elvis0801
Hi all,
Let me explain my issue. I need to set up an openvpn architecture in three blocks :
- customer side : several nomad openvpn clients
- central site : openvpn concentrator
- remote sites : several openvpn clients (with LANs to reach behind)
A VPN tunnel needs to be establish between customer and vpn concentrator, and a second one between concentrator and remote site. (I need to respect this constraint, that's the way it is asked.)
As the remote private subnets behind each openvpn client can share the same subnet IP addresses (for instance remote site 1 and remote site 2 may both use 192.168.1.0/24), it can be a problem for the vpn concentrator to route customer traffic (i.e. same destination IP@ for 2 different machines belonging to 2 distinct remote sites!).
As workaround, I thought that I could run an openvpn server instance for each remote site => 2 openvpn server instances on my vpn concentrator. This way, a given customer running an openvpn client may connect on the right openvpn server instance (via a dedicated given port written in its openvpn config file).
Then, if customer 1 wants to reach remote site 1, its openvpn client config file will contain the right openvpn server port to establish a vpn tunnel to the right openvpn server instance (corresponding to remote site 1).
Same procedure if customer 2 wants to connect to remote site 2 : he will use another dedicated openvpn port on the concentrator...
Finally, I thought I could use "policy-based routing rules" in vpn concentrator to force customer-1 traffic to be routed from an incoming tun interface (with a given virtual IP@ on concentrator side) to another outgoing tun interface of the concentrator(i.e. the one to the remote site 1).
Each openvpn server instance will then route customer traffic to a different given gateway (remote site 1, 2...).
Does it sound ok or is there easier way to do so?
Thanks in advance for your help.
