interfuzzi81 Hi Everbody! Is it possible to connect to clients from different locations, but with the same net 172.16.1.0/27 to one server ? I think there will be issues in the routing ? My oVPN-Server: 10.27.6.0/23 Client1-Network: 172.16.1.0/27 Client2-Network: 172.16.1.0/27 Client3-Network: 172.16.1.0/27 LAN at oVPN-Server is 172.16.10.0/24 So it is no real Server setup, just in my brain .... Thanks for replies
sgillich Hi interfuzzi81 I would like to jump on that thread. I would like to do the same as Traffic but may be able to share more details to the scenario in my mind. General conditions 1) oVPN-Server (Linux based): 10.27.6.0/23 (vpn tunnel IPs, oVPN-Server uses 10.27.6.1, ip addresses are assigned dynamicly to oVPN-Clients) 2) LAN Client1-Network: 172.16.1.0/27 3) LAN Client2-Network: 172.16.1.0/27 4) LAN Client3-Network: 172.16.1.0/27 5) Client Network Connection are concurrent 6) No Client Network to Client Network communication 7) LAN oVPN-Server is 172.16.10.0/24 8) oVPN-Server is configured to use a single ip address and single port for VPN connections 9) oVPN-Client authentication is using certificates 10) oVPN-CLient certificates are using unique common names (e.g. "Client1-Network", "Client2-Network", "Client3-Network") 11) Remote Service Computers located in the oVPN-Server LAN are created dynamicly (cloned virtual machines) with ip address assigned using DHCP (e.g. 172.16.10.100...250) 12) Remote Service Computers are dedicated to single oVPN-Client Network connections Description of Scenario: Everytime a oVPN-Client connects to the oVPN-Server it authenticates using the certificate with unique common name (e.g. "Client1-Network"). After successful authentication the oVPN-Server provides a vpn tunnel IP to the oVPN-Client (e.g. 10.27.6.2). A process outside the oVPN scope creates and starts a Remote Service Computer with DHCP IP address assigment (e.g. 172.16.10.101). I could think about getting the Information from oVPN-Server about assigned vpn tunnel IPs based on certificate common name (is ther a way to get this Information?). Since I know the IP address of the Remote Service Computer and the relation to the certificates common name as well, I could think about configuring a policy based Routing in the oVPN-Server OS System. This policy based route depends on the Remote Service Computers IP address, oVPN-Client Network and oVPN tunnel ip (e.g. somethinmg like: ). If the source of the packet is 172.16.10.101 and the destination network is 172.16.1.0/27 route to 10.27.6.2 For the second connected oVPN-Client Netrork ist could than be like: If the source of the packet is 172.16.10.102 and the destination network is 172.16.1.0/27 route to 10.27.6.3 Could this be a working Scenario? If not, is there an other way to achieve the same System behavior?
Traffic sgillich wroteI would like to jump on that threadNo problem .. 8-) See --client-nat in The Manual v23x
sgillich Hi Traffic Thanks for your reply. I checked the reference you mentioned. However, this is not what I have been looking for. By default, OpenVPN is routing the data packages based on destination ip only. Data packages send from a client computer behind OpenVPN server are routet to tunnel ip of the OpenVPN client with the corresponding destination Network. Because of that, the connected OpenVPN clients have to have unique IP ranges on OpenVPN server side. To achieve that unique IPs, the information you referenced could be used. What I'm looking for is more or less a kind of policy based route. Configure OpenVPN Server to send all data packages recived from a specific IP address on Server side to a specific tunnel IP (belonging to an OpenVPN client).
