Hi,
a) I have 2 networks in different locations (home and office) plus a VPS running Ubuntu Server 11.04 with a fixed IP and a registered domain name.
b) As I have large NAS boxes on each site, I want to be able to use them for backups for the other site (both Ubuntu and Windows desktops) I also want access to other resources from offsite such as remote printing etc.
c) I also want Road Warrior access to both networks and I'd ideally like them to transparently handle all the nasty Microsoft protocol stuff - so I believe I need bridging not routing.
d) Finally I'd also like the VPS to appear local to the subnets so I can host central MySQL databases on it and query them with ODBC connections from various machines.
e) I think it best if I explain what I was thinking and what I'm not sure about then you guys can shoot it down or steer me right!
f) I apologise for the fact that despite reading lots and having got my head round routing netwroks my understanding of bridging is cloudy! I'll number my paragraphs so you can easily answer anywhere you can advise.
g) I am also combining the solving of domestic and business needs with a desire to learn and get satisfaction from making these things work
1) I've read that bridging gives me a transparent connection, but presumably nodes still need to know how to "route" through the VPN or locally. Also I've read that you can use DHCP on the other side of the bridge to get a single subnet working.
2) Currently my two subnets are separate 192.168.2.x and 192.168.3.x
3) The problem with that seems to me that if the link is down you still need DHCP local to each side, so do I put everything on 192.168.2.x and have 2 DHCP servers with different IP ranges to give out- say 192.168.2.50-99 at home, 192.168.2.100-149 office?
4) That way a machine that happens to get an IP from the othhr side is still legal on the local net when it's isolated even if it didn't get it from local DHCP.
5) However I don't know how the various nodes work out that they need 192.168.2.50 to stay local and 192.168.2.100 to go through the bridge.
6) My idea was to use the VPS running OpenVPN bridging to connect the 2 LANs. I've got the VPS configured with bridging and an Ubuntu desktop at home connecting as far as status messages lead me to believe.
7) My VPS connection allocates 10.8.0.1 to the VPS and 10.8.0.2 to my first connection. However since there's no physical nodes on 10.8.0.x it's hard to prove the connection - I get nothing from ping 10.8.0.1 but I guess that's becuase its the VPN Server?
8) Or maybe I have something in the config that prevents pings. Actually ping just hangs when the link is up but says unreachable when it is down.
9) I tried connecting to my webserver at
http://10.8.0.1 but get no response
10) Assuming I get another node connected it will be 10.8.0.3 on the VPN. So can I then ping 10.8.0.3 from 10.8.0.2
11) If I want to connect these 2 subnets then presumably I need at least one computer on each subnet to bridge from 192.xx to 10.xx as well. Presumably then I end up with the 2 bridging desktops plus the VPS knowing about the 10.xx subnet and the rest of the home and office nodes just seeing 192.x devices some of which are 3 bridges away
12) Home PC --192.x-- Home gateway PC -- 10.x --- internet -- 10.x --VPS-- 10.x --internet--10.x-- Office gateway PC--192.x-- Office File server
13) If that can work, can I only use 1 gateway PC or can I have more doing it to give redundancy - am I allowed multiple paths to the destination and how does anything work out which to use - probably this bit is routing not bridging?
14) I also wondered if it was better to flip it aroundand get the VPS to act as OpenVPN client to the local gateways then the local gateways are bridging servers but the VPS would need to bridge 2 client connections.
15) How do I have multiple modes for my OpenVPN - so a node is both a bridge server and a routing server for different clients or both a server and a client at the same time. So I can bridge my 2 subnets with the VPS transparent but also access the VPS files for shared database storage,central user authentication etc.
16) If I'm a server I need my own ca.crt but if I'm a client I need the server's ca.crt can I have both - do i just change the names?
17) Do I have to rerun the dh generator each time I create a new pair of client key files to transfer to a client
18) can you rename key files or is their name fixed when you generate the key
19) I was hoping to use routers I have to connect the networks via the VPS but they don't run OpenVPN and IPsec trips up on NAT and I don't like the fact that passwords get stored all over the place, to get by NAT I had to use PPTP. In some ways it would be sensible to get the routers doing the VPN work but I just thought it woudl be good to use the VPS and OpenSSL to do the job. The routers I have available are a pair of Draytek 2930Vn and a pair of Netgear FVX538s
