Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running the main server for my company and would like to setup a VPN so that the remote offices (in different countries) could be in the same network.

I would like to achieve the following network structure:

   --------------                                   --------------
  | Remote Net 1 |  ------------------------------ | Remote Net 2 |
  | 192.168.2.X  |               |                 |  192.168.3.X |
   --------------                |                  --------------
                          |  The Internet |
                          | Local Network |
                          |  192.168.1.X  |

I would like it to be that all the computers are visible and can communicate and use the network services in the other LAN's (i.e. localnet can use file server in remote net 1 and a computer on remotenet 1 can use the file server from localnet)

Details: All clients using ubuntu 10.10 and main server running Debian Lenny Preferably VPN server will be OpenVPN

Could someone please advise me how I should go about implementing this system?

Help would be greatly appreciated, Thanks, RayQuang

share|improve this question
up vote 1 down vote accepted

If you run one client on each remote network, and have client-to-client enabled in the server config they can communicate with each others. To also let clients behind each gateway at remote network to communicate, you need to use 'iroute' through ccd.

If you don't intend to route all traffic through "local network", you probably need static routes per each side to know about the networks behind the other vpn ends. you can push the routes using the "push" command in the openvpn server config.

I would aim at first create a basic server config and connect the two remote sides. Once they can communicate with the server, you can use iroute (through ccd) and push routes to get them to find each others through the vpn server (and of course the networks behind the vpn server).

Hints: use udp, use tun, start without any additional settings for mtu/mssfix/fragment (run clients with --mtu-test in case of problems). Use a non 192.-network for the vpn communication.

You obviously need ip_forwarding and ACCEPT rules in iptables FORWARD chain for this to work, but apart from that I think it's a fairly simple setup.

There's excellent examples at

Edit 70: Like Harv said, it can make sense to connect Remote net 1 & 2 directly to each others.

share|improve this answer
Thanks for the answer, Ill try it out and let you know how it goes :), RayQuang – RayQuang Dec 10 '10 at 14:25

I would think the easiest way to do this would be to get actual VPN routers. Have one at each office, each on its own static IP. The two branch offices would connect to the main office. If you wanted to get a bit more fancy (and complex..) you would have each VPN router connect to each other VPN router.. I'm not sure how that would work though.

share|improve this answer
Thanks for your answer, However I would really like to use the existing network infrastructure to host the VPN server and just use the built in clients in ubuntu, If all else fails though I will have to use your solution. Thanks, RayQuang :) – RayQuang Dec 9 '10 at 12:53

I haven't used OpenVPN but I had used the IPSec Network-to-Network configuration to achieve a similar setup. In a network-to-network setup your clients wouldn't need a VPN client either. For them to access the hosts on other network would be like accessing a local host minus the latency. The IPSec end point would server as a IPSec router doing all the encryption and decryption.

I had used this setup to create IPSec tunnels between India and US and it worked very well for me.

If RHEL/CentOS is an option then setting this up would be a breeze. Just follow the guide. It is definitely possible in Debian/Ubuntu too but I don't have experience with them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.