Hello,
I am trying to setup OpenVPN between three different sites, which I'll refer to as AH, IDC, CDC. What follows is the idea I have for how I want them connected:
Networks to route
IDC:
172.16.20.0/24
172.16.30.0/24
10.3.0.0/16
CDC:
172.16.40.0/24
172.16.50.0/24
10.4.0.0/16
AH:
193.168.3.0/24
IDC - AH: Networks behind IDC should be available to AH.
Network behind AH _should_not_ be available to IDC
IDC - CDC: Networks behind IDC should be available to CDC.
Networks behind CDC should be available to IDC
AH - CDC: Network behind AH _should_not_ be available to CDC.
Networks behind CDC should be available to AH.
OpenVPN client and server interaction
For a graphical illustration see:
http://i.imgur.com/asBYl.jpg
IDC Server
CDC and AH connect as Clients
AH Server
CDC connects as a Client
various employees connect as Clients
CDC Server
Should take employee Client connections
-----------
What I have for a current setup
Server configs: server.conf
IDC:
port 1194
local $IDC_IP
proto udp
dev tun0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/load1.chi.example.com.crt
key /etc/openvpn/easy-rsa/keys/load1.chi.example.com.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.54.1.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/data/ipp.txt
client-config-dir /etc/openvpn/ccd
client-to-client
keepalive 5 30
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /etc/openvpn/data/openvpn-status.log
push "route 172.16.30.0 255.255.255.0"
push "route 172.16.20.0 255.255.255.0"
push "route 192.168.3.0 255.255.255.0"
route 10.4.0.0 255.255.0.0
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
verb 3
CDC
local $CDC_IP
port 1194
proto udp
dev tun0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.18.1.0 255.255.255.0
ifconfig-pool-persist /tmp/ipp.txt
route 10.8.1.0 255.255.255.0 #just added
push "route 10.4.0.0 255.255.255.0" #just added
client-config-dir ccd
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
AH
local $AH_IP
port 1194
proto udp
dev tun0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.1.0 255.255.255.0
ifconfig-pool-persist /tmp/ipp.txt
push "route 192.168.3.0 255.255.255.0"
push "route 172.16.20.0 255.255.255.0"
push "route 172.16.30.0 255.255.255.0"
push "route 10.3.0.0 255.255.0.0"
client-config-dir ccd
route 10.4.0.0 255.255.0.0
route 10.18.1.0 255.255.255.0 #just added
route 10.8.1.0 255.255.255.0 #just added
push "dhcp-option DNS 192.168.3.1"
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
Client configs
AH, IDC client config
client
remote $IDC_IP 1194
nobind
proto udp
resolv-retry infinite
dev tun1
user nobody
group nobody
persist-key
persist-tun
mute-replay-warnings
ca /etc/openvpn/certs/load1.chi.example.com/ca.crt
cert /etc/openvpn/certs/load1.chi.example.com/ah-vpn-server.crt
key /etc/openvpn/certs/load1.chi.example.com/ah-vpn-server.key
ns-cert-type server
tls-auth /etc/openvpn/certs/load1.chi.example.com/ta.key 1
comp-lzo
mute 20
# Set log file verbosity.
verb 3
CDC, IDC client config
client
remote $IDC_IP 1194
nobind
proto udp
resolv-retry infinite
dev tun1
user nobody
group nobody
persist-key
persist-tun
mute-replay-warnings
ca /etc/openvpn/certs/load1/ca.crt
cert /etc/openvpn/certs/load1/cdc-vpn-server.crt
key /etc/openvpn/certs/load1/cdc-vpn-server.key
ns-cert-type server
tls-auth /etc/openvpn/certs/load1/ta.key 1
comp-lzo
mute 20
# Set log file verbosity.
verb 5
CDC, AH client config
client
remote $AH_IP 1194
nobind #added by gjones
dev tun2
proto udp
user nobody
group nobody
ca /etc/openvpn/certs/openvpn01/ca.crt
cert /etc/openvpn/certs/openvpn01/cdc-vpn-server.crt
key /etc/openvpn/certs/openvpn01/cdc-vpn-server.key
ns-cert-type server
tls-auth /etc/openvpn/certs/openvpn01/ta.key 1
comp-lzo
keepalive 10 60
ping-timer-rem
persist-key
persist-tun
verb 5
CCD configs
IDC, CDC ccd config file
iroute 10.4.0.0 255.255.0.0
push "route 10.3.0.0 255.255.255.0"
push "route 10.3.1.0 255.255.255.0"
IDC, AH ccd config file
iroute 192.168.3.0 255.255.255.0
iroute 172.16.10.0 255.255.255.0
push "route 10.3.0.0 255.255.255.0"
push "route 10.3.1.0 255.255.255.0"
AH, CDC ccd config file
push reset
iroute 10.4.0.0 255.255.0.0
push "route 192.168.3.0 255.255.255.0"
-----------------
The OpenVPN server @CDC has an internal address of 10.4.0.120, there is a SAN device behind it at 10.4.0.1. The specific problem I am having with the above setup is that 10.4.0.1 is _not_ available from the network behind IDC and CDC. It is, however, available from the VPN servers at IDC, CDC. 10.4.0.120 is available from the IDC, AH VPN hosts as well as the networks behind them, so no troubles there.
I should mention that on the CDC host, there are _no_ firewall rules in place and it defaults to accept.
If someone could help me spot the missing piece of the puzzle I would greatly appreciate it. Additionally, if there is/are a/are major flaw in the above architecture or configurations I would be glad to hear of them, and their solutions.
Thanks,
Kendall.
