Hello everyone, I am currently planning a network infrastructure as a part of a project of mine. The aim is to establish a VPN as I poorly try to describe in the following ascii: [code] +----------------------+ |ovpn server | |----------------------| |tun0 - 10.8.0.1/24 | |tun1 - 10.8.1.1/24 | |tun2 - 10.8.2.1/24 | |tun3 - 10.8.3.1/24 | |eth1 - WANIP | +----------------------+ +---------------------+ |ovpn client0 | |---------------------| |tun0 - 10.8.0.6 | +--------------------+ |eth1 - WANIP | +----------------------+ |ovpn client3 | |eth0 - 10.10.1.120/24| |ovpn client1 | |--------------------| | | |----------------------| |tun0 - 10.8.3.6 | +---------------------+ |tun0 - 10.8.1.6 | |eth0 - WANIP | |eth1 - 192.168.1.38/24| | | +--------------------+ | | | | |ovpn client2 | | | +--------------------+ |--------------------| +----------------------+ |tun0 - 10.8.2.6 | |eth0 - WANIP | | | | | +--------------------+[/code] The above scheme is already live and running. A generic client [u]config[/u] that I use: [code]client dev tun proto udp remote WANIP_SERVER 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert cert.crt key key.key ns-cert-type server comp-lzo verb 3[/code] The server config: [code]crl-verify /etc/openvpn/keys/crl.pem port 1194 proto udp dev tun ca ca.crt cert client0.crt key client0.key dh dh1024-client0.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 comp-lzo max-clients 1 persist-key persist-tun status /var/log/openvpn-client0-status.log log-append /var/log/openvpn-client0.log verb 3 mute 20[/code] As you can see, no ccd config, thus no pushing of routes, iroutes, not a single thing done so far. IP forwarding has been enabled on all machines, and the firewalls have been temporarily disabled. I have a basic knowledge and understanding of the way how OpenVPN works but I'd like to ask for your advice on this one. In my scenario, client0 would be part of a 10.10.1.x/24 network along with another 15 servers. Its role would be to make all the servers accessible from the OpenVPN server and other clients. client1 would be a box in my office network that would have the purpose to establish the tunnel with the server. client2 is a monitoring box and will have to have access to the network behind client0 and client1. client3 would be an iOS/Android device(s) (thus the need for tun, but I can switch to tap if that would make things easier) that would also need to reach the networks behind client0 and client1. As you can see, everything revolves around the need of access to the subnets behind client0 and client1 from the other OpenVPN clients & server. If this would prove to be extremely complicated to achieve, I could move the OpenVPN server on the current client0 box. P.S. never mind that 192.168.x network, that can and will be changed :) Any insight and thoughts would be greatly appreciated Thank you ! k.

Sorry for the double-post... I was just a few minutes away from the closing of the window for editing the post. Please merge this as a LE: I totally forgot that 10.10.1.3 will not be able to reply to the ping as it doesn't have a route for that. So I added this on it: [code]route add -net 10.8.0.0/24 gw 10.10.1.2[/code] and that did the trick. I will add this to all the servers in the 10.10.1.x/24 network. I will now move to the 192.168.1.x network and see if I can do the same there. Thanks again for your support.

Hello again ! Thanks for clarifying that for me. It's been a struggle so far to get the 10.10.1.*/24 network reachable from my office (192.168.1.x/24). This works just fine from Client2, however not from the other machines in my office network. On my laptop, which is in the same subnet with Client2, I added the following route: [code]route add -net 10.10.1.0/24 gw 192.168.1.34[/code] So .34 if Client2. On the OpenVPN server I added: [code]route add -net 192.168.1.0/24 gw 10.8.0.2[/code] .2 is the gateway on the OpenVPN Server. Then, I go back to my laptop and try to ping 10.10.1.2 (private IP of the OpenVPN Server) and it doesn't work... I think I'm missing something here... Some replies might get mangled in the tunnels somehow... Also, I don't think that the router from my office has a word in this as I added the routes on my laptop directly... Any thoughts would be sincerely appreciated. Thank you !

Help with advice on VPN project topology

konqstar

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

konqstar

Hello,

Thank you for your reply ! I've read this: https://community.openvpn.net/openvpn/wiki/Topology to better understand the different topologies.

In the meanwhile, I changed the topology a little. So, an up-to-date status looks like this:

OpenVPN server:
- internet, public IP on eth0
- private, 10.10.1.x/24 subnet on eth1
- tun0 - 10.8.0.1/24

Client1:
- internet, public IP on eth0
- tun0 - 10.8.0.10/24

Client2:
- private, 192.168.1.x/24 subnet on eth0 (office)
- tun0 - 10.8.0.14/24

Client3:
- can be mobile device / laptop from home / etc
- tun0 - 10.8.0.x/24

As the subnet topology mode only works for tun devices, I will drop the thought of trying my project with tap.

So far, I am only using the 'staticclients' folder to assign static IPs to some clients.

On Client1, I do:

route add -net 10.10.1.0/24 gw 10.8.0.13

and that enables me to reach 10.10.1.2 (the private IP of the OpenVPN server), but if I try to ping 10.10.1.3 (another server in that network), I can't.

Do I need to bridge the eth1 interface on the OpenVPN server for this to work ?

I will try with the subnet topology and see how that affects things.

Thank you.

konqstar

Sorry for the double-post... I was just a few minutes away from the closing of the window for editing the post. Please merge this as a LE:

I totally forgot that 10.10.1.3 will not be able to reply to the ping as it doesn't have a route for that. So I added this on it:

route add -net 10.8.0.0/24 gw 10.10.1.2

and that did the trick. I will add this to all the servers in the 10.10.1.x/24 network.
I will now move to the 192.168.1.x network and see if I can do the same there.

Thanks again for your support.

konqstar

Hello again !

Thanks for clarifying that for me.

It's been a struggle so far to get the 10.10.1.*/24 network reachable from my office (192.168.1.x/24).

This works just fine from Client2, however not from the other machines in my office network.

On my laptop, which is in the same subnet with Client2, I added the following route:

route add -net 10.10.1.0/24 gw 192.168.1.34

So .34 if Client2.
On the OpenVPN server I added:

route add -net 192.168.1.0/24 gw 10.8.0.2

.2 is the gateway on the OpenVPN Server.

Then, I go back to my laptop and try to ping 10.10.1.2 (private IP of the OpenVPN Server) and it doesn't work...

I think I'm missing something here... Some replies might get mangled in the tunnels somehow...

Also, I don't think that the router from my office has a word in this as I added the routes on my laptop directly...

Any thoughts would be sincerely appreciated.

Thank you !