Connect two networks using OpenVPN

[redbird71]

Hi everyone,

I am trying to connect my home network to my office network in a way that I can access my office computers and network shares from home >>AND<< the other way around. It seams simple enough to make it work in one direction - just create a VPN Server on the office router and a VPN Client on home router (both AC68U) and done. But I can't get it to work bidirectionally. Would be grateful for any hints.

 

[ColinTaylor]

There are already numerous threads covering this. Check out those to see if any of them match your situation.

 

[eibgrad]

It's called a site-to-site configuration.

On the OpenVPN server side, you have to configure the Manage Client-Specific Options section and configure it w/ the local IP network of the connecting OpenVPN client based on the CN (Common Name) of its cert (when using the certs generated by the router, it will be named 'client' (no quotes)). But since that cert is typically shared across *all* OpenVPN clients, it becomes ambiguous which client is actually connecting (unless it's the *only* OpenVPN client you intend to connect to that server). In that case, and assuming you're using username/password, it's better to add the following to the OpenVPN server's custom config field.

username-as-common-name

Then create a user strictly for the site-to-site connection (e.g., site2site) and use it as the CN w/ Manage Client-Specific Options. When that user connects, the OpenVPN server will use that entry in Manage Client-Specific Options to correctly route that OpenVPN client's local IP network over the tunnel.

On the OpenVPN client, you'll need to change the Inbound Firewall option to Allow (the default is Blocked). Also, there's no need to NAT the tunnel in a site-to-site configuration if properly configured.

 

[redbird71]

It's called a site-to-site configuration.

On the OpenVPN server side, you have to configure the Manage Client-Specific Options section and configure it w/ the local IP network of the connecting OpenVPN client based on the CN (Common Name) of its cert (when using the certs generated by the router, it will be named 'client' (no quotes)). But since that cert is typically shared across *all* OpenVPN clients, it becomes ambiguous which client is actually connecting (unless it's the *only* OpenVPN client you intend to connect to that server). In that case, and assuming you're using username/password, it's better to add the following to the OpenVPN server's custom config field.

username-as-common-name

Then create a user strictly for the site-to-site connection (e.g., site2site) and use it as the CN w/ Manage Client-Specific Options. When that user connects, the OpenVPN server will use that entry in Manage Client-Specific Options to correctly route that OpenVPN client's local IP network over the tunnel.

On the OpenVPN client, you'll need to change the Inbound Firewall option to Allow (the default is Blocked). Also, there's no need to NAT the tunnel in a site-to-site configuration if properly configured.

Thank you for that.

Just to get this right this would mean:
1 - On the SERVER site - I open VPN Server config and create a user f.i. site2site with a password
2 - Change VPN Details from 'General' to 'Advanced Settings'
3 - set 'Manage Client-Specific Options' to YES
4 - Under 'Allowed Clients' below I but site2site into Common Name - Subnet ??? mask ??? Push ?? and add it as a client - press Apply
5 - export OpenVPN configuration file

6 - On the CLIENTE site - open VPN Client config
7 - load OpenVPN configuration file
8 - set 'Create NAT on tunnel' to NO
9 - set 'Inbound Firewall' to Allow
10 - Enter username site2site and password
11 - Apply
DONE


Could you fill in the blanks on Subnet - Mask - Push?
Don't I have to activate 'Allow only specified clients' so that the list of Allowed Clientes is checked at all?
Would I have to set up a secondary VPN Server for other users to connect to the server?

 

[redbird71]

There are already numerous threads covering this. Check out those to see if any of them match your situation.

I did search but came up empty ... If you found something please share a link.

 

[eibgrad]

Thank you for that.

Just to get this right this would mean:
1 - On the SERVER site - I open VPN Server config and create a user f.i. site2site with a password
2 - Change VPN Details from 'General' to 'Advanced Settings'
3 - set 'Manage Client-Specific Options' to YES
4 - Under 'Allowed Clients' below I but site2site into Common Name - Subnet ??? mask ??? Push ?? and add it as a client - press Apply
5 - export OpenVPN configuration file

6 - On the CLIENTE site - open VPN Client config
7 - load OpenVPN configuration file
8 - set 'Create NAT on tunnel' to NO
9 - set 'Inbound Firewall' to Allow
10 - Enter username site2site and password
11 - Apply
DONE


Could you fill in the blanks on Subnet - Mask - Push?
Don't I have to activate 'Allow only specified clients' so that the list of Allowed Clientes is checked at all?
Would I have to set up a secondary VPN Server for other users to connect to the server?

Basically the above is correct.

You can make this configuration simple or complex, depending on your overall intentions. Originally you only spoke of the *one* site-to-site connection, and if you had other connections from other users to the same server, these would be unidirectional tunnels. That's why I suggested naming that one site-to-site connection as site2site, to distinguish it from all others. But it's just a name. And you can name it anything you like.

If you want/need *multiple* users to be connected as site-to-site, then you need to configure each of them under Manage Client-Specific Options as well. And you might as well just use the actual usernames (Frank, Phil, Lucy, etc.). Just realize that each OpenVPN client that's connected to the server has to be using a unique, non-overlapping local IP network.

If you want those OpenVPN clients to be able to talk to each other (i.e., use the OpenVPN server as a gateway), then you need to enable the "Allow Client <-> Client" option. Also, you need to check the Push option on each entry of the table so all the connected OpenVPN clients in a site-to-site configuration have their respective routing information made available to each other (if you only ever have *one* OpenVPN client in a site-to-site configuration, you do NOT need to Push it).

If the only clients allowed access to the server are those configured as site-to-site (i.e., NO unidirectional tunnels), then enable "Allow only specified clients". Frankly, I don't find this a particularly useful setting since there's no particular value in limiting connections to bi-directional tunnels (at least NOT that I can see).

 

[eibgrad]

In the following example, there's only one configured site-to-site connection. All others are unidirectional.

In the following example, we have multiple site-to-site connections, none of which are allowed to communicate w/ each other.

In the following example, all of the site-to-site connections are allowed to communicate w/ each other.

In all of the above examples, unidirectional tunnels are allowed since "Allow only specified clients" is set to No.

 

[redbird71]

In the following example, there's only one configured site-to-site connection. All others are unidirectional.

View attachment 40617

In the following example, we have multiple site-to-site connections, none of which are allowed to communicate w/ each other.

View attachment 40618

In the following example, all of the site-to-site connections are allowed to communicate w/ each other.

View attachment 40619

In all of the above examples, unidirectional tunnels are allowed since "Allow only specified clients" is set to No.

Thank you. This is very helpful. I'll give it a try.

 

[redbird71]

Should there be any relation to those two addresses?

 

[redbird71]

Also - the moment I activate 'Manage Client-Specific Options' - the connection becomes unstable, effectively disconnecting every 2 minutes approximately.

 

[eibgrad]

Should there be any relation to those two addresses?


View attachment 40786

10.8.2.0 255.255.255.0 is the IP network of the tunnel. What you want to specify in Manage Client-Specific Options is the IP network on which that specific OpenVPN client is running (e.g., 192.168.1.0 255.255.255.0). That's how the OpenVPN server learns how to route to that specific IP network when a device on the OpenVPN server's local IP network (e.g., 192.168.2.0 255.255.255.0) needs to communicate w/ the IP network of the OpenVPN client. That's the whole point of using that section.

P.S. I just realized that you have 10.8.0.0 for the tunnel, and the site-to-site IP is 10.8.2.0. So there is no problem here *if* indeed the IP network on which that OpenVPN client is residing is 10.8.2.0 255.255.255.0. IOW, the only relationship between them that matters is that they do NOT overlap or create ambiguous routing.