---
title: 'Tutorial: Configure Client-Side Subnet Routing in Access Server'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--client-side-subnets-routing/
product: Access Server Docs
description: Effectively route client-side subnets through your business VPN with Access Server's user permissions and routing settings.
---

# Tutorial: Configure Client-Side Subnet Routing in Access Server

## Overview

This tutorial explains routing specific client-side subnets through a host, such as a router, configured through Access Server's user permissions. This setup enables other end users to access their local network behind the host while connected to the VPN. Proper user permissions and network routing configuration are essential to facilitate this functionality. The steps outlined can ensure that the desired client-side subnets are correctly routed through Access Server for seamless connectivity.

## Prerequisites

- An installed Access Server.
- Admin Web UI access.
- Basic understanding of IP addressing, subnetting, and routing.
- The static IP address for your host device.

## Step 1: Configure user permissions for the host

1. Sign in to the Admin Web UI.
2. Click **User Management \> User Permissions**.
3. If there is no entry for the host user account, add one by entering the username in the "New Username" box and clicking **Add**. (For example: "Branch Network Gateway.")
4. Check the user's box for **Allow Auto-login** to facilitate seamless reconnection.
5. Click on the **More Settings** icon.
6. Configure user settings:
   - Under **IP Addressing** select **Use Static** for **Select IP Addressing**.
   - Enter the static IP address in the **VPN Static IP Address** text box.
   - Under **VPN Gateway**, select **Yes** and enter the client-side subnet in the text box, **Allow client to act as VPN gateway for these client-side subnets**.
7. Select **Save Settings** and **Update Running Server**.

## Step 2: Configure the host device for static routing

1. Enable static routing on your host device (this depends on your device, so refer to your router documentation, etc., for specifics).
2. Access the router's configuration interface.
3. Add a static route for the VPN subnet.

## Step 3: Enable IP forwarding (if using a Linux client as the gateway)

If you're using a Linux client as the gateway, enable IP forwarding:

1. Connect to the terminal.
2. Run this command to enable IP forwarding, allowing it to route traffic between networks:

   ```
   sudo sysctl -w net.ipv4.ip_forward=1
   ```

## Example scenario

Consider the following scenario to illustrate the setup:

- **User:** Fred connects to the VPN from his home.
- **Network Setup:** Fred's home PC has two network interfaces—one connected to the internet via DSL and another to a test network (192.0.2.0/24).
- **Objective:** Allow other users on the VPN to access the test network.

Fred connects to the VPN using a VPN client on his main PC. After following the steps above, you can make the test network accessible to other VPN users, including users on a back-end network in the office.

---

Prev: [Tutorial: Create a Site-to-Site Network with Access Server](https://openvpn.net/as-docs/tutorials/tutorial--site-to-site-network.md)
Next: [Cloud and Multi-VPC Connectivity](https://openvpn.net/as-docs/tutorials/cloud-and-multi-vpc-connectivity.md)
Index: https://openvpn.net/as-docs/llms.txt