Access the same network behind multiple clients

dotmax

First of all, good day to everyone!
This is my very first post on this forum, I hope that it complies to the forum rules.

I try to search in the forum, but for the search engine "Access same network behind multiple clients" are too common words (my english does not allow me more precise definitions of the problem....).

I need to know if it is possible to access the same network behind multiple openvpn remote clients.
I understand that it seems a silly question, but let me explain the backgrounds.
My customer need to setup a vpn between a central site and multiple remote sites.
Each remote site must expose a local network, because we need ip connection to some industrial appliances installed on the remote newtork (PLC's, HMI panels, ect...)
Our support operator also must connect via vpn to the central site
So we have a scenario like this:

It seems pretty simple and straightforward.
Each remote site must have its own subnet, and there is a simple routing between clients..

But here is the point.
The customer asks me to have the same network behind each remote node. so each "device 1" must be 192.168.1.5 in every plant.

I think this is not possible (it is a nonsense in a routing scenario...).

But this customer has showed me a commercial solution (that it seems based on openvpn...) that work in this way.
Now the question is: can open vpn work in this way or the result is achieved via external software/settings/components ????

Thanks in advance to all

Massimo.

maikcat

first,

all the plants will be connected concurrently?

second,

if yes ,when the operator wants to access 192.168.1.5 , which device & from which plant will respond?

Michael.

dotmax

Yes, all the plants shoud be connected. The support operator should be able to choose to wich plant connect.

Thanks

dotmax

maikcat wrotefirst,

all the plants will be connected concurrently?

Yes, the connection is opened from the remote side toward central site. We need to keep all the plants connected.

maikcat wrotesecond,

if yes ,when the operator wants to access 192.168.1.5 , which device & from which plant will respond?

Michael.

The support operator shoud be able to chose (i don't know exactly how) to which plant connect to.

Thanks
Massimo.

maikcat

The support operator shoud be able to chose (i don't know exactly how) to which plant connect to.

this is the key info...

you MUST learn how the operator selects a remote point.

i believe there is NAT somewhere in the scenario.... :mrgreen:

Michael.

dotmax

At the moment i don't have the access to the other system.
I remember that it was a virtualbox appliance with a web based interface.
There is a user autentication, and after a combobox (or a treeview? i don't remember exactly) with the selection of the plant.

Anyway, is this kind of configuration possible? (maybe with the switch/modify of server side config files?)

Thanks.

Massimo

Traffic

dotmax wroteSo we have a scenario like this:
Image

So how does the operator specify which device to connect to ?

For example:

Operater specifies device-1 .. does the operator specify Plant-1😃evice-1 ?

dotmax wroteThe customer asks me to have the same network behind each remote node. so each "device 1" must be 192.168.1.5 in every plant

As the plant# will be the VPN Client, each will have it's own IP on the VPN, regardless of the network behind it. But in order to route to the LAN behind each client the server must have unique internal routes --iroute for each client LAN.

If you add plant.client1:iroute 192.168.0.0/24 and then plant.client2:iroute 192.168.0.0 how will the server know which one to chose ?

The OpenVPN server must have unique (internal and normal) routes to each client LAN but, as Michael said:

maikcat wrotei believe there is NAT somewhere in the scenario.... :mrgreen:

dotmax wroteNow the question is: can open vpn work in this way or the result is achieved via external software/settings/components ????

I think you could try --client-nat snat/dnat on the VPN .. or, you could try nat on the plant.client operating system.

dotmax

Thanks for the suggestion.
I will investigate a little deeper in the other system, an post here any update.

best regards
Massimo