OpenVPN Site to Site Tunnel
This is an example of openvpn site to site routed tunnel configuration. Both sites are using different network subnets and route traffic between them. There is no NAT between the sites, it's a fully routed network and any device in Site 1 can ping any device in Site 2.
| Site | Network | OpenVPN |
|---|---|---|
| Site 1 | 192.168.0.0/16 | Server |
| Site 2 | 10.0.0.0/16 | Client |
Uses Client Config Directive ccd to setup iroute for the client subnets. This example expects site2 as the CN for the client certificate. The client certificate CN should match the filename in the ccd directory.
OpenVPN Server Config in Site 1
# OpenVPN config Site 1
# Filename: /etc/openvpn/server.conf
# Site 1 runs OpenVPN server, subnet 192.168.0.0/16
port 1194
proto udp
dev tun
dh dh.pem
ca ca.crt
tls-crypt ta.key
cert ovpn-server.crt
key ovpn-server.key
server 10.8.0.0 255.255.255.0
topology subnet
ifconfig-pool-persist ipp.txt
# Route Site 2 site-to-site via the tunnel
# See iroute in /etc/openvpn/ccd/site2
route 10.0.0.0 255.255.0.0
# Set this to internal network
push "route 192.168.0.0 255.255.0.0"
# Permit mutiple clients with same client cert
# duplicate-cn
keepalive 10 120
# Notify the client when the server restarts so it can auto reconnect
explicit-exit-notify 1
cipher AES-256-CBC
data-ciphers 'AES-256-CBC'
data-ciphers-fallback 'AES-256-CBC'
auth SHA256
max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
client-config-dir ccd
# Authentiate users with both password and google-authenticator 2FA
# Clients have to enter password and 2fa token in the password prompt
#plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn
# Email root on user connct/disconnect
#script-security 2
#client-connect /etc/openvpn/client-connect.sh
#client-disconnect /etc/openvpn/client-disconnect.sh
# Ensure username and certificate name are same, users cannot share certs
#auth-user-pass-verify /etc/openvpn/auth-cn-user.sh via-env# File name: /etc/openvpn/ccd/site2
# Ensure certificate CN is set to `site2
# Site 2 subnet
iroute 10.0.0.0 255.255.0.0OpenVPN Client Config Site 2
; OpenVPN client config
client
dev tun
proto udp
remote vpn.example.com
tls-crypt [inline]
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
; auth-user-pass
auth-nocache
reneg-sec 0
remote-cert-tls server
cipher AES-256-CBC
data-ciphers 'AES-256-CBC'
data-ciphers-fallback 'AES-256-CBC'
auth SHA256
verb 3
<ca>
</ca>
<cert>
</cert>
<key>
</key>
<tls-crypt>
</tls-crypt>Testing
To test, from OpenVPN server, ping the LAN IP of the OpenVPN client.
Use ip route to display the kernel routing table.