Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to setup a VPN between two small office network :

1st Network : ADSL Router with DHCP - 3 Server(Static IP) - 20 WorkStation(DHCP)

2nd Network : ADSL Router with DHCP - 1 Server(Static IP) - 5 WorkStation(DHCP)

I wanna insert in each network a Linux OpenVPN Server for linking this two small network, for this scenario wich type of VPN is better ? Bridged or Routed ?

If i bride this two network, could i have some problem with two DHCP Server ?

I Want that the client of 1st Network get IP Address from DHCP Server located in 1st Network and not also from DHCP Server located in the 2nd Network...

share|improve this question

2 Answers 2

up vote 0 down vote accepted

To keep this as easy as possible, make sure that the two offices are on different subnets, e.g. 192.168.10.0/24 for the first one and 192.168.20.0/24 for the second one. Then use OpenVPN to build the VPN connection, using a completely separate subnet (e.g. 192.168.254.0/24). Then add routes for the office of the other network to thew ADSL router, pointing at the machine running the OpenVPN Server/Client.

Now you have the following situation:

  1. Traffic from network 1 for network 2 will go the ADSL router (the default gateway), which routes them to the OpenVPN machine, and from there they go through the tunnel.
  2. Traffic from network 2 for network 1 will do the same
  3. Return traffic will also follow the routes.
  4. Computers in need of an IP address use broadcasting, which cannot go across network boundaries (unless you have a DHCP proxy in place). This guarantess that computers on network 1 will always receive their IP settings from the DHCP server on network 1.

I would recommend bridged networking for the OpenVPN instances, but, since they are not located on your default gateways, the extra routes are still needed.

share|improve this answer

You definitely don't want to bridge the networks. All that broadcast traffic and you want to keep both networks separate for security and administrative purposes.

I'd argue that it makes more sense to get two good perimeter router/firewalls (losing the ADSL routers) that support site-to-site IPSec tunnels instead of buying two OpenVPN servers with an arguably more complex routing configuration, two more servers to manage, etc.

Almost every "business class" router/firewall these days supports IPSec tunnels; pick your favourite vendor or buy an ALIX-based pfSense firewall kit from NetGate for less than $250.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.