OpenVPN via HA WiFi Access Point

I use my Home Assistant (connected via ethernet to the router) as wifi access point to share internet, and I want to install OpenVpn (config provided by S*rfshark) and route all the traffic (local and from the access point Wifi) over the VPN.

Here the output of ifconfig:

br-5fa5a7c5472b: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.20.0.1  netmask 255.255.255.0  broadcast 172.20.0.255
        ether 5e:e6:c0:03:3a:17  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 188 overruns 0  carrier 0  collisions 0


docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.30.232.1  netmask 255.255.254.0  broadcast 172.30.233.255
        inet6 fde0:fa7a:42cc::1  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::4c15:c1ff:fe30:6099  prefixlen 64  scopeid 0x20<link>
        ether 4e:15:c1:30:60:99  txqueuelen 0  (Ethernet)
        RX packets 27673  bytes 7040097 (6.7 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 32212  bytes 13618231 (12.9 MiB)
        TX errors 0  dropped 4 overruns 0  carrier 0  collisions 0


end0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.114  netmask 255.255.255.0  broadcast 192.168.2.255
        inet6 2a00:1f:9d02:2901:e6b3:86ca:807a:c844  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::e0a5:7e03:bac1:5296  prefixlen 64  scopeid 0x20<link>
        ether 2c:cf:67:33:ad:e4  txqueuelen 1000  (Ethernet)
        RX packets 2545517  bytes 784995961 (748.6 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2303989  bytes 300975919 (287.0 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 107  


hassio: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.30.32.1  netmask 255.255.254.0  broadcast 172.30.33.255
        inet6 fd0c:ac1e:2100::1  prefixlen 48  scopeid 0x0<global>
        inet6 fe80::343d:f9ff:fea5:b0eb  prefixlen 64  scopeid 0x20<link>
        ether 36:3d:f9:a5:b0:eb  txqueuelen 0  (Ethernet)
        RX packets 1636531  bytes 680682552 (649.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1679418  bytes 294283068 (280.6 MiB)
        TX errors 0  dropped 2 overruns 0  carrier 0  collisions 0


lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 519835  bytes 139112399 (132.6 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 519835  bytes 139112399 (132.6 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.10.1  netmask 255.255.255.0  broadcast 192.168.10.255
        ether 2c:cf:67:33:ad:e6  txqueuelen 1000  (Ethernet)
        RX packets 5742418  bytes 1054308214 (1005.4 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 588446  bytes 399390470 (380.8 MiB)
        TX errors 0  dropped 2 overruns 0  carrier 0  collisions 0

This is the client.ovpn

client
dev tun
proto tcp
remote <server_host> <server_port>
remote-random
nobind
tun-mtu 1500
mssfix 1450
ping 15
ping-restart 0
reneg-sec 0
remote-cert-tls server
auth-user-pass pass.txt
verb 3
fast-io
cipher AES-256-CBC
auth SHA512
key-direction 1
tls-auth ta.key 1
ca ca.crt

Here is the output of the ip route:

0.0.0.0/1 via 10.7.7.1 dev tun0 
default via 192.168.2.1 dev end0  src 192.168.2.114  metric 100 
10.7.7.0/24 dev tun0 scope link  src 10.7.7.3 
37.19.200.103 via 192.168.2.1 dev end0 
128.0.0.0/1 via 10.7.7.1 dev tun0 
172.20.0.0/24 dev br-5fa5a7c5472b scope link  src 172.20.0.1 
172.30.32.0/23 dev hassio scope link  src 172.30.32.1 
172.30.232.0/23 dev docker0 scope link  src 172.30.232.1 
192.168.2.0/24 dev end0 scope link  src 192.168.2.114  metric 100 
192.168.10.0/24 dev wlan0 scope link  src 192.168.10.1

As it is:

  1. from within Home Assistant, it seems my requests goes through the VPN
  2. when connecting a device using the access point, it seems there is no internet connection

That’s not what HA’s for, friend. It’s designed to run on a flat network.
I highly suggest trying a different method for an access point.

I’m running OpenVpn in a docker container, it is not tight to HA