OpenVPN Server/Ubuntu Connecting Router as "Site/Client"

deviat

Hoping someone can help me out. I've configured an OpenVPN server on a Ubuntu 14.04 LTS VM, and followed the guide below to configure the server and setup my certificates. I've created client certs/ca/key but when loaded onto my router (Cradlepoint IBR1100) I get an error

Wed Sep 30th 20:23:50
openvpn[5315]
ERROR
Options error: No client-side authentication method is specified. You must use either --cert/--key, --pkcs12, or --auth-user-pass
Wed Sep 30th 20:23:42
openvpn[5313]
WARNING
Use --help for more information.
Wed Sep 30th 20:23:42
openvpn[5313]
ERROR
Options error: No client-side authentication method is specified. You must use either --cert/--key, --pkcs12, or --auth-user-pass

Now is it safe to say that my transferred CA and Key is not configured or loaded correctly? Essentially I want to have this Router (MBR1400) route all traffic from connected devices over the OpenVPN tunnel and route accordingly through the server. Am I going about this wrong? Should I build the certs locally on the device and then import them into the server? Or should I be able to use the OpenVPN Server certs/key's that I created on the box and go that route?

I am quite new to this, so please any help would be appreciated!

Traffic

Please post your server and client config files.

deviat

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/deviat-lat.crt
key /etc/openvpn/deviat-lat.key
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.10.0 255.255.255.0"
keepalive 10 120
cipher BF-CBC
comp-lzo (? necessary, should I disable if I cannot define on the Cradlepoint router?)
persist-key
persist-tun
log-append  openvpn.log
verb 4

This is cleaned up, I bypassed all the "fluff/comments"

As for the Router, the only definable configurations would be pointing to the OpenVPN Server while defining the following:


Tunnel Name
Mode: Site-to-Site / Bridged / Routed
Local Endpoint (Router):
Remote Endpoint (Server):
Tunnel Protocol: UDP/TCP
Port: 1194
Ping: 10
Ping Restart: 60
Cipher: BF-CBC
Auth Algorithm: SHA1
Remote Servers: (Server Public IP / Port)
Routes: 192.168.20.0/24

deviat

Essentially this is what I'm looking to accomplish.

Basically connect the routers to pass all traffic from ANY connected devices through the Main Firewall. I am hitting a wall where the Cradlepoint will not establish a tunnel to the OpenVPN Server running on the Ubuntu box.

Traffic

deviat wroteShould I build the certs locally on the device and then import them into the server? Or should I be able to use the OpenVPN Server certs/key's that I created on the box

I recommend you use the Ubuntu Server to generate the full PKI using easy-rsa.

Sorry, I can not help with your MBR1400 router.

deviat

I understand about the router portion, its not OpenVPN, but does the server support site-to-site? I have found documentation on Site to Site for two OpenVPN servers, but nothing in the realm of Central Server and a 2nd node for connecting more clients.

Traffic

Site-to-Site: Essentially, you need to implement this setup:
HOWTO: Expanding the scope of the VPN to include additional machines

I do not know how you would implement forcing all client side data over the VPN using your routers but this may help:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

Alternatively, you can simply run OpenVPN client on all of your desired clients, ie. Every client side seat not just the routers.

I recommend giving the entire HOWTO a read .. also the manual.

Remember, steer clear of using common subnets like 192.168.0.0/24 and 192.168.1.0/24 etc.

You are welcome to ask questions but try to be specific.

deviat

Absolutely, in production these subnets will not be used, only in this lab.

I appreciate the links, will give those a read, and report anything back as I work through it this weekend.

Appreciate it!

deviat

Quick question, so I am still wrapping my head around this, I've come across the following document: https://openvpn.net/index.php/access-server/section-faq-openvpn-as/server-configuration/209-how-do-i-setup-openvpn-access-server-to-use-site-to-site.html

Now at the bottom it states the following:
· Now in order to get a tunnel established between AS1 and AS2 we will need to setup a gateway client on one of the LAN'S for either AS1 or AS2.
· By setting up the gateway client it will connect to a remote access server (AS1) and push the routes from the access server(AS1) to the LAN(AS2) and push its LAN's(AS2) routes to the remote Access Server(AS1).
· If you want an access server on the LAN(AS2) of the gateway client to connect to the remote access server(AS1) you will need to make sure your explicitly state in the User Permissions area of the user that the gateway client connects to the access server(AS1) to push the route of the private subnet of the access server(AS2).

so with the above statement, does that mean I need to have a client connected behind each server, pointing at the opposite server it is connected to physically?

Or is the Gateway another configuration on the servers? I've updated my drawing. Correct me if I am not understanding any point of this, but in the OpenVPN server configuration, what would the routers look like to the OpenVPN server, a client? a server? other, unsupported node?

virtualoperator

Good day

I am running in the same type of problem with an Cradlepoint IBR1100

Did you come up with a resolution to this issue

Cheers

Marc