I have set up an OpenVPN server on a Raspberry Pi3 for our office with two services running on ports 1198 and 1199.
1198 is a standard setup allowing for local LAN and Internet tunneling.
1199 is a split tunnel setup which only allows local LAN traffic but leaves Internet on the client's own gateway.
I am also using ccd for limiting access for certain logins.
This has served as a proof of concept and works very well.
Now I am setting up the permanent main OpenVPN server on an Ubuntu Server 16.04-3LTS virtual machine in our VMWare ESXi virtualization system.
This will be more powerful than the little RPi3 box network-wise, but I want to keep the RPi3 system as a fallback OpenVPN server, should the new main one fail.
So I have duplicated the certificates and keys between the two boxes including the openvpn server configuration files, except I have edited the port numbers of course. This server will run on ports 1194 and 1195 with the same type of traffic handling.
Now my question:
Do I need to change the subnet which the two servers use?
I use 10.8.0.0/24 for the full servers and 10.8.1.0/24 for the limited servers.
As you can see below I have split the subnets in half with the first half for DHCP and the upper half for static client dependent addresses.
I have the same on both server's configuration files since they were copied. See below.
The ccd files look essentially like this (example is for the limited access server using subnet 10.8.1.0/24):
#The client configuration is set to assign a specific IP address pair
#for the client's tunnel endpoints, which will then be handled by the
#IPTABLES firewall to allow access only to specific servers on the network.
#Example IPTABLES entry:
#iptables -I FORWARD 1 -s 10.8.1.130 ! -d 10.0.0.10 -j DROP
#
#Note that each client should have his own IP from the range 128..253
#This is reserved for xxxx:
ifconfig-push 10.8.1.130 255.255.255.0
What I am uncertain about is if the subnets 10.8.0.0/24, 10.8.1.0/24 used on the old RPi3 server can also be used on the new Ubuntu server or if I should set the Ubuntu server to use 10.8.2.0/24, 10.8.3.0/24 instead?
It will also affect the ccd files where the clients are assigned fixed addresses.
Could there be a network problem if there are clients connected to both servers at the same time and potentially using the same IP address?
Or is this entirely hidden within the respective OpenVPN server?
This is the full access conf file (new server on port 1194 old server on port 1198):
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/OVPN.crt
key /etc/openvpn/keys/OVPN.key # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem
tls-auth /etc/openvpn/keys/ta.key 0 # This file is secret
topology subnet
server 10.8.0.0 255.255.255.0 'nopool'
ifconfig-pool 10.8.0.2 10.8.0.127 255.255.255.0
client-config-dir /etc/openvpn/ccdw
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
max-clients 20
persist-key
persist-tun
status /etc/openvpn/log/openvpn-status.log
log /etc/openvpn/log/openvpn.log
verb 4
explicit-exit-notify 1
And here is the limited access conf file (new server on port 1195 old server on port 1199):
port 1195
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/OVPN.crt
key /etc/openvpn/keys/OVPN.key # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem
tls-auth /etc/openvpn/keys/ta.key 0 # This file is secret
topology subnet
server 10.8.1.0 255.255.255.0 'nopool'
ifconfig-pool 10.8.1.2 10.8.1.127 255.255.255.0
client-config-dir /etc/openvpn/ccdl
ifconfig-pool-persist ipp2.txt
push "route 10.0.0.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
max-clients 20
persist-key
persist-tun
status /etc/openvpn/log/openvpn-status2.log
log /etc/openvpn/log/openvpn2.log
verb 4
explicit-exit-notify 1
