Free tools Windows power users keep installed
One-click scans. No signup required.
Use the VPS as an internet-reachable OpenVPN server and run an OpenVPN client on an always-on router or Linux host inside your LAN. Build the tunnel as a routed TUN network, give every network a different address range, advertise the LAN route on the server, install return routes on the LAN and VPS gateways, and allow forwarding in both firewalls. A connected tunnel is only the transport; routing and return paths are what let hosts on each side communicate.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
What a site-to-site OpenVPN tunnel actually connects
A site-to-site deployment joins two networks, not just two computers. The VPS runs the OpenVPN server and has a public IP address or DNS name. A router or always-on Linux machine in your home or office LAN runs the OpenVPN client and forwards traffic between its physical LAN interface and the VPN interface. Hosts behind that connector can then reach networks attached to the VPS, provided both directions have routes.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIn a routed design, OpenVPN creates a separate virtual network on a TUN interface. The LAN, any VPS-side private network, and the VPN network must all be distinct. For example, the OpenVPN Access Server site-to-site tutorial illustrates an HQ network of 192.168.70.0/24, a VPN network of 172.16.0.0/20, and a branch LAN of 10.0.60.0/24. The OpenVPN community sample instead starts with UDP port 1194 and a VPN pool of 10.8.0.0/24. These are starting examples, not values to copy without checking your own network.
The packet path must work in both directions:
- A LAN host sends a packet to a remote or VPS-side subnet. Its LAN gateway forwards the packet to the OpenVPN connector.
- The connector sends it through the TUN interface to the VPS.
- The VPS forwards it to the destination network.
- The destination’s gateway has a route back to the LAN subnet through the VPS or OpenVPN server.
If the tunnel handshake succeeds but a second LAN host cannot be reached, the missing piece is usually a route, a forwarding rule, or a firewall policy—not the cryptographic tunnel itself.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the three networks before changing configuration
Write down the exact CIDR ranges and gateways. Reject any plan in which two ranges overlap; overlapping routes are ambiguous and the official site-to-site guidance treats non-overlapping subnets as a prerequisite.
| Network | Illustrative range | Purpose |
|---|---|---|
| Branch LAN behind the connector | 10.0.60.0/24 |
Home or office hosts reached through the site-to-site client |
| VPS-side or headquarters LAN | 192.168.70.0/24 |
Private network attached to the VPS side, when one exists |
| OpenVPN virtual network | 172.16.0.0/20 or 10.8.0.0/24 |
Addresses assigned to the TUN interface and VPN peers |
Replace every example with ranges that are unique across your installation. If a home router already uses 192.168.1.0/24, do not use that same range for the VPS-side network. Changing an established LAN range later is disruptive, so resolve conflicts during planning.
Recommended Free Tools
Decide between routed forwarding and NAT
Use full routing when both sides need to initiate connections, when logs must show the original client addresses, or when you need precise firewall policy between individual hosts. It requires return routes on the relevant gateways.
Use source NAT (masquerading) when the immediate requirement is one-way access from LAN clients to remote resources and you cannot change the remote gateway. The remote side then sees the connector’s translated address. Replies work because they follow the NAT state, but a remote host cannot normally open a new session directly to an individual LAN client.
| Decision point | Routed forwarding | NAT through the connector |
|---|---|---|
| Can a remote host initiate a new connection to a LAN host? | Yes, when the remote side has a route and firewalls permit it. | Generally no; translation hides the individual LAN addresses unless separate port forwarding is added. |
| Are original LAN source addresses visible remotely? | Yes. | No; the translated connector address is visible. |
| Are static routes required? | Yes, on LAN and VPS-side gateways that are not already aware of the VPN routes. | Fewer remote routes are needed, but the connector still needs routes for destinations reached through the tunnel. |
| Operational trade-off | More planning, but better observability and policy control. | Simpler deployment for outbound access, with reduced end-to-end reachability. |
| Firewall focus | Permit forwarding between TUN and the physical LAN interface in both directions. | Permit forwarding and the masquerade rule on the egress path; restrict unsolicited inbound traffic. |
Prerequisites on the VPS and LAN
- A VPS with a public IPv4 address or DNS name that the branch connector can reach.
- OpenVPN server software (Community edition or Access Server) installed on the VPS.
- A router or always-on Linux host with one interface on the branch LAN and another path to the OpenVPN TUN interface.
- Administrative access to the branch LAN’s upstream gateway and to any VPS-side private-network gateway.
- A certificate authority (CA), one unique client certificate and private key per connector, and server credentials.
- Firewall or cloud security-group permission for the selected OpenVPN protocol and port. The community sample uses UDP
1194; change it only when both ends agree. - Permission to enable IP forwarding on the connector and, where necessary, on the VPS.
Community OpenVPN and Access Server expose different configuration workflows. Community deployments use text configuration and per-client route directives; Access Server uses its administrative interface for routing and client profiles. Confirm directive names and defaults against the version installed on each endpoint because release behavior can change.
Step 1: Prepare the VPS OpenVPN endpoint
- Assign the VPS a stable public address or DNS name. The branch client profile will use this value in its
remotesetting. - Install and initialize OpenVPN or Access Server. Select a routed TUN topology unless you have a specific Layer-2 requirement; TUN is the normal choice for inter-network routing.
- Choose a dedicated VPN range, such as
10.8.0.0/24or172.16.0.0/20, after checking it against every LAN and private cloud range. - Allow the OpenVPN listener’s protocol and port through the VPS operating-system firewall and any upstream security group. For the community sample, that means UDP port
1194. - Enable IP forwarding on the VPS if it must route packets between the VPN and a private interface. On a Linux VPS this normally means enabling the IPv4 forwarding sysctl and making the setting persistent through the distribution’s network configuration.
Opening the listener is not enough. The VPS firewall must also allow forwarding between the TUN interface and the VPS-side private interface, with rules limited to the required source and destination ranges.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Step 2: Build the certificate and client profile
Use one CA for the deployment and issue a distinct certificate/key pair to every connector. Never copy one client identity to multiple routers: duplicate credentials make revocation and attribution unreliable and can cause connection conflicts.
The client profile must agree with the server on the transport and virtual-device settings. A minimal conceptual profile contains these values:
client
dev tun
proto udp
remote vpn.example.net 1194
nobind
persist-key
persist-tun
The remote hostname and port must be reachable from the branch. dev tun and proto udp are examples; if the server is configured for a different device or protocol, the client must match it. Add the CA certificate, the connector’s client certificate, and its private key using the format required by your OpenVPN version.
For production, protect private keys with filesystem permissions, store them only on the connector that uses them, and revoke a certificate when that connector is retired or compromised.
Step 3: Configure the LAN connector as a router
The connector is not merely a VPN endpoint. It must forward packets between the branch LAN interface and the TUN interface.
- Install the OpenVPN client and import the profile created for this connector.
- Enable IPv4 forwarding on the host. On Linux, enable the appropriate
net.ipv4.ip_forwardsysctl and persist it through the operating system’s normal configuration mechanism. - Allow forwarding in the host firewall from the LAN interface to the TUN interface and the return direction. Limit rules to the branch, VPN, and remote ranges where possible.
- Ensure the connector itself has a route to the VPS-side or remote subnet through the VPN. OpenVPN can install routes from the client profile, or you can add explicit routes using your platform’s network configuration.
- Keep the client process running at boot and configure automatic restart so a transient link failure does not leave the site disconnected.
Verify the connector’s LAN address and TUN address before testing another host. A connector that can reach the VPS proves only that the connector’s own routing works; it does not prove that the LAN gateway knows where to send other clients’ traffic.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Step 4: Advertise the branch LAN to the OpenVPN server
The server must know that the branch LAN belongs behind this particular client. Without that association, packets destined for 10.0.60.0/24 may be sent nowhere or to the wrong peer.
Community OpenVPN configuration
Use the server’s client-specific routing pattern: a server-side route for the branch subnet and a matching per-client iroute that identifies the certificate common name serving that subnet. The exact file locations and directive syntax depend on the installed release and whether a client-config directory is enabled, so verify them against the version’s configuration reference. The conceptual relationship is:
# server configuration concept
route 10.0.60.0 255.255.255.0
# client-specific configuration for the branch connector
iroute 10.0.60.0 255.255.255.0
The route makes the subnet reachable in the server’s operating-system table; the iroute associates that subnet with the correct OpenVPN client. Both pieces are needed in a typical routed site-to-site setup.
Access Server workflow
In Access Server, add the branch’s private subnet in the administrative routing settings and associate it with the site-to-site client or connector. The tutorial’s example uses HQ 192.168.70.0/24, VPN 172.16.0.0/20, and branch 10.0.60.0/24. Treat those values as a model for the relationships, not as defaults for your network. Download a fresh client profile after changing routing so the connector receives the current settings.
Step 5: Install return routes on the gateways
Every destination must know how to return traffic to the originating subnet. Add a static route on the branch LAN’s upstream gateway for the VPN range and any VPS-side range, using the connector’s LAN address as the next hop. If the VPS is not the gateway for its private network, add a route on that private-network gateway for the branch LAN through the VPS’s private address.
For the illustrative topology, a branch gateway might route 172.16.0.0/20 and 192.168.70.0/24 via the connector’s address on 10.0.60.0/24. The VPS-side gateway would route 10.0.60.0/24 via the VPS/OpenVPN server. Use your actual gateway and next-hop addresses; do not paste these examples unchanged.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
If you cannot add a route to the remote gateway, that is the point at which NAT may be justified. Document the loss of source-address visibility and the inability of remote hosts to initiate ordinary sessions to individual branch clients.
Step 6: Configure forwarding and firewall policy
Apply policy at three layers:
- Listener: Permit the OpenVPN protocol and port on the VPS firewall and upstream security group.
- Forwarding: Permit traffic between the TUN interface and each physical LAN or private-network interface on the VPS and connector.
- Host services: Permit only the application ports that should be reachable on the destination hosts.
On Linux, forwarding rules are commonly implemented with the host firewall framework (for example, nftables or iptables). The exact commands vary by distribution and firewall manager, so express the policy in terms of interfaces and CIDRs rather than assuming a command set. A secure routed policy allows traffic from the VPN range to the intended branch range and the reverse direction, then adds narrower service rules such as TCP to a specific application port. Log denied forwarding packets while testing, and remove broad temporary permits after the path is confirmed.
For NAT, add masquerading on the connector’s interface toward the remote network and allow established return traffic. Do not combine NAT with a routed design accidentally; double NAT makes troubleshooting and access control harder.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Step 7: Validate from the tunnel outward
Test in layers so each failure points to a small set of causes.
- Process and handshake: Confirm the OpenVPN service is running and the client is connected. Check logs for certificate errors, an unreachable
remote, or a protocol/port mismatch. - Virtual addresses: Inspect the TUN interface on both ends and confirm they are inside the selected VPN range.
- Routing tables: On the server and connector, verify routes for the branch LAN, VPN range, and VPS-side network. Confirm the server associates the branch route with the correct client.
- Connector reachability: From the VPS side, ping or otherwise test the connector’s LAN address if that protocol is allowed. This checks the first routed hop.
- Second-host reachability: Test a different host behind the connector. If the connector responds but the second host does not, inspect the branch gateway’s return route and the host firewall.
- Application test: Test the required TCP or UDP service rather than relying only on ICMP. A successful ping does not imply that an application port is open.
- Counters and captures: Watch firewall counters and, where permitted, capture traffic on the TUN and LAN interfaces. A packet visible on one interface but absent on the next identifies the forwarding boundary that needs correction.
Test initiation in both directions when you selected routed forwarding. An outbound connection from the branch can succeed under NAT even though a new connection from a VPS-side host would fail; that asymmetry is expected for NAT, not proof of a complete routed deployment.
Reference configuration relationships
The following snippets show the relationships to establish, not a complete production configuration. Replace addresses, certificate blocks, interface names, and firewall syntax with values for your system.
Routed server concepts
port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0
route 10.0.60.0 255.255.255.0
The server line represents the VPN virtual pool used by the community sample. The route line tells the server operating system that the branch subnet is reachable through OpenVPN; the client-specific iroute associates it with the branch certificate.
Branch client concepts
client
dev tun
proto udp
remote vpn.example.net 1194
route 192.168.70.0 255.255.255.0
The client-side route is for a VPS or headquarters subnet in the example. If the server pushes the route centrally, do not create conflicting duplicate routes. Check the resulting table rather than assuming the profile was applied as intended.
Common failures and targeted fixes
Overlapping address ranges
Symptom: A host chooses its local interface for a remote address, or traffic reaches the wrong gateway. Fix: Renumber one network so the branch, VPS-side, and VPN CIDRs are distinct. Do this before tuning firewall rules.
Missing return route
Symptom: The server can send a packet toward the branch, but replies disappear at the branch gateway; or branch clients can reach the VPS but VPS-side hosts cannot start connections. Fix: Add the gateway route through the connector and verify the next-hop address is on that gateway’s directly connected network.
NAT mistaken for bidirectional routing
Symptom: Branch clients can browse or reach a remote service, but remote hosts cannot open a new session to them and logs show only the connector address. Fix: Replace NAT with routed forwarding and install return routes, or explicitly accept the one-way design and expose only deliberately forwarded services.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Listener or profile mismatch
Symptom: The client repeatedly retries, never receives a tunnel address, or logs a TLS/transport failure. Fix: Check that the remote hostname, port, protocol, and dev value match the server, and that the VPS firewall and security group allow the same protocol and port.
Forwarding blocked by a firewall
Symptom: Both TUN interfaces are up, but packets stop at the connector or VPS. Fix: Inspect forward-chain policy and counters on both systems; allow the required TUN-to-LAN and LAN-to-TUN flows, then narrow the rules to the intended CIDRs and services.
Duplicate client credentials
Symptom: Connections flap when two sites use the same profile, or you cannot identify which site generated an event. Fix: Issue a unique certificate and key for each connector, revoke the shared identity, and deploy separate profiles.
Operational and security checks after it works
- Keep the VPN virtual range, branch range, and VPS-side range documented in one network diagram with gateways and next hops.
- Restrict forwarding to the subnets and application ports that need access; do not treat the VPN as a trusted flat LAN.
- Store each private key with restrictive permissions and rotate or revoke credentials when hardware or staff changes.
- Monitor OpenVPN logs, tunnel uptime, and firewall deny counters. A connected session can still lose a route or a downstream host.
- Back up server configuration and client profiles securely, but never place private keys in an unsecured shared repository.
- After upgrades, re-check directive names, default routes, and Access Server routing settings. OpenVPN release behavior and defaults can change.
- Document whether the deployment is routed or NATed. Future administrators need to know whether remote-initiated sessions are expected to work.
What success looks like
A complete site-to-site deployment has a stable OpenVPN session, distinct address ranges, a TUN address on each endpoint, a server route and client association for the branch LAN, return routes on the relevant gateways, and firewall rules that permit forwarding in the required directions. You can reach a second host behind the connector and test the application ports that matter. If any of those pieces is missing, the tunnel may appear healthy while the LAN remains unreachable.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
