First time vpn here. Help!

jentekkl

Ok. Here goes.

Overview: I am attempting to set up a vpn connection between to offices on a router level. I have set up what I believe to be a routed tunnel. What my basic requirements are is that I have a server router Asus RT-n66u using Merlin flavor build and openvpn. I have two of these. One set up as a server and one set up as a client at the remote office. In the future I need to expand this to many clients but only the server needs to talk to them all. No client to client. I was able to successfully generate the certs on both ends and enable both server and client.

The trouble: I am very new to this so please bear with me if you need things to help me. I have attempted on DD-WRT and gotten nowhere so I don't really have that much grounding in the higher levels of VPN. I am currently able to access the remote router using the vpn address of 10.1.0.6 with 10.0.1.1 being my local router. HOWEVER, i want to be able to browse the net neighborhood on both sides. IE server computers behind server router can see all of client computers behind client router in network neighborhood and vice-verse.

What I can do so far: I can go to the remote office and open a web browser and access my server side computers and router including a basic centos test server ( basic Apache test page) with no problem. I can even access the server router over the internet at its local address of 192.168.1.1.

I will attach a link to a png of what my current set up is to the best of my knowledge. I know it is bad. I'm IT not graphic artist.

http://www.glrc.biz/public/config.png

maikcat

hi there,

i want to be able to browse the net neighborhood on both sides

are you using WINS?

Michael.

jentekkl

I am not too familiar with the setup of a WINS device. I do not have one set up right now but I have a Synology Nas on the server side that has a WINS server package built in, it is just not on. From my understanding, that would need to be configured on all computers involved correct? Or just the routers?

maikcat

hi there,

WINS is not a device its a service usually runs on windows server OS,
its purpose it to keep browse lists ,browse lists usually created by broadcast
packets ,broadcasts dont pass over tun based openvpn...

to be able to see all pcs in network neighborhood is not openvpn's issue,
its MS smb protocol.. (NBNS if it says anything to you..)

Michael.

jentekkl

Hmmmm. Ok. I still have the problem of not being able to see past the client router from the server side. Is that a wins problem as well. IE I can go to client and type in a network ip on server side behind router and get a result but not vise verse. I can only get to router from server side and only on the 10.1.0.x address.

maikcat

to achieve lan-to-lan connectivity openvpn must be setup accordingly...

can you post the server config & ccd files used?

Michael.

jentekkl

Sorry it took so long. Was out sick.

Server config (I think)

# Automatically generated configuration
daemon
server 10.1.0.0 255.255.255.0
proto tcp-server
port 1194
dev tun21
cipher AES-128-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.1.0 255.255.255.0"
client-config-dir ccd
push "dhcp-option DNS 192.168.1.1"
push "redirect-gateway def1"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

adn my ccd file is empty...

maikcat

the additions needed for lan-to-lan are:

lets say that your client remote network is 192.168.2.0/24,
with that in mind you add to your server config:

route 192.168.2.0 255.255.255.0

also you create a ccd file named after your clients certificate name with
the following contents...

iroute 192.168.2.0 255.255.255.0

in BOTH server client ip forwarding MUST be enabled...

regards

Michael.

jentekkl

Would that be done using IPTABLES I am assuming?

Also I just create a file named what my clients common name is with the second piece of code and insert into ccd directory? What file extension do I need to put on it. And i am using 192.168.0.0 as client net and 192.168.1.0 for server net.

maikcat

Would that be done using IPTABLES I am assuming?

i suggested the openvpn's routing way....
if you have something else in your mind,then go ahead...

Also I just create a file named what my clients common name is with the second piece of code and insert into ccd directory? What file extension do I need to put on it

no extention needed...just create a file with the contents i posted earlier.

And i am using 192.168.0.0 as client net and 192.168.1.0 for server net.

ok then,simply substitute 192.168.2.0 with 192.168.0.0

regards
Michael.

jentekkl

OK.. Did all that.

Minor success. From server side I can now access client router and vise versa, but nothing beyond that.......

jentekkl

Actually I did get it to work the problem was it was wiping the settings on restart. Its works excellent now 🙂