Beginner question about VPN topology?

Sully

Hi. I have always used applications like tunngle or lanbridger for any of my needs. I also have used ntops n2n. I'm no stranger to networking in general (windows, not *nix). But recently I have the need to create a vpn tunnel for a few people at work.

The situation is simple really, they were taking spreadsheets home to work on, or emailing them to themselves, and kept losing them or overwriting them, or whatever. I have a synology nas box in mirrored raid array for the data (replaced older win2k server machines), so while here at work, they always open files from shares. Anyway, its ok that they work on this at home, but I am getting tired of thier lack of skills in maintaining files.

My nas box has the ability to run openvpn, as client or server, but not both it seems. I have two other machines at my disposal (whatever OS I want to use, but they run xp pro now).

I like ntop n2n, but it is not the right solution as anyone can hit the supernode and create thier own network. They can't get into mine, but really that is not a good solution.

So, in looking at openvpn, I need some topology clarification.

First, if I have a machine setup as the server, and that machine has some share on it, will a client be able to access those shares?

Or, does the server act more like a gateway, where an internal client on the lan side of the server could connect to a remote client which also connects to the server?

I ask because, the goal is to allow a remote client to open a spreadsheet file that exists on the nas box. Not download it to the client machine and then upload it after modifications (ftp can do that easy enough, or other options as well), but really open it as if they were in the lan. This is the best method I can think of to allow access to these employees and keep the dang files in thier proper location.

Anyway, I have read a lot of the documentation and faqs here, and on many other blogs or how-tos online, but haven't found the answer yet.

I assume it is like n2n, where a machine hosts the supernode (server) and on the same machine the n2n client connects, thus sharing the resources to remote clients. But a server only connects the clients, not sharing its own resources.

This complicates matters because while I could house these files on a windows machine, that defeats the purpose of my nas box and its available tools like the raid array, the users rights and the backups that originate from it.

Sort of hard to explain I guess when one doesn't know all the terminology. But if you get the idea of what I am trying to do, and also understand what it is that I don't understand about how vpns work, could you share that with a fellow geek?

Thanks to any takers.

Sul.

maikcat

hi there,

openvpn operates by creating a tun/tap interface,means that it operates at layers 2 or 3,

with that in mind..

First, if I have a machine setup as the server, and that machine has some share on it, will a client be able to access those shares?

shares?you mean smb/cifs shares?if yes then its cifs job to permit access to your openvpn clients,
openvpn simply "routes" packets...

Or, does the server act more like a gateway, where an internal client on the lan side of the server could connect to a remote client which also connects to the server?

yeap and transparently encrypts traffic & verifies peers identity..

Sort of hard to explain I guess when one doesn't know all the terminology. But if you get the idea of what I am trying to do, and also understand what it is that I don't understand about how vpns work, could you share that with a fellow geek?

vpn's (like openvpn implementations) create a virtual interface and to every packet going in & out to this
interface they add the necessary headers (encapsulation) & encrypt the content , then send it over via internet to the other vpn endpoint...

sorry for my poor english.

Michael.

Sully

Thank you for the response.

Let me try to explain this better, I think my first attempt was poor.

Lets suppose that I have a machine acting as vpn server at ip 192.168.5.1.
This machine has shares (cifs) available. As a vpn server, if a remote client connected to it, would this machines resources be available to the remote client?

Next, suppose I had the same machine acting as a vpn server at ip 192.168.5.1. Also suppose that an internal client attached to the machine at ip physical 192.168.5.100. And finally, a remote machine also attached to the server. I know that both clients could access each others resources as they are in the same vpn subnet (although without bridging it would not be the "same" as a physical lan, netbios missing and all), and I know that the two physical machines in the 192.168.5.0 subnet would operate as normal. So, is one limitation of vpn that the server only connects peers together and is not an actual "part of the vpn network"?

I realize there is routing involved for many advanced aspects, and that routers and firewalls need the correct rules to allow vpn traffic. I am just trying to find out what can access what, because....

My synology NAS can be a vpn server or connect to a vpn. If a vpn server can allow the clients it handles connections for to access its resources, then my nas box could do everything. However, if the vpn server only connects peers and does not share its resources, then I must put up a different machine to act as the server, and the NAS box would connect as a client.

The desire is to allow a remote client to open a file on the NAS box directly, without having to download it, just as would happen in the physical lan.

Hopefully that describes the questions and situation better.

Sul.

maikcat

hi there,

This machine has shares (cifs) available. As a vpn server, if a remote client connected to it, would this machines resources be available to the remote client?

as i said before, openvpn has nothing to do if a client can access a share on openvpnserver itself,

openvpn starts a virtual interface with an ip assinged on it...
the rest is : firewall ,if any, job to allow incoming traffic and configuring other services to allow
access from other networks (in your case cifs).

Next, suppose I had the same machine acting as a vpn server at ip 192.168.5.1. Also suppose that an internal client attached to the machine at ip physical 192.168.5.100. And finally, a remote machine also attached to the server. I know that both clients could access each others resources as they are in the same vpn subnet (although without bridging it would not be the "same" as a physical lan, netbios missing and all), and I know that the two physical machines in the 192.168.5.0 subnet would operate as normal. So, is one limitation of vpn that the server only connects peers together and is not an actual "part of the vpn network"?

openvpn supports 2 modes: routing & bridging , both creates a virtual interface (tun or tap ,tun is layer3,tap
is layer 2)in routing mode if you enable ip forwarding on your openvpn server then you simply have a router with 2 interfaces....nothing more nothing less....

in bridge mode your client gets an ip from your internal lan and acts like one..

openvpn is not FILTERs ANY traffic...
if you want filtering use iptables.

regards
Michael.

Sully

Thank you. I think this will work for my needs if I understand you correctly. Well, I do not understand it yet, but I will.

For now, I have a machine running as a vpn server, and one connecting as a client. I tried the static key mini how-to, and can see the connection coming in to the server from the client, but get errors, cant authenticate.

So, I figured I might as well generate the keys/certs. I have done this in the past I think it was with ipsec on xp. Anyway, version 2.3 (as you likely know) does not include the easy-rsa package/module any longer. You must install it separately. I go to github, and download the package (which it calls the master package). It is zipped. The readme for windows platforms says to

Extract all zip'd files to the OpenVPN home directory,
including the openssl.cnf file from the top-level
"easy-rsa" directory.

I am a pretty big geek, but I don't understand what they want me to do here. For starters, I cannot find an openssl.cnf file in any top-level directory. Its not on github, nor in the zip I downloaded. There are some in a subdirectory a few levels down. They also mention to extract all files to the home directory, which I assume they mean the openvpn root directory (ie. %programfiles%\openvpn). But, the zip file contains a lot more than just the windows batch files.

Anyway, in order to proceed I guess I should test authentication and see where my failure is. I examined the batch files, but don't see anything in them that clears up my questions.

How exactly does one install easy-rsa for v2.3 of openvpn on a windows platform? Or rather, what needs to go where to be correct?

Thank you again for your time to help.

mwandelaar

EasyRSA works fine, no comments about that in anyway.
When installing openvpn you have openssl installed. That package has the openssl.cnf configfile they are referring to.

As a tip, i'm using TinyCA ( http://tinyca.sm-zone.net/ ) to create my CA and server+client certificates.
As this uses the normal "openssl ca" tools, you can use it in other ways too. Even again with EasyRSA or -as i do myself- script it for more automated issuing/crl-generation etc.

Sully

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

thomasstuart28

Sully wroteThank you for the response.

Let me try to explain this better, I think my first attempt was poor.

Lets suppose that I have a machine acting as vpn server at ip 192.168.5.1.
This machine has shares (cifs) available. As a vpn server, if a remote client connected to it, would this machines resources be available to the remote client?

Next, suppose I had the same machine acting as a vpn server at ip 192.168.5.1. Also suppose that an internal client attached to the machine at ip physical 192.168.5.100. And finally, a remote machine also attached to the server. I know that both clients could access each others resources as they are in the same vpn subnet (although without bridging it would not be the "same" as a physical lan, netbios missing and all), and I know that the two physical machines in the 192.168.5.0 subnet would operate as normal. So, is one limitation of vpn that the server only connects peers together and is not an actual "part of the vpn network"?

I realize there is routing involved for many advanced aspects, and that routers and firewalls need the correct rules to allow vpn traffic. I am just trying to find out what can access what, because....

My synology NAS can be a vpn server or connect to a vpn. If a vpn server can allow the clients it handles connections for to access its resources, then my nas box could do everything. However, if the vpn server only connects peers and does not share its resources, then I must put up a different machine to act as the server, and the NAS box would connect as a client.

The desire is to allow a remote client to open a file on the NAS box directly, without having to download it, just as would happen in the physical lan.

Hopefully that describes the questions and situation better.

Sul.

What best you have found out any best way to allow vpn traffic. Also, I am really confused with the advanced aspects use and need some better options to go with!

CCIE Routing and Switching