On Saturday 02 July 2016 03:13 PM, Selva Nair wrote:
>
> On Sat, Jul 2, 2016 at 1:59 PM, Josu Lazkano <[email protected]
> <mailto:[email protected]>> wrote:
>
> Thanks Selva!
>
> It works, I remove the routes in the configuration files and execute
> this:
>
> ip route add 192.168.1.0/24 <http://192.168.1.0/24> dev tun0 src
> 192.168.2.10
> ip route add 192.168.2.0/24 <http://192.168.2.0/24> dev tun0 src
> 192.168.1.10
>
> Now it is working great, the only problem is that if I reboot the
> servers, the lost the routes, how could I add the routes every time
> that tunnel is up?
>
>
> Option 1: Leave the routes as before in the config and add a static
> route to the remote vpn ips on the routers:
> On router1:
> # ip route add 10.0.0.2/32 <http://10.0.0.2/32> via 192.168.1.10
> On router 2:
> # ip route add 10.0.0.1/32 <http://10.0.0.1/32> via 192.168.2.10
>
> Option 2: Set up the routes using a script with the "--route-up
> path-to-file" option. The file in this case could be a shell-script that
> runs
>
> #!/bin/sh
> /sbin/ip route add 192.168.2.0/24 dev ${dev} src
> 192.168.1.10
>
> on server 1. Similarly for server 2.
>
> The tun device name (tun0) will be exported as $dev by openvpn when the
> script is executed.
>
> You can also add a --route-pre-down script to tear down the route,
> though not really necessary in this case.
>
> I think option 1 is better.
Can you please explain why in your opinion Option 1 is _better_? I would
think that is is preferable to use the second option as it keeps all the
OpenVPN configuration together. By separating the routing part of the
tunnel from the tunnel itself, we could potentially create an admin
headache for the future.
Also, does OpenVPN also export other variables like the remote and local
IPs/Subnets, so that the route-up script could be written as below?
#!/bin/bash
IP="/sbin/ip"
REMOTE_IP=<${remote_IP}>
REMOTE_SUBNET=<${remote_SUBNET}>
LOCAL_IP=>${Local_IP}>
/sbin/ip route add ${REMOTE_IP}/${REMOTE_SUBNET} dev ${dev} src ${LOCAL_IP}
This ensures that the route-up script is completely independent of the
configuration and can thus be the same at both ends.
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
