My company is about to expand onto additional, agile (and small) branches.
I have created a topology illustrated in picture 1:
Notice how I am completely going to skip anything that is not VPN database connections related, therefore no general web pages internet access etc. are to be discussed (it's all up and running already).
As of today, a number of clients work on a slave Ubuntu MySQL database server. Nothing special, the server has port 3306 open and it's not seen from outside the LAN, the clients connect straight to it. The slave MySQL server has an Openswan + xl2tpd + ppp (ms-chap) VPN connecting it to a remote WEB + DB server overseas. Internet customers connect to that server and create orders etc. etc.
Most stuff on the WEB + DB server is quite updated: recent Nginx, MySQL 5.6.12, Openswan 2.6.37 based on NetKey + PSK, PHP 5.4+ etc. The server itself is an Ubuntu 12.04.02 LTS machine I am also the admin of.
As of today everything is running like a charm.
But as I pointed at in the opening statement, we are to add some branches. Since they mostly consist of roaming business agents, the only infrastructure they are going to get are Windows 7+ laptops each connecting to the overseas main server via IPSEC VPN over an ADSL router. Each branch will have an internal 192.168.XX.YY LAN of course. Each agent has to be able to connect from everywhere (including his branch) a la "Road Warrior" and thus each Windows client has to connect to the main server with its own VPN.
As of today I have created a test Windows 8 VPN to the main server and it works.
To make matters a bit more complicated, I have also to add a second computer in the main branch and that second computer has to connect to the overseas server via VPN as well.
The new, expanded topology will have to be the one shown at picture 2:
Considering most Openswan and IPSec material I have found is dated 2004-2009, I am going to ask the experts on this website for their most appreciated suggestions:
1) Regarding the main branch: how do I make the second computer connect to the overseas server? I have read that it's impossible to connect two or more computers sitting on the same LAN. That's years old references though.
- Is it still true?
- Any functioning workaround?
- I may change routers to Netgear based stuff (not Cisco) in case some features are needed.
2) Regarding the additional branches:
same as above. I must make Windows laptops connect to the overseas server through a VPN channel, they may or may not sit on the same internal network (may = business agent in the office, may not = when he's working away from the office).
I have also read that IPSEC VPN won't work if all the branches each have the same 192.168.X.Y network. Shall I just configure those branches to be i.e. on 192.168.0.X, 192.168.1.X, 192.168.2.X and so on? Is it enough for the VPN server to discern the callers?
any hint about how to create the configuration for the server to discern those callers basing on their third octect?
One thing is sure: the boss is not going to accept a "it's not possible" reply on any of the asked features.
Thank you in advance, even just for having endured reading this epic wall of text.