addresses from the selected VPN pool and that the TUN interface is up.
- Inspect routes. On the server, confirm the branch route points to the correct client. On the connector, confirm the VPS-side route points to the TUN interface. On both site gateways, confirm return routes.
- Test the connector itself. From the VPS side, reach the connector’s tunnel address; from the connector, reach a VPS-side tunnel or gateway address.
- Test the connector’s LAN address. This separates a tunnel problem from a forwarding or LAN-gateway problem.
- Test a second LAN host. Use a host that permits the protocol you are testing. A host firewall may reject ping even when TCP access works.
- Test the application port. Use the actual service port, then inspect both endpoint logs and firewall counters if it fails.
Record the source address seen by the destination. A routed design should show the original branch host; a NAT design should show the translated connector address.
Troubleshoot the failures that appear most often
| Symptom | Likely cause | What to check |
|---|---|---|
| Client never connects | Unreachable endpoint, blocked listener, or protocol mismatch | DNS/public address, provider security group, UDP/TCP choice, port, and matching dev/proto settings |
| Tunnel is up but branch hosts are unreachable | Missing server route, client iroute, connector forwarding, or LAN firewall rule |
Routing tables, OpenVPN client association, IP forwarding, and FORWARD counters |
| One-way connectivity | Missing return route on a LAN or VPS-side gateway | Trace the reply path and add a route through the connector or VPS private address |
| Only outbound branch sessions work | NAT is hiding branch addresses | Choose routed forwarding and install return routes if remote-initiated sessions are required |
| Intermittent or duplicate clients | Several connectors sharing one certificate and key | Issue a unique certificate/key pair and revoke the shared identity |
| Some networks work, others do not | Route or firewall policy covers only part of the intended scope | Compare every VLAN’s route, OpenVPN association, gateway return route, and interface policy |
Overlapping subnets cannot be repaired with a firewall rule
If the branch and VPS-side LAN use the same range, renumber one side or redesign with translation. Adding more routes to an overlapping topology does not remove the ambiguity and usually creates asymmetric behavior.
A handshake is not proof of end-to-end access
OpenVPN can authenticate and encrypt traffic while the host firewall drops forwarded packets. Always test a real host behind each connector and inspect the route in both directions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Operate the connection safely
- Keep certificate and private-key files readable only by the OpenVPN service account.
- Revoke a connector’s certificate when the device is retired, lost, or replaced.
- Document each subnet, next hop, VPN identity, and firewall rule so a replacement connector can be built without guesswork.
- Monitor tunnel restarts, route changes, and rejected forwarding attempts.
- Limit the remote networks pushed to clients; do not advertise an entire corporate address space when only one service is needed.
- Review OpenVPN release notes and the configuration reference after upgrades. Directive behavior and defaults can change, and Access Server interface labels are version-dependent.
The durable design is therefore straightforward: distinct address spaces, a public VPS server, a uniquely identified LAN connector, explicit routes in both directions, and firewall rules that allow only the intended traffic. Select NAT only when its one-way behavior and loss of source-address visibility are acceptable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
