Hi all,
I've looked and looked and looked and either people are so bad at describing what they're doing that it doesn't appear to be what I'm doing or nobody's doing what I need to do... And nobody seems to be able to explain the necessary parts for me to modify what they've done to do what I need.
So I'll start with the basics.
What I have (or, will have completed soon):
- Three subnets (10.0/16, 10.1/16, 10.2/16), each with a Linux gateway using iptables/netfilter.
- Services on those subnets using mdns for discovery.
What I want:
- Connections from 10.0.0.10 to 10.1.0.10 to be routed through the VPN... without using NAT masquerading
- And vice-versa
Pictures:
Big overview:
Internal Workings (incomplete: missing VPN parts)
Please note that I am not bridging the subnets, I'm linking them. I do not want DHCP servers fighting or a restricted subnet or anything that comes with bridging. I'll use an mDNS repeater to forward these broadcasts across the subnet and that's all I need.
Questions:
- On the central gateway, is the inner blue arrow to the other gateway a tun interface?
- How will netfilter on the central gateway know to use the right gateway for IPs destined for 10.1/16?
- And vice-versa
What is the behavior of the tunnel?
Does it act like an ethernet cable plugged into the other gateway? If so:
- The tunnel will have the right gateway as its gateway
- Netfilter will have no problem detecting that it's the correct gateway for that traffic
- How does the right gateway know to use the central gateway for everything other than 10.1/16?
Does it act like another gateway? If so:
- Does it act like tun -> vpn(192.168.0.1) -> vpn(192.168.0.2) -> tun? (where the vpn interfaces have a separate IP address?)
Also:
- Do I need a separate vpn-daemon running on the central gateway for each other subnet? Do they need separate ports?
- What if, later, I also want to allow bridging connections from personal devices to the LAN (where the local DHCP provides addresses)? Do I need one-daemon-per-client? This is a secondary question.
- Can I use AES with a static key instead of RSA? RSA is still untrusted security since we can't prove it's uncrackable. It's also more difficult to set up - and, if you're as careful with the static key as you are with the certificates, AES256 is just as "secure" from an identity point of view.
I guess the two biggest things with which I need help are, in order:
(1) Understanding the behavior of the vpn tunnel with respect to eth0(LAN), eth1(WAN), etc.
(2) Configuring the VPN
Thanks for your help!
