Configuration help - internal network

jpfingstmann

Hello!

I'm new to OpenVPN (except for the standard setups by example on the site, which I've done many times, but never really "learned" OpenVPN that way) and am trying to figure out the best way to configure it for a slightly unusual setup.

I currently have 3 servers (hosted) at different sites. Each has 1 NIC with IP assigned to it. I want to create a new internal network (10.11.20.0/24) that OpenVPN can connect and allow services to run on.

I was hoping to use tap0 and assign an IP (10.11.20.1 on the first server, 10.11.20.2 on the second, etc) I want this to be fully accessible from any site (DNS says internalweb.example.com has 10.11.20.2 IP that can be reached from any server). I want the setup to be decentralized, so I thought maybe something like this:

10.11.20.1         10.11.20.2         10.11.20.3
OpenVPNServer1  -> OpenVPNClient2
                   OpenVPNServer2  -> OpenVPNClient3
                                      OpenVPNServer3 -> (To client1)
OpenVPNClient1
ExternalSvr1       ExternalSvr2       ExternalSvr3

I was hoping for bidirectional access so if 10.11.20.2 goes down, .1 and .3 can still communicate normally without interruption.

ExternalSvr1-3 are second instances of OpenVPN on alternate ports for client connections from mobile devices. I'd like them to be on the 10.11.20 network, if possible.

Any thoughts or suggestions? Is there a better way to do this? Thanks!

Jason

mwandelaar

Personally i think you can better use tun (and routing therefor) as it has less overhead.
In your setup i would choose one of the servers to be an openvpn-server and let both other servers connect to it.

Using the directive

client-to-client

you can make all openvpn-systems talk to each other.

This has the advantage of a single, routed, setup without forwarding packets between several openvpn-instances (packets from server 1 to server 3 are picked-up by one openvpn-instance and send out by another openvpn-instance)

Hope this helps.