It is kind of puzzling, I was forced to use NAT on both end in order to get connections between site office and main office. But is not really good for me, because NAT lost identification functions & security logging.
main office gateway:
remote XXX.XXX.XXX.YYY
float
dev tun
ifconfig 10.0.0.2 10.0.0.1
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo
ping 15
secret /usr/local/etc/openvpn/keys/vpn.key
#internal network behind remote server
route [b]192.168.200.0[/b] 255.255.255.0
site office gateway:
remote YYY.YYY.YYY.YYY
float
dev tun
#virtual tunnel
ifconfig 10.0.0.1 10.0.0.2
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo
ping 15
secret /usr/local/etc/openvpn/keys/vpn.key
route [b]192.168.1.0 [/b]255.255.255.0
1st upon the aboves, I am able to connect the 2 vpn gateways cross, I can ping & ssh each other from gateways themselves.
But I am not yet able to have connections across vpn between computers between site office & main office yet, until I NAT in place.
Once I started NAT on both gateways, all the computers can ping one another across VPN between my site office & main office . But this is handicap and unreasonable.
Because once it is NAT, only the gateways' address is presented for any connection, and we can not see which is the actual machine on the other side any more. No NAT is preferred, because then I can log the IP of connection and even allow/deny connections based on the source IP.
In theory, I believe only enabling packet forwarding on both gateways should be sufficient to get connected, without NAT. But some how, I can not get connections except between 2 gateways themselves if I removed NAT. I was initially suspecting some firewall rules spoiled it, I can not figure out. At one point I configure firewall to be NONE or OPEN, and still the same, no connections between computers unless NAT is on.
NAT causes connections to be seen as coming from gateways' IP instead of the real IP over the other side of VPN.
I am wondering if the non-connection or rejection when without NAT was caused by individual computers that they rejected everything that came from outside own LAN IP? I don't believe so, because one of them main office computer is a working web server, and it accepts connection from a router which redirected port 80 to it.However I am not the guy in charge of that web server & it router, I can explore it too much. My task is to setup VPN for site office, which is a work site away from main office. It was agreed that IP address scheme will be as follows:
Site Office LAN is
192.168.1.0 255.255.255.0
Main Office LAN is
192.168.200.0 255.255.255.0
As of now, we can connect with NAT, but not ideal because better security is expected. Ideally actual source IP of each connections is preserved for log and access control.
Thanks for readers attentions and pse share your related experience and suggestions.
