up vote 0 down vote favorite
share [g+] share [fb]

I am new to OpenVPN - I just know how to set up a basic tunnels between two computers, but now i am assigned with a lot harder task.

I need to set up a special VPN:

I got hosts A, B, C and D and all of them are Windows XP SP 1/2/3 with OpenVPN installed. I need to create a tunnels like this:

A == B == C == D

i.e. tunnel between A and B, tunnel between B and C etc. The main purpose of this setup will be the user who will access A to tunnel through all the tunnels and will "get out" from D :

user -> A=->=B=->=C=->=D -> Internet

Questions:

How to set up the tunnels like that so they will allow that kind of routing the traffic ?

The VPN servers must not leak the internal network structure.

I will really appreciate your help. Thank you in advance.

link|improve this question
You can do this. It's not particularly difficult, just remember you need to enable routing and add routes at each step along the way. But my question is what are you trying to accomplish like this, because it seems like there must be a more elegant way of accomplishing what you're trying to accomplish. – emgee Aug 21 '09 at 17:50
I know i can do it, but i just don't know how to start. Can you at least point me to some place where i can learn more about openvpn possibilitis ? – piro Aug 21 '09 at 18:03
Right, it seems to be a hard way to accomplish some site to site VPN. If you need to know more about openvpn, please check google for openvpn server to server. – mezgani Aug 21 '09 at 18:23
feedback

2 Answers

up vote 1 down vote

Ok, lets try to break it down a bit more.

You've said that you already know how to create a VPN? connection from one computer to another. So lets start with this.

  1. Setup a VPN connection between A <==> B
  2. Setup a VPN connection between B <==> C
  3. Setup a VPN connection between C <==> D

Once that has been accomplished, the only thing left to do is setup the proper routes.

I am going to assume that you do not want ALL traffic to be going thru your VPN tunnel. In other words, you want two ways out of each machine, one is regular "internet" traffic, and the other is your "VPN" traffic, right? Well, we need to create some routes on each host. For example, if A is 192.168.1.1/24, and B is 192.168.2.1/24, and C is 192.168.3.1/24 and D is 192.168.4.1/24 then each system must know which endpoint they need to forward the traffic to.

So, if you are on A, trying to Get to D, you need to direct all traffic to go thru B. so your route command on a linux system might be something like:

route add -net 192.168.3.1 mask 255.255.255.0 gateway 192.168.2.1 (traffic for C goes thru B)

route add -net 192.168.4.1 mask 255.255.255.0 gateway 192.168.2.1 (traffic for D goes thru B)

Thats just a rough breakdown, but each system will have routes that tell it that traffic for each subnet needs to be forwarded to the next host in the chain.

This is just a jist of it, if i try to break it down further this post will never end.

link|improve this answer
feedback
up vote 0 down vote

There's an example of how to setup a VPN with more complicated routing at OpenVPN Routing. What you're asking for is not that conceptually difficult, you just need to stack the routing layers on top of one another and get all the details right.

link|improve this answer
Thanks for your help. I read the link and i found some simmilarities with my problem, except for one thing - I need to make a chain of two vpn servers and when a client connects to the first one it will route the traffic to the second one and this one will accept and route the traffic to the internet? I think i was clear enough. – piro Aug 21 '09 at 20:57
feedback

Your Answer

 
or
required, but never shown
discard