+ Responder ao Tópico



  1. #1

    Padrão OpenVPN + Roteamento,

    Estou montando dois servers com OPENVpn, e tenho as seguitnes configuracoes:

    Matrix - ip

    eth0 172.17.0.1/24
    eth1 201.50.245.129/26
    tun1 10.17.0.1

    matriz.conf
    --dev tun1
    --port 5001
    ############## 10.17.0.1 - Empresa - VIT ##############
    ############## 10.17.0.2 - Empresa - RJO ##############
    --ifconfig 10.17.0.1 10.17.0.2
    --secret /etc/openvpn/Key/key
    --route-up "route add -net 172.17.1.0/24 gw 10.17.0.1"
    --log /etc/openvpn/OpenvpnVIT.log
    --comp-lzo
    --ping-restart 15
    --verb 3

    Filial - IP

    eth0 172.17.0.2/24
    eth1 201.210.10.191/26
    tun1 10.17.0.2

    Filial.conf

    --remote 201.50.245.129
    --dev tun1
    --port 5001
    ############## 10.17.0.1 - Empresa - VIT ##############
    ############## 10.17.0.2 - Empresa - RJO ##############
    --ifconfig 10.17.0.2 10.17.0.1
    --secret /etc/openvpn/Key/key
    --route-up "route add -net 172.17.0.0/24 gw 10.17.0.2"
    --log /etc/openvpn/OpenvpnRJO.log
    --comp-lzo
    --ping-restart 15
    --verb 3


    em ambas as maquinas dei o comando

    echo >1 /proc/sys/net/ipv4/ip_forward

    consigo fazer a conexao entre as duas, da filial pingo a interface tun1 e a da rede interna da Matriz e Vice-versa, porem nao consigo pingar as maquinas da rede interna, estou utilizando oTuxfrw 2.62, mesmo eu desativando o Tuxfrw, nao consigo pingar as maquinas, alguem pode me ajudar,

    grato

    Marcelo

  2. #2

    Padrão

    Amigo...
    Da uma olhadinha aqui nessa documentação do OpenVPN --> HOWTO

    Ela fala exatamente do que você esta precisando!
    Falta alguma configuração para que o que você quer funcione!
    Faloww

  3. #3

    Padrão roteamento openvpn

    Ola,

    Para que sua configuracao funcione com os ips que vc tem na eth0 da matriz e da filial, seria necessario que o openvpn estivesse configurado para funcionar em modo bridge, pois a os ips estao na mesma rede 172.17.0.0/24. Observando que neste caso nao pode existir duplicadade de ips entre os computadores da matriz e os computadores da filial.

    Matriz - ip

    eth0 172.17.0.1/24 -------> mesma rede usada na filial
    eth1 201.50.245.129/26

    Filial - IP

    eth0 172.17.0.2/24 -------> mesma rede usada na matriz
    eth1 201.210.10.191/26

    Agora se for o caso, vc pode mudar a configuracao da rede ip ou da matriz ou da filial. Neste caso sera preciso adicionar na configuracao do openvpn uma opcao chamada ccd, em que vc determina a rede por traz de um ponto da vpn. O servidor faz a rota entre as duas redes de forma transparente.

    Os passos para fazer este tipo de configuracao estao explicados na documentacao do Openvpn.

  4. #4

    Padrão

    Você pode fazer essa configuração funcionar em modo ROTEADO também!
    Não é preciso ser em modo bridge!
    É preciso acrescentar um parametro na configuração do cliente chamado iroute!
    Que irá indicar a rede interna! O OpenVPN saberá então que essa rede precisa ser roteada para um
    determinado local!
    Última edição por zenun; 17-08-2008 às 17:08. Razão: Mais informação...

  5. #5

    Padrão

    Aqui está o procedimento completo para fazer isso...
    Tirado do site do OpenVPN:

    Código :
    [B]Including multiple machines on the client side when using a routed VPN (dev tun)[/B]
     
      In a typical road-warrior or remote access scenario, the client machine connects to the VPN as a single machine. But suppose the client machine is a gateway for a local LAN (such as a home office), and you would like each machine on the client LAN to be able to route through the VPN.
      For this example, we will assume that the client LAN is using the [B]192.168.4.0/24[/B] subnet, and that the VPN client is using a certificate with a common name of [B]client2[/B]. Our goal is to set up the VPN so that any machine on the client LAN can communicate with any machine on the server LAN through the VPN.
      Before setup, there are some basic prerequisites which must be followed:
     
    [LIST][*]The client LAN subnet (192.168.4.0/24 in our example) must not be exported to the VPN by the server or any other client sites which are using the same subnet. Every subnet which is joined to the VPN via routing must be unique.[*]The client must have a unique Common Name in its certificate ("client2" in our example), and the [B]duplicate-cn[/B] flag must not be used in the OpenVPN server configuration file.[/LIST]
      First, make sure that [URL="http://openvpn.net/faq.html#ip-forward"]IP[/URL] and [URL="http://openvpn.net/faq.html#firewall"]TUN/TAP[/URL] forwarding is enabled on the client machine.
      Next, we will deal with the necessary configuration changes on the server side. If the server configuration file does not currently reference a client configuration directory, add one now:[INDENT][B]client-config-dir ccd[/B][/INDENT]In the above directive, [B]ccd[/B] should be the name of a directory which has been pre-created in the default directory where the OpenVPN server daemon runs. On Linux this tends to be [B]/etc/openvpn[/B] and on Windows it is usually [B]\Program Files\OpenVPN\config[/B]. When a new client connects to the OpenVPN server, the daemon will check this directory for a file which matches the common name of the connecting client. If a matching file is found, it will be read and processed for additional configuration file directives to be applied to the named client.
      The next step is to create a file called [B]client2[/B] in the [B]ccd[/B] directory.  This file should contain the line:[INDENT][B]iroute 192.168.4.0 255.255.255.0[/B][/INDENT]This will tell the OpenVPN server that the 192.168.4.0/24 subnet should be routed to [B]client2[/B].
      Next, add the following line to the main server config file (not the [B]ccd/client2[/B] file):[INDENT][B]route 192.168.4.0 255.255.255.0[/B][/INDENT]Why the redundant [B]route[/B] and [B]iroute[/B] statements, you might ask? The reason is that [B]route[/B] controls the routing from the kernel to the OpenVPN server (via the TUN interface) while [B]iroute[/B] controls the routing from the OpenVPN server to the remote clients.  Both are necessary.
      Next, ask yourself if you would like to allow network traffic between client2's subnet (192.168.4.0/24) and other clients of the OpenVPN server. If so, add the following to the server config file.[INDENT][B]client-to-client
    push "route 192.168.4.0 255.255.255.0"[/B][/INDENT]This will cause the OpenVPN server to [I]advertise[/I] client2's subnet to other connecting clients.
      The last step, and one that is often forgotten, is to add a route to the server's LAN gateway which directs 192.168.4.0/24 to the OpenVPN server box (you won't need this if the OpenVPN server box [I]is[/I] the gateway for the server LAN). Suppose you were missing this step and you tried to ping a machine (not the OpenVPN server itself) on the server LAN from 192.168.4.8? The outgoing ping would probably reach the machine, but then it wouldn't know how to route the ping reply, because it would have no idea how to reach 192.168.4.0/24. The rule of thumb to use is that when routing entire LANs through the VPN (when the VPN server is not the same machine as the LAN gateway), make sure that the gateway for the LAN routes all VPN subnets to the VPN server machine.
      Similarly, if the client machine running OpenVPN is not also the gateway for the client LAN, then the gateway for the client LAN must have a route which directs all subnets which should be reachable through the VPN to the OpenVPN client machine.

    Falowww

  6. #6

    Padrão Openvpn e roteamento

    Esta faltando informacao zenum ...

  7. #7

    Padrão

    Citação Postado originalmente por amaia Ver Post
    Esta faltando informacao zenum ...
    Qual?

  8. #8

    Padrão openvpn + roteamento

    Faltou deixar claro que precisa ter dentro do diretorio ccd um arquivo com o nome do cliente, mas o nome do cliente neste caso eh o nome do qual o certificado foi gerado, nao o nome que o cliente dah para o certificado no arquivo de configuracao.

    Numa traducao literal da parte da documentacao que vc colocou ele cita que precisa ter um arquivo dentro do diretorio ccd, e dentro deste arquivo a opcao iroute

  9. #9

    Padrão

    Claro meu amigo!
    Mas isso esta descrito na documentação ali!
    E pensando no fato de que ele já possui uma instalação OpenVPN deveria estar claro o suficiente!

  10. #10

    Padrão openvpn + roteamento

    Concordo plenamente.