Hi, Douglas D Germann Sr wrote: > that would simulate a much more realistic environment and you'd be rid > of the "double" reference to 192.168.0/24 on the VPN client. >> >> OK, went out and bought a new router today. I am running out of time >> today to get it set up, and may not be able to look at it again till >> Saturday. Will get back to you after I have made some progress on >> that end. >> >> Thanks for sticking with me, JJK! >> >> :- Doug. > > JJK-- > > Well, a bit of a detour on this end: I farkled the new computer (wind) > on Friday, and spent all of Saturday and part of Sunday starting over > from scratch. Also, another person suggested a different approach, > which turned out to do what I want, and it seems to be working. We'll > find out when I send air and wind home with the people who use them. > > I would like your comments and suggestions, JJK. Maybe what I have > done is not good networking. > > Also, I offer here what I have done in case it helps someone else with > a similar quandary: > > Now it is three clients and one server. I started by setting up new > easy-rsa certificates all around. The computer I use to ssh to the > off-site clients (air and wind) is called fire. > > (So mariah the server and fire the client are in the lan, while the > clients air and wind will be remote using ddns to connect via the vpn > to the server.) > > > <<<mariah, server>>> > > server.conf: > ======== > > push "route 10.8.1.0 255.255.255.0" > > dev tun > > management 127.0.0.1 1195 > > server 10.8.1.0 255.255.255.0 > > > dh /usr/syno/etc/packages/VPNCenter/openvpn/dh4096.pem > ca /usr/syno/etc/packages/VPNCenter/openvpn/ca.crt > cert /usr/syno/etc/packages/VPNCenter/openvpn/mariah.crt > key /usr/syno/etc/packages/VPNCenter/openvpn/mariah.key > > max-clients 4 > > comp-lzo > > persist-tun > persist-key > > verb 3 > > log-append /var/log/openvpn.log > > keepalive 10 60 > reneg-sec 0 > > status-version 2 > proto udp6 > port [blanked] > > user nobody > group nobody > > client-to-client > tls-auth ta.key 0 > > ========== end server.conf > > mariah> route > Kernel IP routing table > Destination Gateway Genmask Flags Metric Ref Use > Iface > default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0 > 10.8.1.0 10.8.1.2 255.255.255.0 UG 0 0 0 tun0 > 10.8.1.2 * 255.255.255.255 UH 0 0 0 tun0 > 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0 > mariah> > > > <<<air client>>> > > client.conf for air: > ======= > > client > dev tun1 > proto udp > remote [ddns blanked] > resolv-retry infinite > nobind > persist-key > persist-tun > dh dh4096.pem > ca /etc/openvpn/synca.crt > cert /etc/openvpn/air3.crt > key /etc/openvpn/air3.key > remote-cert-tls server > comp-lzo > verb 3 > tls-auth ta.key 1 > > ========= end of client.conf for air > > doug@air:/etc/openvpn$ route > Kernel IP routing table > Destination Gateway Genmask Flags Metric Ref Use > Iface > default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0 > 10.8.0.0 10.8.0.41 255.255.255.0 UG 0 0 0 tun0 > 10.8.0.41 * 255.255.255.255 UH 0 0 0 tun0 > 10.8.1.0 10.8.1.5 255.255.255.0 UG 0 0 0 tun1 > 10.8.1.5 * 255.255.255.255 UH 0 0 0 tun1 > link-local * 255.255.0.0 U 1000 0 0 eth0 > 192.168.0.0 * 255.255.255.0 U 1 0 0 eth0 > doug@air:/etc/openvpn$ > > > <<<wind client>>> > > client.conf for wind: > ======= > > client > dev tun1 > proto udp > remote [blanked ddns] > resolv-retry infinite > nobind > persist-key > persist-tun > dh dh4096.pem > ca /etc/openvpn/synca.crt > cert /etc/openvpn/wind.crt > key /etc/openvpn/wind.key > remote-cert-tls server > comp-lzo > verb 3 > tls-auth ta.key 1 > > =========end client.conf for wind > > doug@wind:/etc/openvpn$ route > Kernel IP routing table > Destination Gateway Genmask Flags Metric Ref Use > Iface > default router 0.0.0.0 UG 0 0 0 eth0 > 10.8.1.0 10.8.1.9 255.255.255.0 UG 0 0 0 tun1 > 10.8.1.9 * 255.255.255.255 UH 0 0 0 tun1 > link-local * 255.255.0.0 U 1000 0 0 eth0 > 192.168.0.0 * 255.255.255.0 U 1 0 0 eth0 > doug@wind:/etc/openvpn$ > > > <<<fire client>>> > > client.conf for fire: > ======= > > client > dev tun1 > proto udp > remote [blanked ddns] > resolv-retry infinite > nobind > persist-key > persist-tun > dh dh4096.pem > ca /etc/openvpn/synca.crt > cert /etc/openvpn/fire.crt > key /etc/openvpn/fire.key > remote-cert-tls server > comp-lzo > verb 3 > tls-auth ta.key 1 > > ========end client.conf for fire > > doug@fire:/etc/openvpn$ route > Kernel IP routing table > Destination Gateway Genmask Flags Metric Ref Use > Iface > default router 0.0.0.0 UG 0 0 0 eth0 > 10.8.1.0 10.8.1.13 255.255.255.0 UG 0 0 0 tun1 > 10.8.1.13 * 255.255.255.255 UH 0 0 0 tun1 > link-local * 255.255.0.0 U 1000 0 0 eth0 > 192.168.0.0 * 255.255.255.0 U 1 0 0 eth0 > doug@fire:/etc/openvpn$ > > > > Each of the three can ssh to and ping the other two. So I can ssh from > fire to air and to wind like I need to so I can perform maintenance. > > See anything troublesome here? > > My next projects are to: set static 10.8.1.x addresses for each > client; harden the security; and figure out exactly how the firewalls > should look on the server and the three clients. I will ask about the > firewalls separately. >
all clients have routes 192.168.0.0 * 255.255.255.0 U 1 0 0 eth0 that means you cannot reach the server side LAN 192.168.0.0/24; if that is not an issue then you're fine. apart from that it looks OK. JJK ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
