Complicate Setup

[ziomuschio]

Firts of all, openVpn is one of the greates vpn software i ever used! Thank you all for the incredible work you done.

I'm triyng to arrange a quite complicates setup, at least I think it is so...


I have one server host and many client host. The problem is that each client host has many interfaces and each of this must have a specific address. I would like to do it having only 1 certificate so my CCD config file doesn't works.

SERVER

Code: Select all

mode server
tls-server
topology subnet
push "topology subnet"

ifconfig 10.8.0.1 255.255.255.0

ca  		/etc/openvpn/easy-rsa/keys/ca.crt
cert		/etc/openvpn/easy-rsa/keys/server.crt
key  		/etc/openvpn/easy-rsa/keys/server.key 
dh    		/etc/openvpn/easy-rsa/keys/dh2048.pem

persist-key
persist-tun
keepalive 10 60

duplicate-cn
management 127.0.0.1 2323 stdin

client-config-dir /etc/openvpn/client-configs
script-security 2

keepalive 10 120
comp-lzo

#user nobody
#group nogroup

#status openvpn-status.log
#verb 6

As you can see in the server statement i did not specify a ip address pool for client as I like to set it statically depending on the interface.


for example in my first host client I have 2 interfaces and 2 differnt config files

client->INTERFACE1.conf

Code: Select all

client
proto tcp

local 172.16.0.10
remote  192.168.6.10 1194

dev tun0

ca    /etc/openvpn/keys/ca.crt
cert  /etc/openvpn/keys/client1.crt
key   /etc/openvpn/keys/client1.key

resolv-retry infinite
persist-key
persist-tun
ns-cert-type server


script-security 2
up   "upRoutes.sh"
down "downRoutes.sh"

client->INTERFACE2.conf

Code: Select all

client
proto tcp

local 172.16.2.12
remote  192.168.6.10 1194

dev tun2

ca    /etc/openvpn/keys/ca.crt
cert  /etc/openvpn/keys/client1.crt
key   /etc/openvpn/keys/client1.key

resolv-retry infinite
persist-key
persist-tun
ns-cert-type server


script-security 2
up   "upRoutes.sh"
down "downRoutes.sh"

As you can see these two config shares the ca and key file. I cannot generate a certificate for each interface because that number is variable and can be like 3 or like 30. It will be a kind of trunk!


then in the scripts i put the addresses in the interfaces but when i try to ping the server it drops the packet.


Could someone help?


Thanks you very much!

Salvatore

[janjust]

the 'local' and 'remote' directives are used for the local (LAN) interface and the remote interface.
In your setup you would use

Code: Select all

ifconfig 10.8.0.2 255.255.255.0

for client1 and 10.8.0.3 for the next, etc.

Remember that the client VPN interface must be in the same subnet as the server interface (10.8.0.1/24 in your setup).