Openvpn – How to connect remotely to our network from behind a double NAT

ddnsnat;openvpnport-forwardingrdp

Having successfully set up my home office network for remote access via OpenVPN, I would now like to do the same thing at work, however I am double natted.

There is a central router maintained by the company that run our building, with Ethernet cables in each office. We have then connected our DD-WRT router, but obviously we only have a 192. Private ip address.

Our router has an OpenVPN server built in. To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router? Or is it potentially more complicated than that?

Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router and then forwarding the same port on our router to the ip address of the pc we want to remotely control on our subnet?

Finally, is ddns going to be a challenge with this setup? Or should it work as expected providing we use their public ip address and relevant ports, ie 1194 or 3389?

Cheers
Rich

Best Answer

To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router?

Yes.*

Or is it potentially more complicated than that?

No.*

Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router and then forwarding the same port on our router to the ip address of the pc we want to remotely control on our subnet?

It's safer to access RDP server through VPN. Don't leave any other doors to your network, it will work if your ISP'd forward that port too.

Finally, is ddns going to be a challenge with this setup?

It depends if your ISP uses static or dynamic public address, if it's static, then you use address provided by your ISP. It can be simply your outside NAT address as well, you can check it for instance here. If dynamic, then there are some options too.

*assuming that your ISP does simple (P)NAT.