Creating multi-server on a single machine?

SedoSan

Hello,
I would like to know how to create multiple server configurations so I can connect to any of them depending on the situation.
Basically I want to make 4 different servers
one on UDP 1194 for me and my family members
one on UDP 1194 for friends/guests
one on TCP 443 for me and my family members
one on TCP 443 for friends/guests

I connect to UDP 1194 with no problems but sometimes in college firewall can be pretty restrictive so I will connect to the other server configuration.
As for the guests, I want to give them a different virtual network so they won't be able to connect to my home network interface.

from what i understood I can create multiple .conf files such as serverUDP1.conf, serverUDP2.conf, serverTCP1.conf, serverTCP2.conf
I know this far, but how do I choose how client chooses which server to connect to?

Thanks,

brendan

you configure the client to connect to the given instance...

--remote host [port] [proto]

example:

--remote vpn.mydomain.com 443 tcp

janjust

or you configure the client to use multiple 'remote' statements: the client will then go through the list until it finds one that it can connect to:

<connection>
  remote HOST
  port PORT1
  proto udp
</connection>

<connection>
  remote HOST
  port PORT2
  proto tcp
</connection>

<connection>
  remote HOST
  port PORT3
  proto tcp
</connection>

etc.

SedoSan

Do I have to create a new .crt and .key files for every new server??

janjust

nope you can reuse the same cert/key pair for each server.

SedoSan

Then I don't know whats wrong, I can't seem to be able to connect from my other client config file...
I'll see if I can submit the log

SedoSan

ok, this is the story:
I originally had only 1 server.con which connects on 443 TCP.

This is the original server.conf:

mode server
tls-server

local 192.168.1.21
port 443
proto tcp

#bridging directive
dev tap0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"

persist-key
persist-tun

#certificates and encryption
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0

cipher BF-CBC
comp-lzo

#DHCP Information
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.21 255.255.255.0 192.168.1.80 192.168.1.89
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DOMAIN mydomain.com"
push "redirect-gateway def1 bypass-dhcp"
max-clients 10
client-to-client

#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
crl-verify crl.pem

This is the port 1194 UDP serverUDP.conf:

mode server
tls-server

local 192.168.1.21
port 1194 
proto udp 

#bridging directive
dev tap0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"

persist-key
persist-tun

#certificates and encryption
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0

cipher BF-CBC
comp-lzo

#DHCP Information
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.21 255.255.255.0 192.168.1.90 192.168.1.99
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DOMAIN mydomain.com"
push "redirect-gateway def1 bypass-dhcp"
max-clients 10
client-to-client

#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
crl-verify crl.pem

These are the 443 TCP client.ovpn:

client

dev tap

remote mydomain.com 443
proto tcp

nobind

resolv-retry infinite

persist-key
persist-tun

ca ca.crt
cert client.crt
key client.key

tls-auth ta.key 1

cipher BF-CBC

comp-lzo

verb 3

This is the UDP client2.ovpn:

client

dev tap

remote mydomain.com 1194
proto udp

nobind

resolv-retry infinite

persist-key
persist-tun

ca ca.crt
cert client.crt
key client.key

tls-auth ta.key 1

cipher BF-CBC

comp-lzo

verb 3

These are my iptables:

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

and my rc.local has the ipv4 forwarding = 1 on...

Since the server on 443 TCP connecting, I don't see why the UDP one is not...

Any idea why this isn't working?
Thanks

SedoSan

ok, so I fixed the problem "I think",
i changed this in the serverUDP.conf:

#bridging directive
dev tap0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"

to:

#bridging directive
dev tap1
up "/etc/openvpn/up.sh br0 tap1 1500"
down "/etc/openvpn/down.sh br0 tap1"

janjust

you've got a bridging setup - you will need to set up a new bridge for each config. Do you really need bridging (in 90+% of the cases it's not necessary).

SedoSan

janjust wroteyou've got a bridging setup - you will need to set up a new bridge for each config. Do you really need bridging (in 90+% of the cases it's not necessary).

Can you tell me the exact differences?
the reason i'm doing a bridged connection is (to my understanding), my PC will be a part of the main network and thus I can access my shared folders, I was able to access my media network from a remote place and streamed it via VPN without any problems, is this achievable with the other setup? I don't want to make a virtual network. Unless a virtual network can connect to my main network.

I'm not very knowledgeable when it comes to networks and subnets, but currently my main network is 192.168.1.0 with 255.255.255.0, lets say i do a virtual network with tun, I have to choose another network right? for example 192.168.10.0? if I did this can I still connect to the shared folders on 192.168.1.0?

Thanks.

janjust

yes that is all possible, but you will need to set up proper routing , and WINS forwarding if you're using Windows/Samba shares.

Bridging is also possible, but you will need a bridge to which multiple tap devices are connected , e.g. eth0+tap0+tap1+tap2

each OpenVPN setup would then specify 'tap0', 'tap1' and 'tap2' respectively.
(this is slightly different from what I said before - each config will need its own tapN device, but you *CAN* share them all in one bridge, with quite some performance loss, however).