client-server-client

sinsco

hi to all, i'm new on forum and I would to know if is possible create something like:

CLIENT1 --- SERVER --- CLIENT2 --- (PC1, PC2, ..)

I've seen that by using "client-to-client" I can reach each client, but I would to
reach PC1 from CLIENT1

please could you point me in the right way?

PS. CLIENT2 have 2 interface with different IP (such as 192.168.1.xxx and 192.168.0.xxx), the first one to connect to the SERVER and second one to connect with PC1, PC2, ..

thks in advance

maikcat

you will need to setup lan-to-lan connectivity for
the network behind client2 to be reachable..

post diagram with ips used and i will help you out

Michael.

sinsco

thanks for your reply.
this is the scenario:
SERVER: 192.168.1.2 (service is also available from the internet)
CLIENT1: 192.168.1.10 (same network of the server, but it could be connect also from internet)
CLIENT2: eth0=192.168.0.100 (not in the same network, it connects with ther server always over internet)
CLIENT2: eth1=192.168.100.1 (switch)
PC1: 192.168.100.10 (switch)
PC2: 192.168.100.11 (switch)
..

so, I have:

C1 ----(WEB)---- SERVER ----(WEB)---- C2 ----(switch)---- [PC1, PC2, ...]

I hope to be clear

thks

maikcat

please create a minimal config first and i will add the necessary
options for lan-to-lan...

you MUST use certificates+ccd files...

also keep in mind that you must not have the same network range
between server side and client2 lan

Michael.

sinsco

this is my configs:

# server, launched from command line with this arguments
--port 443
--dev tun
--proto tcp-server
--server 10.1.0.0 255.255.255.0
--comp-lzo
--verb 1
--dh "/vpn/keys/dh1024.pem
--ca "/vpn/keys/ca.crt
--cert "/vpn/keys/server.crt"
--key "/vpn/keys/server.key"
--client-cert-not-required
--auth-user-pass-verify "/vpn/bin/auth.exe" via-env
--auth-nocache
--script-security 3 system
--route 10.1.0.0 255.255.0.0
--push route 10.1.0.0 255.255.0.0
--connect-retry-max 3
--inactive 10
--ping 3
--ping-exit 5
--remap-usr1 SIGTERM
--client-to-client

and clients:

# client 1/2
client
dev tun
proto tcp
remote <public_ip> 443
resolv_retry infinite
nobind
persist_key
ca "/vpn/ca.crt"
comp_lzo
verb 3
script_security 2 system
ns_cert_type server
inactive 10
ping 3
ping_exit 5
remap_user1 SIGTERM
auth_user_pass "/vpn/pass"
status "/tmp/openvpn.log"
connect_retry 15
#up "/vpn/bin/forward set"
#down "/vpn/bin/forward unset"

ccd file is really necessary?

maikcat

i will start backwards...

ccd files ARE necessary for a simple reason,
you want to route traffic for a remote lan which resides to one
of your clients...

how is suppose openvpn to know where to route packets for this subnet?
that what is the iroute statement does,
you create a ccd file and inside it you place

iroute x.x.x.x 255.255.255.0

where x.x.x.x is the lan network of your client
also you add to your server config

route x.x.x.x 255.255.255.0

if you dont to use certificates for your clients you must add to your server config

username-as-common-name

and create the ccd file named after the username your client uses...

also remove these:

--route 10.1.0.0 255.255.0.0
--push route 10.1.0.0 255.255.0.0

you still need to push to your client1 routes for:

+ your internal lan
+ your clients internal lan

also you must enable ip forwarding on both openvpn server & the client with the lan route

Michael.

sinsco

thanks very much..I'll try to play with this tricks as soon as possible