breaking up Class C into four subnets

m3tatr0n

Hi There,

I have this configuration:

eth0 - with a public ip address
eth1 - 192.168.10.1 (bridged - br0)
eth2 - 192.168.2.1 (bridged - br1)

eth2/br1 is our local lan. We have two people offsite that connects to OpenVPN
and they get an ip address within that subnet (bridged).

eth1/br0 is for one of our clients. We housed their 3 server in our shop. We have access
to their servers using the OpenVPN server as the gateway but their server don't have
access to our 192.168.2.0 network. This is done via iptables. The OpenVPN configuration
on this one is also bridged. They get 192.168.10.?? when they connect.

I was told that we might be getting another client that we need to house their servers here
and they want VPN access to it. And they want a setup similar to our first client.

My question is, can I breakup 192.168.10.0 network in four subnets and still retain
bridging on all four subnets? I want our LAN (192.168.2.0 network) to access all four
subnets. I am trying to avoid adding another network card since I don't really need
all 254 ip address for either clients. Not only that, mother nowadays don't have enough
PCI slot to add more physical network cards. I tried IP alias but apparently, I can not
bridge to an alias.

Thank you very much.

Mimiko

can I breakup 192.168.10.0 network in four subnets and still retain bridging on all four subnets?

Yes, and if the subnet mask will differ, the clients will not see each other, only if they setup their servers to use the other subnet mask.

m3tatr0n

Here is my server.conf

port 1194
proto udp
dev tap0
ca /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.crt
cert /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.crt
key /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/server.key # This file should be kept secret
dh /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.10.1 255.255.255.0 192.168.10.100 192.168.10.110
push "dhcp-option DNS 192.168.10.1"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn/tdt_openvpn.log
log-append /var/log/openvpn/tdt_openvpn.log
verb 3
inactive 1800

And here is my client config:

client
dev tap
proto tcp
remote public_ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3

Network interface on the OpenVPN Server (also our firewall using iptables)
eth0 has the public ip address
eth1 has 192.168.10.1/24 -> for customers' use
eth2 has 192.168.2.1/24 -> this is our local LAN.

When our client ( let's call then Client A) connects, they get an ip address
from this range 192.168.10.100 - 192.168.10.110. They really don't have
a lot of servers here only 5. So I thought I can break up the Class C into four.
Give them one of the segment and another for the new client (Client B).

I guess eth1 will now have and ip_address/subnet_mask of 192.168.10.1/26.
I can put Client A in that segment. But how do I deal with Client B? They will
be on a separate segment all together.

Since we will be maintaining these customers' server, we need to access it
from our local LAN (192.168.2.0/24). On the current configuration we can do that
now. Can I still access Client B's network if it's in 192.168.10.64/26 network
and eth1 of the OpenVPN is in the 192.168.10.0/26 network?
How will the "server-bridge" line looks like for Client B's server config file?

Thanks in Advance