OpenVPN Server-to-Server
Historical administrator reference. These instructions describe the older server installation. The Rocky Linux 9 server procedure has not yet been validated for this cluster. Preserve the deployed addresses, port, certificates, and routing rules when planning a migration. For workstation setup, use the OpenVPN client guide.
OpenVPN Server-to-Server
We installed OpenVPN on CentOS servers and successfully connected from Windows, Mac OS X, and Linux clients. Our next step was to set up a site-to-site VPN. A Google search led us to the following zeldor.biz website (see Useful Links and References). We adapted its configuration to our environment, which included openSUSE 13.1. To install OpenVPN on that older Linux version, we copied the version installed on CentOS 7.4 and adjusted the configuration file. Our network topology is shown below:
| Name | Site-A | Site-B |
| External IP | 128.6.224.216 | 128.6.24.173 |
| Internal subnet | 10.10.10.0/24 | 192.168.200.0/24 |
| tun0 IP | 10.0.0.1 | 10.0.0.2 |
As described above, we copied the /etc/openvpn directory from the CentOS server to the openSUSE server, recreated the server certificates (see the server installation guide), generated the vpn.key file, and adjusted the server.conf file
Site-A
To generate vpn.key, we used:
openvpn --genkey --secret /etc/openvpn/vpn.key
Configuration file for site A:
site-A server.conf:remote 128.6.24.173 float #change with your port port 1194 #You can use udp or tcp proto udp # "dev tun" will create a routed IP tunnel. dev tun ifconfig 10.0.0.1 10.0.0.2 persist-tun persist-local-ip comp-lzo ping 15 secret /etc/openvpn/vpn.key route 192.168.200.0 255.255.255.0 chroot /var/empty log /var/log/openvpn/openvpn.log #Log Level verb 3
Site-B
To configure site B, we copied the/etc/openvpn directory from the site A server to site B and adjusted the server.conf file. The configuration for site B is shown below:site-B server.conf:
remote 128.6.224.216 float #change with your port port 1194 #You can use udp or tcp proto udp # "dev tun" will create a routed IP tunnel. dev tun ifconfig 10.0.0.2 10.0.0.1 persist-tun persist-local-ip comp-lzo ping 15 secret /etc/openvpn/vpn.key route 10.10.10.0 255.255.255.0 chroot /var/empty log /var/log/openvpn/openvpn.log #Log Level verb 3
A cleaner setup would generate separate certificate files for site B and share only vpn.key between the sites. For our original setup, we used the copied files described above.
Firewall Configuration
We configured the firewall to block external connections to our servers while allowing these two servers to trust each other. For example, the site A firewall configuration contains:FW_TRUSTED_NETS="128.6.24.173"
This allows the two servers to connect to each other on all ports, so a separate rule for port 1154 is not needed in this configuration. To enable forwarding and masquerading, we specified tun0 as an external interface in the firewall configuration:
/etc/sysconfig/SuSEfirewall2 (site A firewall):FW_DEV_EXT = "enp5s0f1 tun0"We also assume that the custom rules line in the firewall configuration is uncommented and looks like this:
FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"
in the file /etc/sysconfig/scripts/SuSEfirewall2-custom
on site A, add the following lines to the function fw_custom_before_denyall()
site-A fw_custom_before_denyall:
fw_custom_before_denyall() { # could also be named "after_forwardmasq()"
# these are the rules to be loaded after IP forwarding and masquerading
# but before the logging and deny all section is set by SuSEfirewall2.
# You can use this hook to prevent the logging of annoying packets.
#example: prevent logging of talk requests from anywhere
#for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do
# iptables -A $chain -j DROP -p udp --dport 517:518
#done
# these are the rules to be loaded after the firewall is fully configured
#openvpn
iptables -A INPUT -s 0/0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.0.0.2 -d 10.10.10.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o enp10s0f1 -j MASQUERADE
iptables -A INPUT -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
#
iptables -A INPUT -s 0/0 -j DROP
true
}
site-A ifconfig:
[15:52:17] [root@rupc06:]# ifconfig
enp5s0f0 Link encap:Ethernet HWaddr 00:04:23:DC:B1:96
inet addr:192.168.100.6 Bcast:192.168.100.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:75475577 errors:0 dropped:170 overruns:0 frame:0
TX packets:17760898 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:34203479727 (32618.9 Mb) TX bytes:2320588877 (2213.0 Mb)
Interrupt:18 Memory:b8820000-b8840000
enp5s0f1 Link encap:Ethernet HWaddr 00:04:23:DC:B1:97
inet addr:128.6.224.216 Bcast:128.6.224.255 Mask:255.255.255.192
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:421111655 errors:0 dropped:6 overruns:0 frame:0
TX packets:217664199 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:490728867160 (467995.5 Mb) TX bytes:182685009433 (174222.0 Mb)
Interrupt:19 Memory:b8800000-b8820000
enp10s0f1 Link encap:Ethernet HWaddr A0:36:9F:0A:1C:16
inet addr:10.10.10.6 Bcast:10.10.10.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:9000 Metric:1
RX packets:162474871 errors:0 dropped:0 overruns:0 frame:0
TX packets:273765524 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1013412338643 (966465.3 Mb) TX bytes:1839483285266 (1754267.9 Mb)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:41446171 errors:0 dropped:0 overruns:0 frame:0
TX packets:41446171 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:38359535269 (36582.5 Mb) TX bytes:38359535269 (36582.5 Mb)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.0.1 P-t-P:10.0.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:3006466 errors:0 dropped:0 overruns:0 frame:0
TX packets:1119590 errors:0 dropped:114032 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:3908350634 (3727.2 Mb) TX bytes:645909065 (615.9 Mb)
On site B, add the following lines to the same function:
site-B fw_custom_before_denyall:
fw_custom_before_denyall() { # could also be named "after_forwardmasq()"
# these are the rules to be loaded after IP forwarding and masquerading
# but before the logging and deny all section is set by SuSEfirewall2.
# You can use this hook to prevent the logging of annoying packets.
#example: prevent logging of talk requests from anywhere
#for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do
# iptables -A $chain -j DROP -p udp --dport 517:518
#done
# these are the rules to be loaded after the firewall is fully configured
#openvpn
iptables -A INPUT -s 0/0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.0.0.1 -d 192.168.200.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o bond0 -j MASQUERADE
iptables -A INPUT -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
#
iptables -A INPUT -s 0/0 -j DROP
true
}
Output of ifconfig on site B:
site-B ifconfig:
[15:54:04]udo@rupc-caip-03:~>/sbin/ifconfig
bond0 Link encap:Ethernet HWaddr 0C:C4:7A:1D:9E:D0
inet addr:192.168.200.254 Bcast:192.168.200.255 Mask:255.255.255.0
UP BROADCAST RUNNING MASTER MULTICAST MTU:9000 Metric:1
RX packets:192590831 errors:0 dropped:2793357 overruns:0 frame:0
TX packets:138775294 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:489458504808 (466784.0 Mb) TX bytes:94196445053 (89832.7 Mb)
bond1 Link encap:Ethernet HWaddr 90:E2:BA:6F:8B:50
inet addr:192.168.100.254 Bcast:192.168.100.255 Mask:255.255.255.0
UP BROADCAST RUNNING MASTER MULTICAST MTU:9000 Metric:1
RX packets:8315085560 errors:0 dropped:0 overruns:0 frame:0
TX packets:6444832438 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:8114152229334 (7738258.5 Mb) TX bytes:3017768773044 (2877968.5 Mb)
enp1s0f0 Link encap:Ethernet HWaddr 0C:C4:7A:1D:9E:D0
UP BROADCAST RUNNING SLAVE MULTICAST MTU:9000 Metric:1
RX packets:101397312 errors:0 dropped:0 overruns:0 frame:0
TX packets:69384676 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:244307674331 (232989.9 Mb) TX bytes:47074809606 (44894.0 Mb)
enp1s0f1 Link encap:Ethernet HWaddr 0C:C4:7A:1D:9E:D0
UP BROADCAST RUNNING SLAVE MULTICAST MTU:9000 Metric:1
RX packets:91193519 errors:0 dropped:0 overruns:0 frame:0
TX packets:69390618 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:245150830477 (233794.0 Mb) TX bytes:47121635447 (44938.6 Mb)
enp5s0f0 Link encap:Ethernet HWaddr 90:E2:BA:6F:8B:50
UP BROADCAST RUNNING SLAVE MULTICAST MTU:9000 Metric:1
RX packets:5620897892 errors:0 dropped:0 overruns:0 frame:0
TX packets:3222407630 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3300228294889 (3147342.9 Mb) TX bytes:1508936400795 (1439033.8 Mb)
enp5s0f1 Link encap:Ethernet HWaddr 90:E2:BA:6F:8B:50
UP BROADCAST RUNNING SLAVE MULTICAST MTU:9000 Metric:1
RX packets:2694187668 errors:0 dropped:0 overruns:0 frame:0
TX packets:3222424808 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4813923934445 (4590915.6 Mb) TX bytes:1508832372249 (1438934.6 Mb)
enp8s0f0 Link encap:Ethernet HWaddr A0:36:9F:38:F9:E8
inet addr:128.6.24.173 Bcast:128.6.24.191 Mask:255.255.255.224
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:35504123 errors:0 dropped:4 overruns:0 frame:0
TX packets:165180734 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6475025892 (6175.0 Mb) TX bytes:241926281557 (230718.8 Mb)
Memory:fba00000-fbafffff
enp8s0f1 Link encap:Ethernet HWaddr A0:36:9F:38:F9:E9
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Memory:fb900000-fb9fffff
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:6299623 errors:0 dropped:0 overruns:0 frame:0
TX packets:6299623 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3427544629 (3268.7 Mb) TX bytes:3427544629 (3268.7 Mb)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.0.2 P-t-P:10.0.0.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:1597538 errors:0 dropped:0 overruns:0 frame:0
TX packets:3648225 errors:0 dropped:603 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1064927582 (1015.5 Mb) TX bytes:4606928636 (4393.5 Mb)
openvpn --config /etc/openvpn/vpn.conf
Then test the connection by running ping from site A to site B, for example:
[15:57:28]udo@rupc06:~>ping 10.0.0.2 PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data. 64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.641 ms 64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.580 ms ^C --- 10.0.0.2 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1000ms rtt min/avg/max/mdev = 0.580/0.610/0.641/0.039 ms [15:57:38]udo@rupc06:~>Ping works.
Next, test SSH access to a computer on the site B subnet:
[16:01:40]udo@rupc06:~>ssh 192.168.200.1 Last login: Mon Mar 12 13:46:06 2018 from rupc-caip-03 [16:01:45]udo@n01:~>This also works, indicating that forwarding is working. This completes the OpenVPN site-to-site setup.