How to establish Host to LAN VPN with VPN matcher

Vigor router supports VPN matcher to establish VPN connection between VPN peers behind NAT since firmware version 3.9.2. The method is introduced in What is VPN Matcher and how to use it. The feature can be used not only on LAN-to-LAN VPN connections but also on Host-to-LAN VPN connections. This article is going to demonstrate how to build a Host-to-LAN VPN with VPN matcher and Smart VPN client(v5.5.0).

Go to https://vpn-matcher.draytek.com and login

1. Click Add device. Add the server router into VPN matcher by their LAN MAC address. And choose Yes for Set as VPN server.

2. Click Add device. Add the client PC into VPN matcher by their LAN MAC address.

3. Copy the Router List Key

VPN matcher uses OpenVPN as VPN protocol for Host-to-LAN connection, therefore certificates for router and PC are required. In this example, we use the self-generated certificate on the Vigor Router.

VPN Server Setup :

1. Go to VPN and Remote Access >> VPN Matcher Setup

• Choose Enable.
• Enter Router List Key.
• Click OK.
• Click Get List.
• Click Create Profile.

2. Select the index for the profile. Enter the Username and Password. Then click OK to save.

3. Go to VPN and Remote Access >> OpenVPN >> OpenVPN Server Setup

• Choose Router generated certificates.
• Click Generate. Then we will see the certificates generated by the router.

4. Go to VPN and Remote Access >> OpenVPN >> Client Config

• Choose VPN Matcher for Remote Server.
• Enter the File Name.
• Click Export.

VPN Client Setup :

1. Run Smart VPN Client, select OpenVPN for Type, and Import the .open file.

• Enter Username and Password.
• In Advance Options, Enable VPN Matcher
• Enter the Auth Key (Router List Key).
• Click Get List to select the VPN server. Then click OK.
• Click OK to save.

2. Select this profile. And click Connect.

Now the VPN connection is up.

We can see the connection in VPN Connection Status.

Note: There is a network requirement, that the NAT type should be Cone NAT, such as Full cone NAT(one-to-one), Address-Restricted cone NAT or Port-Restricted cone NAT. Symmetric NAT is not supported, Vigor Router and Smart VPN client also provide detection function in VPN Matcher Setup.