Hi, I tried searching, I promise.. I always try figuring it out with the help of Searches, but I'm stuck. 3+ days into it, and I've got my logic all twisted around :( [b]Background[/b]: Client wants a (seemingly simple) VPN solution to connect his main-office(site A) to his satellite-office(site B)(in same city) I am networking familiar. Understand WANs and LANs. [b]Never attempted[/b] OpenVPN. Purchased 2 ASUS RT-N66 routers for both sites, flashed Tomato 1.28 by Shibby VPN on each. Both have their respective WANs passed through. site A has 1 desktop (office) Windows 8.1 - Network 10.1.10.0 - Mask 255.255.255.0 site B has 1 desktop (satellite) Windows 7 Pro - Network 192.168.2.0 - Mask 255.255.255.0 all that's required is for desktop-a to connect to desktop-b, and desktop-b to connect to desktop-a (what I understand as Client to Client) Both sites have dynamic IP addresses. I've configured DDNS through dyn.com and that part seems to be working/updating for both sites. Time is set on each router ________________________ What I've done: installed OpenVPN 2.3.10 on both PCs with easy-rsa utility generated keys, i.e. init-config, vars, clean-all, and the builds(ca, client, server and dh) on/via both PCs ________________________ This is where following multiple guides has gotten my logic screwed up, and I'm hoping an explanation can get me back in the right direction... [i]Site A[/i] has a Tomato Router and desktop (office) I config'd a common name of [b]office[/b] for desktop client and [b]server[/b] for the tomato router [i]Site B[/i] has a Tomato Router and desktop (satellite) I config'd a common name of [b]satellite[/b] for desktop client and [b]server[/b] for the tomato router In [b]each tomato router[/b]: I have (under [b]VPN Tunneling:Server[/b]-Basic), Started with WAN, Interface TUN, Protocol UDP, Port 1194, Firewall Automatic, Authorization TLS, Extra HMAC disabled, VPN subnet 10.8.0.0 and mask 255.255.255.0 Site A(under [b]VPN Tunneling:Server[/b]-Advanced) I have Client to Client checked, and put in details: cn=satellite, 192.168.2.0, 255.255.255.0, push=checked Site B(under [b]VPN Tunneling:Server[/b]-Advanced) I have Client to Client checked, and put in details: cn=office, 10.1.10.0, 255.255.255.0, push=checked Site A(under [b]VPN Tunneling:Server[/b]-Keys) I put the ca.crt, server.crt, server.key and dh1024.pem I generated from Site A desktop (office) Site B(under [b]VPN Tunneling:Server[/b]-Keys) I put the ca.crt, server.crt, server.key and dh1024.pem I generated from Site B desktop (satellite) Site A(under [b]VPN Tunneling:Client[/b]-Basic) Started with WAN, Interface TUN, Protocol UDP, Server/Address Port XXsatellite.dynalias.com 1194, Firewall Auto, Auth TLS, Extra HMAC disabled, Create NAT unchecked Site B(under [b]VPN Tunneling:Client[/b]-Basic) Started with WAN, Interface TUN, Protocol UDP, Server/Address Port XXoffice.dynalias.com 1194, Firewall Auto, Auth TLS, Extra HMAC disabled, Create NAT unchecked Site A(under [b]VPN Tunneling:Client[/b]-Keys) I opened, copied, pasted the keys for the respective fields with notepad for [b]satellite[/b] client Site B(under [b]VPN Tunneling:Client[/b]-Keys) I opened, copied, pasted the keys for the respective fields with notepad for [b]office[/b] client _____________________ Now, to the OpenVPNGUI.exe running on each client (office, and satellite) I used the sample client.ovpn file and set: ca.crt, office(or satellite).crt, office(or satellite).key paths to the same folder i.e. config I set the remote path of Site A's client(office) as XXsatellite.dynalias.com I set the remote path of Site B's client(satellite) as XXoffice.dynalias.com I tried to keep the other settings as default(simplistic) as I could, based on what I've researched/read after struggling and driving back and forth, I set Windows Firewall Inbound/Outbound rules to allow UDP 1194, and then Port forward on each router for: On UDP 1194 in, 1194 out, to (static private IP of office and satellite desktop PC respective to each router) _____________________ It's not working, and I'm offsite now and cannot post any pertinent log files, but I'm afraid I've got some fundamental things wrong. Here are some questions I have that I can't figure out: Do I have the client keys mixed up on each Tomato router? Do I even need to set those there(within VPN Tunneling option of Tomato router)? If not, how else does Router A(openvpn server) know to connect to Router B(other openvpn server)? Do I have the remote set wrong in each client.ovpn file? It makes sense to me that site A remote should be Site B and vice versa Does server.ovpn(and server keys) need to be in the config folder(with client.ovpn)? Or does it not matter if/since keys are put into Tomato Web Gui? Does TAP/TUN matter when using DDNS? looking for reliability not security? There might be more I'm missing, I'm doing this all from memory as I asked to setup Remote login to both PCs(networks) in question and was forbade. I believe in ethics, so I'm respecting their wishes, but I really need help, and 3+days in I'm getting desperate. Thanks in advance..

Windows + Tomato - Client 2 Client logic = help please

jsmithwesley

Hi, I tried searching, I promise.. I always try figuring it out with the help of Searches, but I'm stuck. 3+ days into it, and I've got my logic all twisted around 🙁

Background: Client wants a (seemingly simple) VPN solution to connect his main-office(site A) to his satellite-office(site B)(in same city)

I am networking familiar. Understand WANs and LANs. Never attempted OpenVPN. Purchased 2 ASUS RT-N66 routers for both sites, flashed Tomato 1.28 by Shibby VPN on each. Both have their respective WANs passed through.

site A has 1 desktop (office) Windows 8.1 - Network 10.1.10.0 - Mask 255.255.255.0
site B has 1 desktop (satellite) Windows 7 Pro - Network 192.168.2.0 - Mask 255.255.255.0
all that's required is for desktop-a to connect to desktop-b, and desktop-b to connect to desktop-a (what I understand as Client to Client)

Both sites have dynamic IP addresses. I've configured DDNS through dyn.com and that part seems to be working/updating for both sites.
Time is set on each router
________________________
What I've done:
installed OpenVPN 2.3.10 on both PCs
with easy-rsa utility generated keys, i.e. init-config, vars, clean-all, and the builds(ca, client, server and dh) on/via both PCs
________________________

This is where following multiple guides has gotten my logic screwed up, and I'm hoping an explanation can get me back in the right direction...

Site A has a Tomato Router and desktop (office)
I config'd a common name of office for desktop client and server for the tomato router
Site B has a Tomato Router and desktop (satellite)
I config'd a common name of satellite for desktop client and server for the tomato router

In each tomato router:
I have (under VPN Tunneling:Server-Basic), Started with WAN, Interface TUN, Protocol UDP, Port 1194, Firewall Automatic, Authorization TLS, Extra HMAC disabled, VPN subnet 10.8.0.0 and mask 255.255.255.0

Site A(under VPN Tunneling:Server-Advanced) I have Client to Client checked, and put in details:
cn=satellite, 192.168.2.0, 255.255.255.0, push=checked
Site B(under VPN Tunneling:Server-Advanced) I have Client to Client checked, and put in details:
cn=office, 10.1.10.0, 255.255.255.0, push=checked

Site A(under VPN Tunneling:Server-Keys) I put the ca.crt, server.crt, server.key and dh1024.pem I generated from Site A desktop (office)
Site B(under VPN Tunneling:Server-Keys) I put the ca.crt, server.crt, server.key and dh1024.pem I generated from Site B desktop (satellite)

Site A(under VPN Tunneling:Client-Basic) Started with WAN, Interface TUN, Protocol UDP, Server/Address Port XXsatellite.dynalias.com 1194, Firewall Auto, Auth TLS, Extra HMAC disabled, Create NAT unchecked
Site B(under VPN Tunneling:Client-Basic) Started with WAN, Interface TUN, Protocol UDP, Server/Address Port XXoffice.dynalias.com 1194, Firewall Auto, Auth TLS, Extra HMAC disabled, Create NAT unchecked

Site A(under VPN Tunneling:Client-Keys) I opened, copied, pasted the keys for the respective fields with notepad for satellite client
Site B(under VPN Tunneling:Client-Keys) I opened, copied, pasted the keys for the respective fields with notepad for office client
_____________________

Now, to the OpenVPNGUI.exe running on each client (office, and satellite)
I used the sample client.ovpn file and set: ca.crt, office(or satellite).crt, office(or satellite).key paths to the same folder i.e. config
I set the remote path of Site A's client(office) as XXsatellite.dynalias.com
I set the remote path of Site B's client(satellite) as XXoffice.dynalias.com
I tried to keep the other settings as default(simplistic) as I could, based on what I've researched/read
after struggling and driving back and forth, I set Windows Firewall Inbound/Outbound rules to allow UDP 1194, and then Port forward on each router for: On UDP 1194 in, 1194 out, to (static private IP of office and satellite desktop PC respective to each router)

_____________________

It's not working, and I'm offsite now and cannot post any pertinent log files, but I'm afraid I've got some fundamental things wrong.
Here are some questions I have that I can't figure out:

Do I have the client keys mixed up on each Tomato router? Do I even need to set those there(within VPN Tunneling option of Tomato router)? If not, how else does Router A(openvpn server) know to connect to Router B(other openvpn server)?

Do I have the remote set wrong in each client.ovpn file? It makes sense to me that site A remote should be Site B and vice versa

Does server.ovpn(and server keys) need to be in the config folder(with client.ovpn)? Or does it not matter if/since keys are put into Tomato Web Gui?

Does TAP/TUN matter when using DDNS? looking for reliability not security?

There might be more I'm missing, I'm doing this all from memory as I asked to setup Remote login to both PCs(networks) in question and was forbade. I believe in ethics, so I'm respecting their wishes, but I really need help, and 3+days in I'm getting desperate.
Thanks in advance..