Hello everyone,
I have been doing some research off and on over the past week but I am still unable to figure out the simplest yet most effective solution to my unique configuration.
I have not configured anything with OpenVPN yet other than making the cert on the "server" (Since I understand only one computer can be used as the server).
Here is my topology:
Server1 = Main Site...has two interfaces...eth0 and eth1. eth0 is connected to internal network and eth1 is connected to "P2P Circuit" (will explain)
Server2 = Secondary Site...has two interfaces like above...eth0 and eth1. eth0 is also connected to internal network and eth1 is connected to "P2P Circuit"
** Quick note: Both servers are configured identically from a topological standpoint except they are at two separate locations and with two separate IP ranges for eth0.
P2P Circuit = Basically a managed circuit provided by an outside company that essentially connects Server1's location to Server2's location over a managed (Layer2+) network...think of it as one big long copper cable connecting the two locations for simplicity's sake.
The problem is this, we cannot trust the outside company...well, we can...but there is always a risk to it...and we want to completely *eliminate* the risk.
BGP traffic, other router traffic, as well as regular TCP/UDP traffic will be passing over the VPN as eth0 is essentially connected directly to that location's router...(at both sites).
From what I have read, it sounds like a tap would be my best solution. However, I want to do this in the simplest way possible.
Diagram:
Network[Loc1] <=g0/0=> Router[Loc1] <=g0/1=> eth0[Loc1] <==> eth1[Loc1] <=Provider=> eth1[Loc2] <==> eth0[Loc2] <=g0/1=> Router[Loc2] <=g0/0=> Network[Loc2]
NOTE: g0/x is the Cisco router's physical port connection....so the internal network would be on g0/0 and the connection to the other router will be through g0/1, then the VPN, and finally to g0/1.
What I have conceptually thought of & done thus far:
I have setup an internal network between the two server devices that connect directly to each [eth1 at both sites] with a 10.0.0.1/24 [.1 {Loc1} and .2 {Loc2} respectively]. I have proven that I am able to make an SSH connection between the two locations and transfer large amounts of data between them at a fast rate.
Once I knew that infrastructure was in place, I bound eth0 to be the same as the IP address of the far end location's router interface (g0/1). My presumption would be that any device wishing to communicate with that other location would connect to the far end router through that IP....and that would be the visible IP seen by the LOCAL router. I did the exact reverse on the other location...setting up the IP address on eth0 to match the far end router's IP address.
I know there is a better and simpler way.
All I want to accomplish is to pass the traffic through each device as if the devices did not exist....and the encryption be done "invisibly" similar to VLAN tagging.
Any help would be GREATLY appreciated.
