4

I have two sites, A and B, like shown in the diagram below

+-+------------------------------------------------------------------+
| |            |OTHER DEVICES                                        |
| |            |:-)                    SITE A: 128.66.32.0/24  |     |
| |            +-------+               PUBLIC DNS: SITEA.EXAMPLE.ORG |
| |            |       |               PORT FORWARDING CUSTOMIZABLE  |
| |            |       |               DYNAMIC IP / DDNS             |
| +------------+       |                                             |
|                      |                                             |
| +---------------+----+-------------------+---------+-------------+ |
|                 |                        |         |               |
|  RASPBERRY PI   |         PRINTER        |         |    ROUTER/GW  |
|  128.66.32.18   |         128.66.32.3    |         |    128.66.32.1|
| +------------+  |        +----------+    |         |    +----------+
| |            |  |        |          |    |         |    |          |
| |            |  |        |          |    |         |    |          |
| |            +--+        |          +----+         +----+          |
| |            |           |          |                   |          |
+-+------------+-----------+----------+-------------------+----------+






 +-----------------------------+-------------+------------+----------+
 |  SITE B: 128.66.55.0/24     |             |            |          |
 |  NO DNS                     |             |            |          |
 |  FIREWALLED BY ISP    +-----+             |        +---+          |
 |  DYNAMIC IP           |     +-------------+        |   |          |
 |  PUBLIC IP 10.0.0.0/8 |      LAPTOP                |   |          |
 |                       |      DHCP                  |   +----------+
 |                       |                            |   ROUTER/GW  |
 |                       |                            |   128.66.55.1|
 |                       |                            |              |
 |  ++-------------------+-------------------+--------+-----------+  |
 |   |                                       |                       |
 |   |                                       |                       |
 |   |   NAS                                 |      RASPBERRY PI     |
 |   |   128.66.55.23                        |      128.66.55.18     |
 |   |  +-------------+                      |      +-----------+    |
 |   |  |             |                      |      |           |    |
 |   +--+             |                      +------+           |    |
 |      |             |                             |           |    |
 +------+-------------+-----------------------------+-----------+----+

What I basically want is to peerly connect the two sites. A VPN can allow me to access any host within A while being in B. In theory, a VPN link established between A and B should allow any device in A to type ping 128.66.55.x and see data.

Since I have two spare Raspberry Pi machines I want to unleash them and establish a permanent and transparent VPN link, so anybody will get a zero-configuration link between the two sites.

As you have seen, one of the sites is not addressable: can work only as a client because ISP provides a private IP address shared among several customers.

Homework I did

I have examined OpenVPN documentation and got an idea on how to configure the Pis one as server and one as client. Then while I wait for traveling to A to deploy the Raspberry server and port-forward it, I have other oubts. I will be ready to leave an SSH channel open to administer the Raspberry while I'm out.

Pending questions:

I am a bit rusty about networking, as I attended classes many years ago.

  • Can OpenVPN be used for peering two sites in a VPN? Or am I following the wrong path?
  • I know I need to have a routing rule between eth0 and tun adapters on both devices. Does OpenVPN do it for me or do I need to use iptables?
  • In order to make the VPN transparent, I don't remember if I have to set a static route on the main gateways (e.g. route 128.66.55.0/24 via 128.66.32.18) or the Raspberries should broadcast the route within their eth0 network. Which of the two?

Basically I need to remotely print, access NAS and so on

1
  • Here is how I do it on my RPi linux server, it isn't exactly what you want, but it might help you or others: My 404 page pings my other servers, and if it founds the failed directory, it redirects to that (and creates a fake directory with PHP redirection, so it only pings once if it exists). This is a bad approach, but it works, and it is just intranet of our home network.
    – ave
    Feb 18, 2016 at 0:01

1 Answer 1

4

Looks like I was correct in my design and on the good way. I am now answering my own question both to share knowledge and publish my thoughts, research and considerations for reference in future questions.

Thanks to this post I have found most of the answers to my questions. So let me summarize:

  • OpenVpn has setup for peering LANs

Our user had a openvpn server with a lan (10.10.2.0/24) behind it, and 2 client with lans behind them:

client1 with lan 10.10.1.0/24 client2 with lan 10.10.3.0/24

He wanted machines on all 3 lans to be able to communicate using a tun (routed) setup.

Every machine with a LAN behind it must have IP forwarding enabled. In this example that means the server, and client1/client2. The user needed the following in his server.conf:

route 10.10.1.0 255.255.255.0
route 10.10.3.0 255.255.255.0
push "route 10.10.2.0 255.255.255.0"
push "route 10.10.1.0 255.255.255.0"
push "route 10.10.3.0 255.255.255.0"
client-to-client

Simply need to adapt to my case: Server has to route only the networks it does not control, and push all. It's not so smart to dynamically push every LAN that connects to it. Not a problem because I am not implementing a scalable setup and I have only two LANs

  • OpenVpn takes care of routing on the Raspberry it's running on.

I have made an example within my own lan at B site. I assigned an A's IP address to Raspberry A, let her take a DHCP address from B on the same eth0 interface and then run both OpenVpn and an echo server. Then I connected Raspberry A, who had her B network IP address, to Raspberry A's address in B LAN. Finally, I could echo and watch it in the logs. Only caveat was that Raspberry A (echo server) saw connection from an IP in A range and not in B, so the LANs were not communicating.

  • Routes must be set at gateway, apparently. The article explains it well. Let me quote

Lets say our server is 10.10.2.10 on its lan, and uses 10.10.2.1 as its default route, and you want the 2.x lan to be accessible or able to access over the vpn. 2.1 would need a route for every network that 2.x will access or be accessed by. That means in our example: 10.10.2.1 must know that for 10.10.1.x 10.10.3.x and the vpn internal network (for example, 10.8.0.x), it sends the traffic to 10.10.2.10 This is true for any number of lans you want to connect, whether server or client.

If you fail to add this route, here is what would happen if a VPN client (for example, 10.8.0.6) wanted to send traffic to 10.10.2.20:

The vpn client sends traffic to 10.10.2.20, with a source address of 10.8.0.6
The vpn server (10.8.0.1 and 10.10.2.10) receives the traffic, has IP forwarding enabled, and passes the traffic to 10.10.2.20
10.10.2.20 gets it and tries to respond to 10.8.0.6 but has no entry in its routing table
Because 10.10.2.20 has no route for 10.8.0.6, it sends the traffic to its default gateway which is 10.10.2.1
10.10.2.1 checks its routing table, has no route for 10.8.0.6, and sends the traffic to its default gateway which is likely its ISP
The ISP ignores it, because it is a RFC 1918 ip (aka lan only)

Since I happen to have control on both gateways, setting a static route was the correct way

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .