I have some internal networks with some clients. I need that when these clients connects from Internet to VPN server they enter in the same network that they use when they are phisically here. The reason is that they should be submited to the same firewall rules, so I can't use one network for all VPN clients.
I did this using IPv4 and apparently is working well. Each client has a certificate and a different configuration file. I'll have one server for each subnet and client will connect to the right server.
Server Config
# IPv4 configuration
local 10.129.128.200
port 1194
proto udp
dev tap-nti-udp
ca nti/nti-ca.crt
cert nti/nti-server.crt
key nti/nti-server.key # This file should be kept secret
dh nti/nti-dh2048.pem
ifconfig-pool-persist nti/nti-ipp.txt
server-bridge 10.129.32.254 255.255.255.0 10.129.32.230 10.129.32.250
push "dhcp-option DOMAIN mydomain"
push "dhcp-option DNS A.B.C.D"
push "redirect-gateway def1"
client-to-client
keepalive 10 120
tls-auth nti/nti-ta.key 0
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/nti-udp-openvpn-status.log
log-append /var/log/openvpn/nti-udp-openvpn.log
verb 3
crl-verify nti/nti-crl.pem
local 10.129.128.200
port 1194
proto udp
dev tap-nti-udp
ca nti/nti-ca.crt
cert nti/nti-server.crt
key nti/nti-server.key # This file should be kept secret
dh nti/nti-dh2048.pem
ifconfig-pool-persist nti/nti-ipp.txt
server-bridge 10.129.32.254 255.255.255.0 10.129.32.230 10.129.32.250
push "dhcp-option DOMAIN mydomain"
push "dhcp-option DNS A.B.C.D"
push "redirect-gateway def1"
client-to-client
keepalive 10 120
tls-auth nti/nti-ta.key 0
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/nti-udp-openvpn-status.log
log-append /var/log/openvpn/nti-udp-openvpn.log
verb 3
crl-verify nti/nti-crl.pem
On the server I have:
interface 1: with 10.129.128.200 address that receives the clients connections
interface 2: the tap-nti-upd interface; this interface is on a bridge with interface 3
interface 3: connects to one internal network (10.129.32.0/24) called nti
The directive
Code: Select all
server-bridge 10.129.32.254 255.255.255.0 10.129.32.230 10.129.32.250Then,
Code: Select all
push "redirect-gateway def1"Well, I need to do the same configuration using IPv6.
I can create the tap interface, the bridge, use --local with an ipv6 address etc. But, how can I configure the server as like I did with IPv4 but using IPv6, mainly on these directives:
Server Config
#
server-bridge 10.129.32.254 255.255.255.0 10.129.32.230 10.129.32.250
push "redirect-gateway def1"
server-bridge 10.129.32.254 255.255.255.0 10.129.32.230 10.129.32.250
push "redirect-gateway def1"
It would be something like:
Server Config
#
server-bridge 2001:DB8::1 64 2001:DB8::2 2001:DB8::100
push "redirect-gateway ipv6"
server-bridge 2001:DB8::1 64 2001:DB8::2 2001:DB8::100
push "redirect-gateway ipv6"
I'd tested a lot of ipv6 directives but not successful. How can I combine the ipv6 configuration to set this scenario?
From man:
IPv6 Related Options
The following options exist to support IPv6 tunneling in peer-to-peer and client-server mode. All options are modeled after their IPv4 counterparts, so more detailed explanations given there apply
here as well (except for --topology , which has no effect on IPv6).
--ifconfig-ipv6 ipv6addr/bits ipv6remote
configure IPv6 address ipv6addr/bits on the ``tun'' device. The second parameter is used as route target for --route-ipv6 if no gateway is specified.
--route-ipv6 ipv6addr/bits [gateway] [metric]
setup IPv6 routing in the system to send the specified IPv6 network into OpenVPN's ``tun''. The gateway parameter is only used for IPv6 routes across ``tap'' devices, and if missing, the
``ipv6remote'' field from --ifconfig-ipv6 is used.
--server-ipv6 ipv6addr/bits
convenience-function to enable a number of IPv6 related options at once, namely --ifconfig-ipv6, --ifconfig-ipv6-pool and --push tun-ipv6 Is only accepted if ``--mode server'' or
``--server'' is set. Pushing of the --tun-ipv6 directive is done for older clients which require an explicit ``--tun-ipv6'' in their configuration.
--ifconfig-ipv6-pool ipv6addr/bits
Specify an IPv6 address pool for dynamic assignment to clients. The pool starts at ipv6addr and matches the offset determined from the start of the IPv4 pool.
--ifconfig-ipv6-push ipv6addr/bits ipv6remote
for ccd/ per-client static IPv6 interface configuration, see --client-config-dir and --ifconfig-push for more details.
--iroute-ipv6 ipv6addr/bits
for ccd/ per-client static IPv6 route configuration, see --iroute for more details how to setup and use this, and how --iroute and --route interact.
Thank you!!
