Firstly, let me apologize in advance for everything i might have done incorrectly within this shout for help (wrong subject, wrong subforum, missing info...)
Ill try to go by the rules as much as i can.
So, im really new to OpenVPN (and VPN in general).
What im trying to achieve is a network of machines, where each machine is an OpenVPN Server and OpenVPN Client of
EVERY other Server.
Im using Cloud Service Providers for the machines instances, and connect to those machines via SSH.
Standalone client (Vagrant VM)
Ubuntu 14.04. LTS => OpenVPN 2.3.2
Cloud Machines
Ubuntu 16.04 LTS => OpenVPN 2.3.10
Forwarding enabled
sed -i "s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/" /etc/sysctl.conf
IPs are set in the following manner (
x is unique for every OpenVPN Server) :
Networks:
50.x.0.0/16
Gateways:
50.x.0.1
Clients start from:
50.x.10.1
Heres the simplest network im trying to achieve
SERVER 1
Server Config
mode server
dev tun
tls-server
port 1194
keepalive 10 120
proto udp
ca ca.crt
cert test10.crt
key test10.key
dh dh2048.pem
topology subnet
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.8.8"
push "topology subnet"
client-to-client
tls-auth ta.key 0
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
verb 4
client-config-dir /var/www/client-configs/ccd
ifconfig 50.10.0.1 255.255.0.0
route-gateway 50.10.0.1 255.255.0.0
push "route-gateway 50.10.0.1"
route 50.10.0.0 255.255.0.0
route 50.11.0.0 255.255.0.0
push "route 50.10.0.0 255.255.0.0"
push "route 50.11.0.0 255.255.0.0"
status /var/www/openvpnlogs/Status-test10.log
log /var/www/openvpnlogs/Server-test10.log
Client Config
client
dev tun
proto udp
remote $SERVER2_IP 1194
remote-cert-tls server
resolv-retry infinite
nobind
user nobody
group nogroup
daemon
persist-key
persist-tun
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 4
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
log /var/www/openvpnlogs/Client-test20.log
<ca>
#Server2 ca.crt
</ca>
<cert>
#Server1 client cert generated by Server2
</cert>
<key>
#Server1 client key generated by Server2
</key>
<tls-auth>
#Server2 ta.key
</tls-auth>
SERVER 2
Server Config
mode server
dev tun
tls-server
port 1194
keepalive 10 120
proto udp
ca ca.crt
cert test20.crt
key test20.key
dh dh2048.pem
topology subnet
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.8.8"
push "topology subnet"
client-to-client
tls-auth ta.key 0
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
verb 4
client-config-dir /var/www/client-configs/ccd
ifconfig 50.11.0.1 255.255.0.0
route-gateway 50.11.0.1
route 50.11.0.0 255.255.0.0
route 50.10.0.0 255.255.0.0
push "route-gateway 50.11.0.1"
push "route 50.11.0.0 255.255.0.0"
push "route 50.10.0.0 255.255.0.0"
status /var/www/openvpnlogs/Status-test20.log
log /var/www/openvpnlogs/Server-test20.log
Client Config
client
dev tun
proto udp
remote $SERVER1_IP 1194
remote-cert-tls server
resolv-retry infinite
nobind
user nobody
group nogroup
daemon
persist-key
persist-tun
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 4
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
log /var/www/openvpnlogs/Client-test10.log
<ca>
#Server1 ca.crt
</ca>
<cert>
#Server2 client cert generated by Server1
</cert>
<key>
#Server2 client key generated by Server1
</key>
<tls-auth>
#Server1 ta.key
</tls-auth>
STANDALONE CLIENT
Config (Both servers)
client
dev tun
proto udp
remote $SERVER_IP 1194
remote-cert-tls server
resolv-retry infinite
nobind
user nobody
group nogroup
daemon
persist-key
persist-tun
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 4
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
log /var/www/client-configs/$SERVER_NAME.log
<ca>
#ca.crt
</ca>
<cert>
#$CLIENT.cert
</cert>
<key>
#$CLIENT.key
</key>
<tls-auth>
#ta.key
</tls-auth>
OpenVPN service is running OK.
I can connect to each of the servers as a 'standalone' client individually (machine that doesnt have OpenVPN Server set on it and its Vagrant VM in this case (cause of practicality)).
The problems are following:
- I cannot connect to both of servers at the same time from Standalone Machine
- On the machine which already has server running and has Standalone Client connected, in the moment I run
openvpn --config $CLIENT_CONFIG.ovpn
to connect it as client to another machine, it cuts all connections to the standalone client from itself and locks all outside connections to itself.
Then i have to go to Providers site to reboot the machine to be able access it again.
I also disabled ufw but its the same.
I will add logs after you tell me which ones you want to see, there are more of those so i didnt want to add them all.
Pls help, im fighting this for a week now, going more than slightly mad. 🙁
