On Sun, Jul 3, 2016 at 12:36 AM, Sachin Garg <[email protected]>
wrote:
> >
> >
> > Option 1: Leave the routes as before in the config and add a static
> > route to the remote vpn ips on the routers:
> > On router1:
> > # ip route add 10.0.0.2/32 <http://10.0.0.2/32> via 192.168.1.10
> > On router 2:
> > # ip route add 10.0.0.1/32 <http://10.0.0.1/32> via 192.168.2.10
> >
> > Option 2: Set up the routes using a script with the "--route-up
> > path-to-file" option. The file in this case could be a shell-script that
> > runs
> >
> > #!/bin/sh
> > /sbin/ip route add 192.168.2.0/24 dev ${dev} src
> > 192.168.1.10
> >
> > on server 1. Similarly for server 2.
> >
> > The tun device name (tun0) will be exported as $dev by openvpn when the
> > script is executed.
> >
> > You can also add a --route-pre-down script to tear down the route,
> > though not really necessary in this case.
> >
> > I think option 1 is better.
>
> Can you please explain why in your opinion Option 1 is _better_? I would
> think that is is preferable to use the second option as it keeps all the
> OpenVPN configuration together. By separating the routing part of the
> tunnel from the tunnel itself, we could potentially create an admin
> headache for the future.
I prefer option 1 because (i) I do not like scripts run with admin
privileges; (ii) the OP's setup needs static routes on the routers anyway,
so adding one more on each router is easy to manage. It also keeps the
required routing statements in the config and no external scripts to bother
about. That said, choose whatever suits your needs.
Also, does OpenVPN also export other variables like the remote and local
> IPs/Subnets, so that the route-up script could be written as below?
>
Yes it does. Please see the "Environmental Variables" section in the man
page.
>
> #!/bin/bash
>
> IP="/sbin/ip"
> REMOTE_IP=<${remote_IP}>
> REMOTE_SUBNET=<${remote_SUBNET}>
>
> LOCAL_IP=>${Local_IP}>
>
> /sbin/ip route add ${REMOTE_IP}/${REMOTE_SUBNET} dev ${dev} src ${LOCAL_IP}
>
> This ensures that the route-up script is completely independent of the
> configuration and can thus be the same at both ends
>
For that leave the route statement in the configs, add --route-noexec and
then use $route_network_1, $route_netmask_1 and $route_gateway_1 exported
by openvpn. To have a common script is a little more work as the local ip
to be used as the source address will have to be determined some other way.
Selva
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
