Hello!
I have a goal to connect main office with sub-offices (including offices behind NAT)
I've Googled a bit and found that OpenVPN and Strongswan should be able to do what I need.
It looks like OpenVPN have much bigger community and more easy to configure, so I started with OpenVPN.
I've tried this config in VirtualBox and in general it works.
So my question - is it good idea to use OpenVPN in my case, how sane does this configuration looks?
Is it possible to do something better?
Notes:
Regional network could be behind NAT and have random external IP.
Clients authenticate with rsa keys, I use easy-rsa to manage keys.
For encryption I choose AES 128 as compromise between speed and security.
Powerful CPU with AES instructions for Server.
Cheap router with OpenWRT and AES instructions for clients.
There should several hundreds of regional offices, but they do not generate a lot of traffic.
I use several instances of OpenVPN to split loading between cores of CPU.
For testing I use network 172.17.0.0/24 between VPN Server and Clients.
I don't care for what IP roadwarrior would get, I just need to get access to site behind it.
Central network should be accessible from any regional office.
Regional offices do not see each other.
Central network should be able to access any regional Network.
[Central net]
192.168.1.0/24
|
|
[OpenVPN Server]
ip lan 192.168.1.1
ip wan 172.17.0.1
instance one |instance two
port 1191 |port 1192
tun1 |tun2
pool10.1.0.0/24 |10.2.0.0/24
|
|Internet
|-----------------------|-----------------------|---------(etc)
| | |
| | |
[VPN Office I] [VPN Office II] [VPN Office III]
192.168.11.0/24 192.168.12.0/24 192.168.13.0/24
server.1.cnf
mode server
port 1191
proto udp
dev tun1
topology subnet
learn-address /etc/openvpn/route1.sh
script-security 2
ca easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.1.0.0 255.255.0.0
client-config-dir ccd
keepalive 2 10
cipher AES-128-CBC
tls-auth ta.key 0
max-clients 300
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
route1.sh
#!/bin/bash
case $1 in
add)
ip route del $2 dev tun2 src 10.2.0.1
ip route add $2 dev tun1 src 10.1.0.1
;;
delete)
ip route del $2 dev tun1 src 10.1.0.1
;;
esac
client.cnf
client
user nobody
group nogroup
proto udp
dev tun
float
nobind
persist-key
persist-tun
remote 172.17.0.1 1191
remote 172.17.0.1 1192
remote-random
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client1.crt
key /etc/openvpn/client1.key
cipher AES-128-CBC
remote-cert-tls server
tls-auth ta.key 1
verb 3
