Hi guys. I need to setup the following OpenVPN network and need your help {ME} {Datacenter_01} {Datacenter_02} {Uncensored internet} [oconf=ME OpenVPNClient01] auth-nocache verb 3 auth SHA512 cipher AES-256-GCM data-ciphers AES-256-GCM client proto-force udp4 remote a.a.a.a aaa udp4 ca "aaca.crt" cert "aaclient.crt" key "aaclient.key" remote-cert-tls server tls-cert-profile preferred tls-ciphersuites TLS_AES_256_GCM_SHA384 tls-crypt-v2 "aatlsv2client" tls-version-min 1.3 verify-x509-name CN=aaserver keepalive 10 60 nobind dev tun dev-node OpenVPN dev-type tun route-method exe windows-driver wintun [/oconf] [oconf=Datacenter_01 TAP towards ME]OpenVPNserver01] verb 3 auth SHA512 cipher AES-256-GCM data-ciphers AES-256-GCM server 10.0.2.0 255.255.255.0 verify-client-cert require ca "c:\\easyrsa-3.0.8\\pki\\aaca.crt" cert "c:\\easyrsa-3.0.8\\pki\\issued\\aaserver.crt" key "c:\\easyrsa-3.0.8\\pki\\private\\aaserver.key" crl-verify "c:\\easyrsa-3.0.8\\pki\\crl.pem" dh "none" remote-cert-tls client tls-cert-profile preferred tls-ciphersuites TLS_AES_256_GCM_SHA384 tls-crypt-v2 "c:\\program files\\openvpn\\bin\\aatlsv2server" tls-version-min 1.3 keepalive 10 60 local a.a.a.a lport aaa mode server proto udp4 proto-force udp4 dev tun dev-node In dev-type tun dhcp-option DNS 127.0.0.1 dhcp-option DISABLE-NBT topology subnet dhcp-renew ip-win32 adaptive route-method adaptive windows-driver tap-windows6 push "persist-key" push "explicit-exit-notify 1" push "dhcp-option DNS 10.0.0.1" push "dhcp-option DISABLE-NBT" push "persist-tun" push "redirect-gateway def1 bypass-dhcp" push "topology subnet" push "block-outside-dns" push "dhcp-renew" push "register-dns" [/oconf] [oconf=Datacenter_01 TAP toward datacenter_02]OpenVPNClient02] auth-nocache verb 3 auth SHA512 cipher AES-256-GCM data-ciphers AES-256-GCM client proto-force udp4 remote b.b.b.b bb udp4 ca "bbca.crt" cert "bbclient.crt" key "bbclient.key" remote-cert-tls server tls-cert-profile preferred tls-ciphersuites TLS_AES_256_GCM_SHA384 tls-crypt-v2 "bbtlsv2client" tls-version-min 1.3 verify-x509-name CN=bbserver keepalive 10 60 nobind dev tun dev-node Out dev-type tun route-method exe windows-driver tap-windows6 [/oconf] [oconf=Datacenter_02_OpenVPNserver_02] verb 3 auth SHA512 cipher AES-256-GCM data-ciphers AES-256-GCM server 10.0.0.0 255.255.255.0 verify-client-cert require ca "c:\\easyrsa-3.0.8\\pki\\bbca.crt" cert "c:\\easyrsa-3.0.8\\pki\\issued\\bbserver.crt" key "c:\\easyrsa-3.0.8\\pki\\private\\bbserver.key" crl-verify "c:\\easyrsa-3.0.8\\pki\\crl.pem" dh "none" remote-cert-tls client tls-cert-profile preferred tls-ciphersuites TLS_AES_256_GCM_SHA384 tls-crypt-v2 "c:\\program files\\openvpn\\bin\\bbtlsv2server" tls-version-min 1.3 keepalive 10 60 local b.b.b.b lport bb mode server proto udp4 proto-force udp4 dev tun dev-node OpenVPN-Wintun dev-type tun dhcp-option DNS 127.0.0.1 dhcp-option DISABLE-NBT topology subnet dhcp-renew ip-win32 adaptive route-method adaptive windows-driver wintun push "persist-key" push "explicit-exit-notify 1" push "dhcp-option DNS 10.0.0.1" push "dhcp-option DISABLE-NBT" push "persist-tun" push "redirect-gateway def1 bypass-dhcp" push "topology subnet" push "block-outside-dns" push "dhcp-renew" push "register-dns" [/oconf] All the configurations works and all of them connect perfectly. But how can I make it route internet traffic through OpenVPNServer_02 Client is Win10 and server are win server 2019 I hope you guys understand my problem/

[quote=TinCanTech post_id=96693 time=1609604650 user_id=37053] What about data centre 02 ? [/quote] Thanks for your reply. Datacenter02 is not possible. It have to be Windows Server 2019 BTW,Thanks @pipin for oconf

[quote=msh19511 post_id=96697 time=1609649668 user_id=46080] [quote=TinCanTech post_id=96693 time=1609604650 user_id=37053] What about data centre 02 ? [/quote] Thanks for your reply. Datacenter02 is not possible. It have to be Windows Server 2019 [/quote]This is difficult enough with *nix. It cannot be done at all with Windblows.

[quote=TinCanTech post_id=96699 time=1609685275 user_id=37053] [quote=msh19511 post_id=96697 time=1609649668 user_id=46080] [quote=TinCanTech post_id=96693 time=1609604650 user_id=37053] What about data centre 02 ? [/quote] Thanks for your reply. Datacenter02 is not possible. It have to be Windows Server 2019 [/quote]This is difficult enough with *nix. It cannot be done at all with Windblows. [/quote] Thanks for your kind reply. I check with DC2 and they accept my request. they can change my OS to *nix. I don't know which one suite my purpose best so please be kind and tell me best distro for my demand

Openvpn configuration help

[deleted]

Hi guys.

I need to setup the following OpenVPN network and need your help

{ME} <----OVPN-UDP-Link----> {Datacenter_01} <----OVPN-UDP-LINK----> {Datacenter_02} <-------> {Uncensored internet}

auth-nocache
verb 3
auth SHA512
cipher AES-256-GCM
data-ciphers AES-256-GCM
client
proto-force udp4
remote a.a.a.a aaa udp4
ca "aaca.crt"
cert "aaclient.crt"
key "aaclient.key"
remote-cert-tls server
tls-cert-profile preferred
tls-ciphersuites TLS_AES_256_GCM_SHA384
tls-crypt-v2 "aatlsv2client"
tls-version-min 1.3
verify-x509-name CN=aaserver
keepalive 10 60
nobind
dev tun
dev-node OpenVPN
dev-type tun
route-method exe
windows-driver wintun

OpenVPNserver01]
verb 3
auth SHA512
cipher AES-256-GCM
data-ciphers AES-256-GCM
server 10.0.2.0 255.255.255.0
verify-client-cert require
ca "c:\\easyrsa-3.0.8\\pki\\aaca.crt"
cert "c:\\easyrsa-3.0.8\\pki\\issued\\aaserver.crt"
key "c:\\easyrsa-3.0.8\\pki\\private\\aaserver.key"
crl-verify "c:\\easyrsa-3.0.8\\pki\\crl.pem"
dh "none"
remote-cert-tls client
tls-cert-profile preferred
tls-ciphersuites TLS_AES_256_GCM_SHA384
tls-crypt-v2 "c:\\program files\\openvpn\\bin\\aatlsv2server"
tls-version-min 1.3
keepalive 10 60
local a.a.a.a
lport aaa
mode server
proto udp4
proto-force udp4
dev tun
dev-node In
dev-type tun
dhcp-option DNS 127.0.0.1
dhcp-option DISABLE-NBT
topology subnet
dhcp-renew
ip-win32 adaptive
route-method adaptive
windows-driver tap-windows6
push "persist-key"
push "explicit-exit-notify 1"
push "dhcp-option DNS 10.0.0.1"
push "dhcp-option DISABLE-NBT"
push "persist-tun"
push "redirect-gateway def1 bypass-dhcp"
push "topology subnet"
push "block-outside-dns"
push "dhcp-renew"
push "register-dns"

OpenVPNClient02]
auth-nocache
verb 3
auth SHA512
cipher AES-256-GCM
data-ciphers AES-256-GCM
client
proto-force udp4
remote b.b.b.b bb udp4
ca "bbca.crt"
cert "bbclient.crt"
key "bbclient.key"
remote-cert-tls server
tls-cert-profile preferred
tls-ciphersuites TLS_AES_256_GCM_SHA384
tls-crypt-v2 "bbtlsv2client"
tls-version-min 1.3
verify-x509-name CN=bbserver
keepalive 10 60
nobind
dev tun
dev-node Out
dev-type tun
route-method exe
windows-driver tap-windows6

verb 3
auth SHA512
cipher AES-256-GCM
data-ciphers AES-256-GCM
server 10.0.0.0 255.255.255.0
verify-client-cert require
ca "c:\\easyrsa-3.0.8\\pki\\bbca.crt"
cert "c:\\easyrsa-3.0.8\\pki\\issued\\bbserver.crt"
key "c:\\easyrsa-3.0.8\\pki\\private\\bbserver.key"
crl-verify "c:\\easyrsa-3.0.8\\pki\\crl.pem"
dh "none"
remote-cert-tls client
tls-cert-profile preferred
tls-ciphersuites TLS_AES_256_GCM_SHA384
tls-crypt-v2 "c:\\program files\\openvpn\\bin\\bbtlsv2server"
tls-version-min 1.3
keepalive 10 60
local b.b.b.b
lport bb
mode server
proto udp4
proto-force udp4
dev tun
dev-node OpenVPN-Wintun
dev-type tun
dhcp-option DNS 127.0.0.1
dhcp-option DISABLE-NBT
topology subnet
dhcp-renew
ip-win32 adaptive
route-method adaptive
windows-driver wintun
push "persist-key"
push "explicit-exit-notify 1"
push "dhcp-option DNS 10.0.0.1"
push "dhcp-option DISABLE-NBT"
push "persist-tun"
push "redirect-gateway def1 bypass-dhcp"
push "topology subnet"
push "block-outside-dns"
push "dhcp-renew"
push "register-dns"

All the configurations works and all of them connect perfectly.
But how can I make it route internet traffic through OpenVPNServer_02
Client is Win10 and server are win server 2019
I hope you guys understand my problem/

[deleted]

I need to mention that i can change Datecenter_01 to linux too, if that would help

TinCanTech

What about data centre 02 ?

[deleted]

TinCanTech wrote What about data centre 02 ?

Thanks for your reply.
Datacenter02 is not possible. It have to be Windows Server 2019

BTW,Thanks @pipin for oconf

TinCanTech

msh19511 wrote
TinCanTech wrote What about data centre 02 ?
Thanks for your reply.
Datacenter02 is not possible. It have to be Windows Server 2019

This is difficult enough with *nix. It cannot be done at all with Windblows.

[deleted]

TinCanTech wrote
msh19511 wrote
TinCanTech wrote What about data centre 02 ?
Thanks for your reply.
Datacenter02 is not possible. It have to be Windows Server 2019
This is difficult enough with *nix. It cannot be done at all with Windblows.

Thanks for your kind reply.
I check with DC2 and they accept my request. they can change my OS to *nix.
I don't know which one suite my purpose best so please be kind and tell me best distro for my demand

[deleted]

TinCanTech wrote
msh19511 wrote
TinCanTech wrote What about data centre 02 ?
Thanks for your reply.
Datacenter02 is not possible. It have to be Windows Server 2019
This is difficult enough with *nix. It cannot be done at all with Windblows.

Hi again
both of my servers on both datacenter are now running ubuntu 20.04
Would you guys help me out?
Thanks

TinCanTech

How much is it worth to you ?

[deleted]

TinCanTech wrote How much is it worth to you ?

Think this way.
I live in censorship-country and I always have to think at least one step ahead of censorship.
Right now I don't have any problem with only one server outside and TLS1.3 link but I must think ahead.
are you asking for price?

[deleted]

msh19511 wrote
TinCanTech wrote How much is it worth to you ?
Think this way.
I live in censorship-country and I always have to think at least one step ahead of censorship.
Right now I don't have any problem with only one server outside and TLS1.3 link but I must think ahead.
are you asking for price?

Please? Any answer?

TinCanTech

You can contact me privately: tincantech at protonmail dot com

[deleted]

TinCanTech wrote You can contact me privately: tincantech at protonmail dot com

I send you an email last week but didn't have any reply at all.
check your email.
Thanks