Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Debian server in my home office. I have two clients that I would like to connect my network to theirs over the internet. I also have two similar debian servers in each of their locations. All of our networks are using seperate net blocks. Mine at home is 172.16.120.x, and the other two are 192.168.0.x and 192.168.1.x. I would like to connect all three of these networks together using my linux servers. Is this possible? If so, what program/protocol would I use? I have webmin on all three of these servers also if there is a built-in program that would be make things much easier.

Btw, none of these networks have the Debian box acting as the DHCP server. They are all using external hardware routers.

Just to add, all of my servers are behind the router/firewall and do not have external IP addresses.

share|improve this question
1  
It sounds like there's something else you want to be doing. Please ask that instead. –  Ignacio Vazquez-Abrams Oct 22 '10 at 20:45
    
What do you mean? I basically just want to bridge two networks together over the internet. –  muncherelli Oct 22 '10 at 20:48
    
You never never never bridge multiple clients together over your network. That is a terrible policy. –  Ignacio Vazquez-Abrams Oct 22 '10 at 20:53
    
I really like OpenVPN for site-to-site VPNs. It works wonderfully on Debian. Search the web and this site for lots of information. –  Zoredache Oct 23 '10 at 20:34

2 Answers 2

up vote 1 down vote accepted

It is possible.

You would need:

  • Ports opened to pass VPN traffic through to the Debian boxes
  • IPSEC configuration on each machine
  • IPSEC userspace tools installed (ipsec-tools (and a kernel with it supported, so > 2.5.7))
  • A guide like http://lartc.org/howto/lartc.ipsec.html
  • Lots of fiddling with config files

Then, on your router/default gateway, add static routes for the remote subnets pointing to the Debian boxes.

The configuration isn't that bad, but if you've never dealt with IPSEC VPNs before it may be a confusing mess (but then, it is Linux, so everything is ;) )

On the last (and only) server I got it working on, there were six files involved, which I include below, in a censored fashion. Where I've put *local_ip* was the ip address of the local server, and where I've put *remote_ip* was the ip address of the remote server, and this config was for secure communication between two machines on the same network, so the config isn't going to be right for you with NAT and multiple machines involved.

You will need to mirror the config on either side (so, swapping the local_ip and remote_ip bits on one server), and also find where you need to put public IPs to get it working over the internet.

Anyway, if you want to get it working, be prepared to spend some hours faffing with it, because it might well take that. VPNs are not really click and drag, unless you buy expensive firewall kit.

/etc/sysconfig/network-scripts/ifcfg-ipsec0

DST=remote_ip
TYPE=IPSEC
ONBOOT=yes
IKE_METHOD=PSK

/etc/sysconfig/network-scripts/keys-ipsec0

IKE_PSK="passphrase"

/etc/racoon/psk

remote_ip  passphrase

/etc/racoon/racoon.conf

path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk";
path certificate "/etc/racoon/certs";

# log debug2;

listen
{
    isakmp local_ip;
}

include "/etc/racoon/remote_ip.conf";

/etc/racoon/setkey.conf

#!/sbin/setkey -f
flush;
spdflush;

#Add the policy
#This policy applies to inbound traffic from remote
spdadd remote_ip/32 local_ip/32 any -P in ipsec esp/transport//require;
spdadd remote_ip/32 local_ip/32 any -P in ipsec ah/transport//require;

#This policy applies to outbound traffic to remote
spdadd local_ip/32 remote_ip/32 any -P out ipsec esp/transport//require;
spdadd local_ip/32 remote_ip/32 any -P out ipsec ah/transport//require;

/etc/racoon/remote_ip.conf

remote remote_ip
{
    exchange_mode main;
    my_identifier address local_ip;
    proposal {
        encryption_algorithm 3des;
        hash_algorithm sha1;
        authentication_method pre_shared_key;
        dh_group 2;
        lifetime time 8 hours;    
    }
}

sainfo address local_ip any address remote_ip any
{
    authentication_algorithm hmac_sha1;
    encryption_algorithm 3des;
    compression_algorithm deflate;
}

sainfo address remote_ip any address local_ip any
{
    authentication_algorithm hmac_sha1;
    encryption_algorithm 3des;
    compression_algorithm deflate;
}
share|improve this answer
    
I have since learned that in one distribution (CentOS 6.5, I think), the two ESP/AH lines need to merge into one, e.g. """spdadd remote_ip/32 local_ip/32 any -P in ipsec esp/transport//require esp/transport//require;""" –  TessellatingHeckler Nov 23 '10 at 15:19

It sounds like you want a site-to-site VPN, from each client to you. You may or may not want the two clients connected to each other.

That's not "bridging", but I think I understand what you're getting at. Read up on the documentation for the border devices at each of the three sites, and figure out how to make a VPN from their sites to yours.

This is entirely independent of the servers inside of each network. Once the gateways or other border devices have created the VPN tunnels, you can do what you need to do.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.