point to site vpn - windows masquerade?

bs27975-1

What dumb thing am I not remembering - quick reminder / point in right direction, please.

Creating a site to site vpn between two client networks at different physical locations behind nat, win 7/8, no access to premise routers / port forwarding. So 'client to client' link. Using laptops each side in the middle of each network to create a direct link between them, then the other machines on each net can tunnel through these links.

i.e. openvpn --secret secret.key --dev tun --ping 15 --port %1 --remote otherside.net %1 --ifconfig 10.0.10.2 10.0.10.1

and the reverse on the other. So windows is going to have to masquerade when going to the other net. (Or machines beyond the other gateway won't know how to route back.)

I get I'll have to 'route -p add 192.168.2.0 mask 255.255.255.0 10.0.0.1' on the gateway machine to forward over the link (and the reverse on the other side'. Call that side 1.0.

ICS is not an option here / not interested in dealing with window's dhcp (dhcp, everything else, working just fine on local nets). Never used rras, but I get from posts that I need to enable those services, and tick the share nic checkbox in properties. I'm just confused over upon which adapter.

For some reason I can't seem to wrap my head around this, pointers please.

Suppose I 'telnet 192.168.1.10' from 2.0 side. route says to get to 1.0 go via 10.0.0.1, so passes the packet through the 10.0.0.2 interface. Lands on the other side, it sees it's going to 1.10 so forwards it over the lan link. So it's the lan link nic that does the sharing? (And so windows leaves the packets alone if it sees a source address on the local net?)

[Never mind if I have numbers backwards, here, just looking for the pointer to the right beastie, where. i.e. 0.1 / 0.2 are two sides of link, 1.0 / 2.0 are lan nets of each side.]

Windows masquerade is provided by rras, not ics? And windows is all just happy without side effects in this scenario?

[Linux not an option here, where I do this on my home system, it all just works. Windows ... obscures things with non-standard terms, marketing speak, and pointlessly removing services just because they're not 'server' versions. <sigh>]

Am I thinking this through correctly?

Also, given the openvpn line above, punching through the nats, any gotchas? Robust solution? (I get when the link goes down I'll have to wait for the routers to time out the connections, or change the ports used. [Problematic to change the port on the other side, in that situation!])

TIA!

bs27975-1

debbie10t wrote
bs27975-1 wroteno access to premise routers / port forwarding.
= No VPN

Not so. The line given punches through nat to nat just fine.

Next step is routing beyond the points to make it site to site (aka LAN to LAN).

Thus my question.

bs27975-1

http://www.rusroute.com/ ?

Anyone know anything about it?

Alternately, apparently in XP:
(from somewhere around my searching ...)
vvvvv
netsh routing ip nat install
netsh routing ip nat add interface "Local Area Connection" full
netsh routing ip nat add interface "Local Area Connection #2 (tap-win32!)" private

where "Local Area Connection" is the name of the LAN adapter/outgoing interface (eth0 in linux speak) and "Local Area Connection #2" is the name of the TAP-win32 adapter/incoming interface

* ICS does similar things but it is quite ugly
- turns the PC on which ICS is configured (the "ICS Host") into a DHCP + DNS server
- requires all connecting clients to use this DHCP server
When used in combination with OpenVPN this can give unexpected issue:
* does not scale very well
* would require a 'tap' based setup, if it can be made to work at all.
^^^^^

Post-XP, 'netsh routing' unavailable. Using 'netsh add helper' on ipmontr, ipprommon, ipv6mon, ipxmontr dll's from xp no joy. (For all I know, 'netsh routing' available in win 7 pro.)

I expect one wants to stay away from ICS, runs a DHCP server, requires 192.168.0 (?).0/24 - likely messing up what you already have working.

Other solutions welcome.

... well ... a linux vm (pfsense?) would work, and dynamips gcs cisco router emulator. All of which starts to seem over the top.

bs27975-1

Looks like 'socat tcp-listen:{local port},fork tcp:{remote ip}:{remote port}' is useful if you only have one or a few ports you want to get to beyond the client. In my case, just port 80 of a remote IP cam.