We have a scenario where we would like to have a "Site to Site" VPN connection.
Our Scenario:
# Side-A
Router/GW : 192.168.1.1
WAN-Addr : site-a.sysadmins.co.za
Tunnel Interface: 10.0.0.1
# Side-B:
Router/GW : 192.168.2.1
WAN-Addr : site-b.sysadmins.co.za
Tunnel Interface: 10.0.0.2
Side A
Dependencies:
$ groupadd nogroup
$ yum install openvpn -y
``` <p>
**Firewall Configuration:**
```language-bash
iptables -A INPUT -i ppp0 -p udp --dport 8001 -j ACCEPT
iptables -A INPUT -p icmp -s 10.0.0.2 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.0.0.2 -d 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 192.168.2.0/24 -d 192.168.1.0/24 -j ACCEPT
``` <p>
**Enable IP Routing:**
```language-bash
echo 1 > /proc/sys/net/ipv4/ip_forward
``` <p>
**Set Persistent Static Routes:**
```language-bash
cat > /etc/sysconfig/network-scripts/route-tun0 << EOF
192.168.2.0/24 via 10.0.0.2
EOF
OpenVPN Config Side-A:
/etc/openvpn/server.conf
remote site-b.sysadmins.co.za
float
port 8001
dev tun
ifconfig 10.0.0.1 10.0.0.2
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo
ping 15
secret /etc/openvpn/vpn.key
route 192.168.2.0 255.255.255.0
#chroot /tmp/openvpn
user nobody
group nogroup
log-append /var/log/openvpn/vpn.log
verb 1
``` <p>
>#### Side-B:
**Dependencies:**
```language-bash
$ groupadd nogroup
$ yum install openvpn -y
``` <p>
**Firewall Configuration:**
```language-bash
iptables -A INPUT -i ppp0 -p udp --dport 8001 -j ACCEPT
iptables -A INPUT -p icmp -s 10.0.0.1 -j ACCEPT
iptables -A FORWARD -i tun0 -s 10.0.0.1 -d 192.168.2.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -s 192.168.1.0/24 -d 192.168.2.0/24 -j ACCEPT
``` <p>
**Set Persistent Static Routing:**
```language-bash
cat > /etc/sysconfig/network-scripts/route-tun0 << EOF
192.168.1.0/24 via 10.0.0.1
EOF
OpenVPN Config Side-B:
/etc/openvpn/server.conf
remote site-a.sysadmins.co.za
float
port 8001
dev tun
ifconfig 10.0.0.2 10.0.0.1
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo
ping 15
secret /etc/openvpn/vpn.key
route 192.168.1.0 255.255.255.0
#chroot /tmp/openvpn
user nobody
group nogroup
log-append /var/log/openvpn/vpn.log
verb 1
``` <p>
**Enable IP Routing:**
```language-bash
echo 1 > /proc/sys/net/ipv4/ip_forward
``` <p>
**Generate Security Key:**
Once generated, copy over to the other host:
```language-bash
# on site-a:
$ openvpn --genkey --secret /etc/openvpn/vpn.key
$ chmod 0400 /etc/openvpn/vpn.key
$ scp /etc/openvpn/vpn.key [email protected]:/etc/openvpn/vpn.key
``` <p>
**Start VPN at Boot:**
```language-bash
$ chkconfig openvpn on
$ service openvpn restart
$ vi /etc/default/openvpn
AUTOSTART="vpn"
As soon as openvpn has been started on both ends, the connection should be established, and you will be able to confirm to see if the tunnel interfaces is up which we have specified in the configuration.
Comments