that would simulate a much more realistic environment and you'd be rid of the "double" reference to 192.168.0/24 on the VPN client. >> Go for it, >> >> JJK >> > JJK-- > > OK, went out and bought a new router today. I am running out of time > today to get it set up, and may not be able to look at it again till > Saturday. Will get back to you after I have made some progress on that > end. > > Thanks for sticking with me, JJK! > > :- Doug.
JJK-- Well, a bit of a detour on this end: I farkled the new computer (wind) on Friday, and spent all of Saturday and part of Sunday starting over from scratch. Also, another person suggested a different approach, which turned out to do what I want, and it seems to be working. We'll find out when I send air and wind home with the people who use them. I would like your comments and suggestions, JJK. Maybe what I have done is not good networking. Also, I offer here what I have done in case it helps someone else with a similar quandary: Now it is three clients and one server. I started by setting up new easy-rsa certificates all around. The computer I use to ssh to the off-site clients (air and wind) is called fire. (So mariah the server and fire the client are in the lan, while the clients air and wind will be remote using ddns to connect via the vpn to the server.) <<<mariah, server>>> server.conf: ======== push "route 10.8.1.0 255.255.255.0" dev tun management 127.0.0.1 1195 server 10.8.1.0 255.255.255.0 dh /usr/syno/etc/packages/VPNCenter/openvpn/dh4096.pem ca /usr/syno/etc/packages/VPNCenter/openvpn/ca.crt cert /usr/syno/etc/packages/VPNCenter/openvpn/mariah.crt key /usr/syno/etc/packages/VPNCenter/openvpn/mariah.key max-clients 4 comp-lzo persist-tun persist-key verb 3 log-append /var/log/openvpn.log keepalive 10 60 reneg-sec 0 status-version 2 proto udp6 port [blanked] user nobody group nobody client-to-client tls-auth ta.key 0 ========== end server.conf mariah> route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0 10.8.1.0 10.8.1.2 255.255.255.0 UG 0 0 0 tun0 10.8.1.2 * 255.255.255.255 UH 0 0 0 tun0 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0 mariah> <<<air client>>> client.conf for air: ======= client dev tun1 proto udp remote [ddns blanked] resolv-retry infinite nobind persist-key persist-tun dh dh4096.pem ca /etc/openvpn/synca.crt cert /etc/openvpn/air3.crt key /etc/openvpn/air3.key remote-cert-tls server comp-lzo verb 3 tls-auth ta.key 1 ========= end of client.conf for air doug@air:/etc/openvpn$ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.0.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 10.8.0.41 255.255.255.0 UG 0 0 0 tun0 10.8.0.41 * 255.255.255.255 UH 0 0 0 tun0 10.8.1.0 10.8.1.5 255.255.255.0 UG 0 0 0 tun1 10.8.1.5 * 255.255.255.255 UH 0 0 0 tun1 link-local * 255.255.0.0 U 1000 0 0 eth0 192.168.0.0 * 255.255.255.0 U 1 0 0 eth0 doug@air:/etc/openvpn$ <<<wind client>>> client.conf for wind: ======= client dev tun1 proto udp remote [blanked ddns] resolv-retry infinite nobind persist-key persist-tun dh dh4096.pem ca /etc/openvpn/synca.crt cert /etc/openvpn/wind.crt key /etc/openvpn/wind.key remote-cert-tls server comp-lzo verb 3 tls-auth ta.key 1 =========end client.conf for wind doug@wind:/etc/openvpn$ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default router 0.0.0.0 UG 0 0 0 eth0 10.8.1.0 10.8.1.9 255.255.255.0 UG 0 0 0 tun1 10.8.1.9 * 255.255.255.255 UH 0 0 0 tun1 link-local * 255.255.0.0 U 1000 0 0 eth0 192.168.0.0 * 255.255.255.0 U 1 0 0 eth0 doug@wind:/etc/openvpn$ <<<fire client>>> client.conf for fire: ======= client dev tun1 proto udp remote [blanked ddns] resolv-retry infinite nobind persist-key persist-tun dh dh4096.pem ca /etc/openvpn/synca.crt cert /etc/openvpn/fire.crt key /etc/openvpn/fire.key remote-cert-tls server comp-lzo verb 3 tls-auth ta.key 1 ========end client.conf for fire doug@fire:/etc/openvpn$ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default router 0.0.0.0 UG 0 0 0 eth0 10.8.1.0 10.8.1.13 255.255.255.0 UG 0 0 0 tun1 10.8.1.13 * 255.255.255.255 UH 0 0 0 tun1 link-local * 255.255.0.0 U 1000 0 0 eth0 192.168.0.0 * 255.255.255.0 U 1 0 0 eth0 doug@fire:/etc/openvpn$ Each of the three can ssh to and ping the other two. So I can ssh from fire to air and to wind like I need to so I can perform maintenance. See anything troublesome here? My next projects are to: set static 10.8.1.x addresses for each client; harden the security; and figure out exactly how the firewalls should look on the server and the three clients. I will ask about the firewalls separately. Thanks for all your help, JJK! :- Doug. ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
