Hi all,
I have three networks.
- The central network (10.0/16)
- A remote networks (10.1/16)
- A remote networks (10.2/16)
They're all using routers with openVPN capabilities.
I want to route them together. (I'll install my own mDNS repeater later for discovery, but for now I just want to route them).
What I want:
Typing in 10.0.0.5 in the 10.1/16 block should route through the VPN and come out to 10.0.0.5. 10.0.0.5 should know that the traffic's coming from 10.1.xxx.xxx.
What I think I need:
- On the central server, openVPN running as a server with the below configuration.
- On both remote servers, openVPN running as a client connecting to the central server.
My questions:
(1) What do the things labeled HELP do? I'd like to know what's going on before testing it.
(2) What's missing from these configurations? Anything?
(3) Are my comments describing to myself what I'm doing accurate?
Thanks in advance!
linkServer.conf: (installed on server)
###### Server Access Settings ######
port 9001
proto udp
###### Networking Settings ######
dev tun0
###### Virtual/Internal Network Settings ######
# HELP! I saw this somewhere... Does it do anything?
mode server
# HELP! This too.
topology subnet
server 192.168.42.0 255.255.255.0
ifconfig-pool-persist ipp.txt
###### Routing Settings ######
# We're going to route 10.1/16 and 10.2/16
# to the remote networks, plus the other
# variations on this theme.
route 10.1.0.0 255.255.0.0 # Route from here to
route 10.2.0.0 255.255.0.0 # the other networks.
push "route 10.0.0.0 255.255.0.0" # Route to us.
push "route 10.1.0.0 255.255.0.0" # Route to them. Ignored if
push "route 10.2.0.0 255.255.0.0" # pushed to that host itself.
# We're going to have persistent IP addresses
# HELP! What does this really do?
persist-local-ip
persist-remote-ip
###### Link Settings ######
# Enable compression
comp-lzo
# Keep connections alive
keepalive 10 120
# Allow client-to-client routing
client-to-client
###### On-Machine Security ######
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
user nobody
group nobody
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun
###### Link Security ######
tls-auth linkKey.key 0 # This is our static key
cipher AES-256-CBC
# HELP! I only want AES-256. No certs. Nothing else goes here.
###### Logging ######
status openvpn-status.log
log-append openvpn.log
verb 3
mute 20
linkClient.conf (installed on both clients)
###### Server Access Settings ######
proto udp
remote XXX.XXX.XXX.XXX 9001
###### Networking Settings ######
dev tun0
###### Virtual/Internal Network Settings ######
client
###### Routing Settings ######
# We're going to route 10.1/16 and 10.2/16
# to the remote networks, plus the other
# variations on this theme.
route 10.1.0.0 255.255.0.0 # Route from here to
route 10.2.0.0 255.255.0.0 # the other networks.
push "route 10.0.0.0 255.255.0.0" # Route to us.
push "route 10.1.0.0 255.255.0.0" # Route to them. Ignored if
push "route 10.2.0.0 255.255.0.0" # pushed to that host itself.
###### Link Settings ######
# Enable compression
comp-lzo
# Keep connections alive
resolv-retry infinite
# Binding
nobind
# Allow client-to-client routing
client-to-client
###### On-Machine Security ######
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
user nobody
group nobody
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun
###### Link Security ######
tls-auth linkKey.key 0 # This is our static key
cipher AES-256-CBC
# I only want AES-256. No certs. Nothing else goes here.
###### Logging ######
status openvpn-status.log
log-append openvpn.log
verb 3
mute 20
linkKey.key (not printed here, but generated with "openvpn --genkey --secret linkKey.key")
