Connecting a clone server to the domain via VPN

whitenack

Hi all. First post (take it easy on me)!

First a little background:
We are a small business with a server and a few workstations. The server holds our files and databases, and is set up as a domain. We recently upgraded our server and actually bought two identical servers and want to locate the 2nd offsite as a spare for disaster recovery. We set the servers up identically and synced the drives via DFS. While they were sitting side by side, things worked great. We have now taken the 2nd server offsite and are attempting to set up OpenVPN to connect the two servers once again.

My first attempt at OpenVPN was to set things up from scratch, using some guides I have found on the internet and here at OpenVPN. Unfortunately, it was all way over my head and I couldn't figure out what config settings to use to make the connection. I tried using an old router with Tomato firmware, I tried loading the server software on Server#1, etc. After about 3 straight days of trying, I gave up. My personal router at home was an Asus RT-AC66U, and I saw that it has OpenVPN functionality baked in, so I brought that router to our office and set up the server that way. I was really impressed with how easy I was able to get the servers connected using the Asus instructions.

TL;DR:
I now have both servers connected to the same network. Both servers can ping each other, but for some reason the servers don't recognize that they are on the same network. I'm not sure if it is due to the settings I have configured or if it is some other issue on how I have my network set up. Any help would be appreciated. See below for the settings I have created on the Asus router. Initially, I had set it up as a TUN connection, since everyone recommends that type. However, that was putting Server#2 on a different network from the domain, and I thought that might be the problem. It makes sense to me that the servers need to be on the same network. I can share the client config file that these settings generated, but it will require some work to edit it into a readable format.

Traffic

If it is only the two servers being connected that you need I would recommend you take the router out of the equation and run OpenVPN on both your servers .. that way they will be on the same network, typically: dev tun (OSI Layer 3 - Routing) network 10.8.0.0/24

whitenack

Thanks for the reply.

I hope to be able to connect some mobile workstations to the server as well. However, that isn't as important as getting these servers synced, so if that has to be sacrificed, then so be it. However, I do not look forward to trying to config the server and client files from scratch again. I worked for several days straight and couldn't even make a connection.

I made a few tweaks to the settings yesterday and the servers are now seeing each other, and I can connect to the mapped drives, but the DFS syncing isn't taking place. On Server #1, the Server Management screen shows the two servers as active, and shows the IP address of Server #2. The DFS Management screen shows the two servers are connected and the syncing is taking place. Server #2's Server Management screen says Server #1 has a "kerberos target resolution error", and the DFS Management screen shows the connection cannot be made.

whitenack

Thanks for the reply, Traffic. I tried several different settings and couldn't get anything to work. I finally gave up and tried the built-in Windows VPN service and it worked right away. I'd still like to get OpenVPN to work, since I feel that would be more secure, but I have to go with what works.

I have another use for OpenVPN, and currently have things setup and can connect to the server, but a particular program runs terribly slow. I need help diagnosing the bottleneck, but I'll post in a new thread. Thanks again!

Traffic

Your main goal is to have a VPN connection between your two servers so just focus on that. I would setup the remote machine as the VPN client and the local as the server.
Simply follow the HOWTO and use the sample configs.

Put the two servers next to each other until you have a working VPN then move your client off site. On your server router/firewall you must enable a port-forward so the client can connect to the server.