long time occasional lurker, first time poster on this forum.
I was time to setup my VPN again as I'd reinstalled the OS on my server I had previously had my mikrotik router on my VPN to allow access to all devices on my home LAN (IPMI, RAID management web GUI) and my server/s. So I still remembered how to set it up from last time only problem was (mikrotik routers) can only connect to tcp servers and my server was obviously running to UDP at the time I still wanted UDP as well as TCP because i was intending to use the UDP VPN to play a region restricted game thus wanting/needing any extra improvement/s that I could get. I finished up with a config that appears quite chainable allowing multiple VPNs in subnet mode to be replicated and communicate to each other relatively easy
udp.conf
dev tun0
proto udp
port 1194
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/openvpn.crt
key /etc/openvpn/keys/openvpn.key
dh /etc/openvpn/keys/dh2048.pem
user nobody
group nogroup
topology subnet
server 10.0.1.0 255.255.255.0
local 1.2.3.4
persist-key
persist-tun
cipher AES-256-CBC
push "route 202.221.244.21 255.255.255.255"
push "route 202.221.244.3 255.255.255.255"
push "route 10.0.2.0 255.255.255.0"
status /etc/openvpn/udp/status.log
log /etc/openvpn/udp/openvpn.log
ifconfig-pool-persist /etc/openvpn/udp/ipp.txt
client-config-dir /etc/openvpn/udp/ccd
keepalive 10 120
verb 3
tcp.conf
dev tun1
proto tcp
port 1194
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/openvpn.crt
key /etc/openvpn/keys/openvpn.key
dh /etc/openvpn/keys/dh2048.pem
user nobody
group nogroup
topology subnet
server 10.0.2.0 255.255.255.0
local 1.2.3.4
persist-key
persist-tun
cipher AES-256-CBC
push "route 202.221.244.21 255.255.255.255"
push "route 202.221.244.3 255.255.255.255"
push "route 10.0.1.0 255.255.255.0"
status /etc/openvpn/tcp/status.log
log /etc/openvpn/tcp/openvpn.log
ifconfig-pool-persist /etc/openvpn/tcp/ipp.txt
client-config-dir /etc/openvpn/tcp/ccd
keepalive 10 120
verb 3
Separate log, status, static ip pool and client config directory were used based on the config file name (TCP, UDP)
root@ubuntu:~# ls -al /etc/openvpn/*
-rwxr-xr-x 1 nobody nogroup 596 Jan 21 03:59 /etc/openvpn/tcp.conf
-rwxr-xr-x 1 nobody nogroup 596 Jan 21 03:58 /etc/openvpn/udp.conf
-rwxr-xr-x 1 nobody nogroup 1301 Jul 8 2015 /etc/openvpn/update-resolv-conf
/etc/openvpn/keys:
total 8
drwxr-xr-x 2 nobody nogroup 4096 Jan 14 04:10 .
drwxr-xr-x 5 nobody nogroup 4096 Jan 21 02:46 ..
lrwxrwxrwx 1 nobody nogroup 36 Jan 14 04:08 ca.crt -> /root/easy-rsa-2.0rc1SAN/keys/ca.crt
lrwxrwxrwx 1 nobody nogroup 40 Jan 14 04:10 dh2048.pem -> /root/easy-rsa-2.0rc1SAN/keys/dh2048.pem
lrwxrwxrwx 1 nobody nogroup 42 Jan 14 04:09 openvpn.crt -> /root/easy-rsa-2.0rc1SAN/keys/openvpn.crt
lrwxrwxrwx 1 nobody nogroup 42 Jan 14 04:09 openvpn.key -> /root/easy-rsa-2.0rc1SAN/keys/openvpn.key
/etc/openvpn/tcp:
total 216
drwxr-xr-x 3 nobody nogroup 4096 Jan 21 02:48 .
drwxr-xr-x 5 nobody nogroup 4096 Jan 21 02:46 ..
drwxr-xr-x 2 nobody nogroup 4096 Jan 21 02:45 ccd
-rwxr-xr-x 1 nobody nogroup 21 Jan 21 04:02 ipp.txt
-rwxr-xr-x 1 nobody nogroup 193798 Jan 21 04:05 openvpn.log
-rwxr-xr-x 1 nobody nogroup 369 Jan 21 04:05 status.log
/etc/openvpn/udp:
total 252
drwxr-xr-x 3 nobody nogroup 4096 Jan 21 02:48 .
drwxr-xr-x 5 nobody nogroup 4096 Jan 21 02:46 ..
drwxr-xr-x 2 nobody nogroup 4096 Jan 21 02:46 ccd
-rwxr-xr-x 1 nobody nogroup 26 Jan 21 04:02 ipp.txt
-rwxr-xr-x 1 nobody nogroup 235376 Jan 21 04:05 openvpn.log
-rwxr-xr-x 1 nobody nogroup 380 Jan 21 04:05 status.log
I used easy-rsa-SAN which was used to generate a site wide certificate with multiple subjectaltname fields from the command line instead of certificates with no subjectaltname fields, shared the cert files between both instances no need to be paranoid when I'm the only was using it.
The options in both configs
push "route 202.221.244.21 255.255.255.255"
push "route 202.221.244.3 255.255.255.255"
Explicitly Specify that for those 2 IP addresses (any destination) are routed through the vpn gateway and the option
push "route 10.0.1.0 255.255.255.0"
push "route 10.0.2.0 255.255.255.0"
In either config make each network aware of the other as well as set routes up on the server. In either case an example would look like this from a windows client on the 10.0.1.0/24 network
C:\WINDOWS\system32>route -4 print
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
10.0.1.0 255.255.255.0 On-link 10.0.1.2 276
10.0.1.2 255.255.255.255 On-link 10.0.1.2 276
10.0.1.255 255.255.255.255 On-link 10.0.1.2 276
10.0.2.0 255.255.255.0 10.0.1.1 10.0.1.2 20
202.221.244.3 255.255.255.255 10.0.1.1 10.0.1.2 20
202.221.244.21 255.255.255.255 10.0.1.1 10.0.1.2 20
And routes on the server look like this
root@ubuntu:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 139.162.20.1 0.0.0.0 UG 0 0 0 eth0
10.0.1.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
1.2.3.4 0.0.0.0 255.255.255.0 U 0 0 0 eth0
I hope that I didn't miss anything or be overly detailed in the explanations and reasons why I went to all this trouble. Also Since mainly the routers I use connect to the TCP VPN I can setup firewall rules on the routers to only allow access from my IP on the VPN or other LAN sort of like a management IP/LAN setup.
The final goal for me was learn a little more and have my router setup at the shed at my parents house that I have on stand alone solar setup on and run my file storage machine 24/7 have access to my servers IPMI, SAS RAID web GUI allowing easy management while not at the shed
Hopefully informative and it helps someone out there
