VPN like pptp

kubco2

Hello,

we have pptp vpn server configuration as below:
server 172.10.10.1 - must be accessible
clients 172.11.11.1,2,3,4,5-200, for example client1 have inet addr:172.11.11.1 P-t-P:172.10.10.1 Mask:255.255.255.255
We need to use full range.

I spent few hours with opnvpn configuration, but I cant get desired config.

We need support Windows clients. I prefer tun because I dont want l2 mess.

Thanks for help.

Jakub

kubco2

GOAL:
We need replace pptp vpn server and keep IP addresses. So every client can ping server 172.10.10.1 and server can ping clients 172.11.11.0/24(full range of ip addresses for clients). We want tun.
Actual config server:

ifconfig-pool 172.11.11.1 172.11.11.10
ifconfig 172.10.10.1 172.10.10.2
topology p2p
push "topology p2p"
mode server
tls-server
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert server.crt
key server.key
tls-auth ta.key 0
cipher AES-256-CBC
auth SHA512
verb 3
mute 20
keepalive 10 20
comp-lzo
persist-key
persist-tun
script-security 3
client-cert-not-required
auth-user-pass-verify ./script.sh via-env
client-config-dir ccd
username-as-common-name

client:

client
proto udp
dev tun
remote 192.168.18.1 1194
cipher AES-256-CBC
auth SHA512
auth-user-pass
ca ca.crt
tls-auth ta.key 1
comp-lzo

I didnt test if p2p will work on windows if I set up some special IP to ccd for windows client, because I cant figure out how to properly set this config in linux enviroment on both sides.

kubco2

I read this, and this is whole problem, how to achieve my goal. So because of windows clients cannot be configured with extra ccd to support this mode, I set up subnet network.

ifconfig-pool 172.11.11.1 172.11.11.10
push "topology subnet"
push "route-gateway 172.10.10.1"
push "route 172.10.10.0 255.255.255.0"

topology subnet
ifconfig 172.10.10.1 255.255.255.0
mode server
tls-server
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert server.crt
key server.key
tls-auth ta.key 0
cipher AES-256-CBC
auth SHA512
verb 3
mute 20
keepalive 10 20
comp-lzo
persist-key
persist-tun

script-security 3
client-cert-not-required
auth-user-pass-verify ./script.sh via-env
client-config-dir ccd
username-as-common-name

Client stays same.

server directive is not my option becase it assign server ip 172.11.11.1 and it is client ip.

I think route-gateway should be from client subnet, but there have to be only clients. Second route cannot be set because of unreachable gateway:

Sat Aug  9 16:43:40 2014 us=533146 /usr/bin/ip route add 10.8.0.0/24 via 10.8.0.1
RTNETLINK answers: Network is unreachable

I know this is probably bad config and that is reason why I tried to ask here if is possible to configure it like I wrote, or I spent a lot of hours with trying to set up impossible config..

Edit: for now I see only solution to replace netmask with some extra large like 255.254.0.0 to include server IP in subnet 10.10.0.1 - 10.11.255.254, but it is not nice.

kubco2

I forgot to add, that we are using some /24 subnets from 10.10.0.1 - 10.11.255.254, so we cannot use this option.

kubco2

Did you read whole thread?

We need set up things like we have in pptp server. So server IP is 10.10.10.1 and clients are another subnet, IP=ID if ID=1 => IP=1 so 10.11.11.1 is client1 ip

CCD is empty for now, in future there will be static IPs.

Traffic wroteWhy are you adding 10.8 network routing ?

Sorry for another route subnet, I changed IP addressses in thread and I forgot to edit log output. But things are right.

Traffic wroteYour VPN is 172.11.11.0 (Which is not RFC compliant)

Same answer. IPs in thread are not our real.

Traffic wroteWhy not read the documentation for OpenVPN and try to setup a simple VPN to start with .. and then build on that.

I have done more openvpn deplyments(tun and tap), but none of them had these requierements, and therefore I ask here, because I tried a lot of things and none works, so some of experts maybe help .

Traffic wroteWhich really makes no difference .. just use a different subnet for your VPN

No. Problem what I wrote exists in our real network.

Thanks.

kubco2

OK now I totally messing up IPs.

kubco2 wroteWe need set up things like we have in pptp server. So server IP is 10.10.10.1 and clients are another subnet, IP=ID if ID=1 => IP=1 so 10.11.11.1 is client1 ip

Right is: 172.10.10.1 and 172.11.11.1

These IPs is not our real IPs so no RFC problem.

Corrected error should be:

Sat Aug  9 16:43:40 2014 us=533146 /usr/bin/ip route add 172.10.10.0/24 via 172.10.10.1
RTNETLINK answers: Network is unreachable

I know that 172.10.10.1 is unreachable, but I dont know how and if is possible something like "route add 172.10.10.1 via dev tun" in openvpn.. Or how to make it work? In pptp server I have localip 172.11.11.1 and remoteip 172.10.10.1 and all are happy.

kubco2

Not very nice workaround can be to set always last possible IP in subnet to server and everytime when we enlarge subnet we shift server, and create virtual interface with desired IP on server and push route. . Bad, then we must adapt and maintain additional network settings on server 🙁 .