openVPN config question.

feisty

Hi,

First I want to thank you for this amazing software. 🙂 I am using it since 3th of January.

So, I 've setup the vpn, and its working without any issues, but I need to tweak my configuration, and I've spend last 30 hours in researching, but without success. Now intro of my infrastructure:

I have 5 servers connected to one managed switch, all of them using 1 C class network.
1 server has installed VPN software only, the rest 4 are hosting servers. I've routed through the VPN only the traffic to my servers, to the rest of the world, the traffic is not routed. My question is the following:

Those 4 hosting servers have KVM modules (IPMI) and I want to set them up using private IPs, so they could be access only through VPN, but I can't do this, because those KVM modules don't have openvpn client, so, would you please let me know how to finish this job, because, I cant find any tutorials or info about that, but I want to secure those IPMI web access.

Your help will be highly appreciated.

Regards

maikcat

you CAN route the networks behind your clients.

post your configs use and we will help you out.

Michael.

feisty

hello,

sorry, I forgot to post my config:

here they are:

Server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
tls-auth /etc/openvpn/ta.key 0
server 10.11.12.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "route xxx.xxx.xxx.xxx 255.255.255.255 net_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.255 vpn_gateway"
push "route xxx.xxx.xxx.xxx 255.255.255.0 vpn_gateway"
client-to-client
keepalive 10 60
client-config-dir ccd
cipher DES-EDE3-CBC # Triple-DES
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
log /var/log/openvpn.log
status /var/log/openvpn-status.log
verb 5
mute 20

* these xxx.xxx.xxx.xxx are few single IPs + 3 "C" class networks

clinet.ovpn:

client
remote AAA.AAA.AAA.AAA 1194
remote-cert-tls server
ca /root/vpn/ca.crt
cert /root/vpn/me.crt
key /root/vpn/me.key
cipher DES-EDE3-CBC
comp-lzo yes
dev tun
proto udp
tls-auth /root/vpn/ta.key 1
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user nobody
group nogroup

AAA.AAA.AAA.AAA is a real static IP address of vpn server

ccd client file:

ccd# cat me 
ifconfig-push 10.11.12.6 10.11.12.5

this is my default configuration, which VPN works like a charm, now, I have to access through it my IPMI devices which should have private IPs from the same subnet (10.11.12.xxx) or if its possible, they can use another subnet (10.11.20.xxx).

Thank you once again for you kind help.

maikcat

i want you please to clarify the following:

I have 5 servers connected to one managed switch, all of them using 1 C class network.
1 server has installed VPN software only, the rest 4 are hosting servers.

all 5 servers are in the SAME ip network?

Those 4 hosting servers have KVM modules (IPMI) and I want to set them up using private IPs, so they could be access only through VPN,

if your servers use public ips you can assign private ips to your modules and enable your openvpn server to allow
routing between your modules and openvpn clients.

a network diagram will also help...

Michael.

feisty

Hi 🙂

all 5 servers are in the SAME ip network?

this switch will be used with different networks and vlans, but, I will attach to it new switch to which I will add only kvm modules. the kvm modules will have private IPs

if your servers use public ips you can assign private ips to your modules and enable your openvpn server to allow
routing between your modules and openvpn clients.

My server using public IPs but for their eth adapters, not KVM.

So you mean that as per my server config file, I can set for my KVM module IP: 11.12.13.xxx (which gateway should I use?) then what?
sorry for my english and stupid questions, but I'd hacked kvm, and I am trying to accomplish this as soon as possible.

here is my terrible diagram (first time with gimp 🙂)

maikcat

if openvpn server has one interface connected to your kvm module switch
you can enable ip forwarding on it and push this network to your clients.

Michael.

feisty

Hello,

I've tried that but without success.

vpn give me ip 10.11.12.6 with gateway 10.11.12.5
I can ping the VPN gateway - 10.11.12.1
I/ve added IP 10.11.12.100 (as child IP eth0:0)to one server ,but I can't ping it
what should I do?

thank you

maikcat

I/ve added IP 10.11.12.100 (as child IP eth0:0)to one server ,but I can't ping it

you WILL use an alias on eth0 like you wrote (eth0:0) but it is need to be a
seperate NEW ip range

Michael.

feisty

I will setup this configuration which you suggested, and I will add private IPs like 192.168.10.0/24 to my KVM modules, and my vpn will still give the same network 10.11.12.0/24. then I'll push this network 192.168.100/24 to my vpn client and I hope this will work. I will share my results.

thank you 🙂

feisty

hello again, the things didn't happen as expected 🙁

I've made the suggested configuration, but I can't access my private network. Here is the setup:

KVM module :

192.168.33.11
gw: 192.168.33.5

ETH1 on vpn server :
192.168.33.5

KVM module and ETH1 from the vpn server are both connected to one unmanaged switch.

Routing pushed to my vpn client:
192.168.33.0 10.11.12.5 255.255.255.0 UG 20 0 0 tun0

as 10.11.12.5 is the gateway provided to my from the vpn private network.

what am I doing wrong, did you say to assign completely different network, didn't you?

Thank you.

maikcat

can you ping the kvm modules from your openvpn server?

for testing disable firewall on openvpn server

can you ping openvpn server tun interface from one kvm module?

can you post the change you made in your openvpn server config file.

Michael.

feisty

can you ping the kvm modules from your openvpn server?

yes

for testing disable firewall on openvpn server

I've stopped it, but nothing changed. Still I can't ping 192.168.33.11

can you ping openvpn server tun interface from one kvm module?

ipmi kvm module can't ping, but it has IP 192.168.33.11 but openvpn server tun0 device has IP 11.12.13.1

can you post the change you made in your openvpn server config file

this is the only thing I've added to the above server.conf:

push "route 192.168.33.0 255.255.255.0 vpn_gateway"

should I need to add more rules into the server config?

Thank you

feisty

should I add additional routings or iptables rules and if its yes, on which server - my or vpn

feisty

I've managed to make it work.

just changed tun to tap in the server and client configs.

Thank you.