Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to set up an OpenVPN network with two protected segments.

1) A developer network where all developers can reach each other machines. 2) A support network with two roles, supporter and client. Preferably clients can not initiate connections to the supporter, but the support can initiate connections to clients.

The easy way to set up this would be with two separate OpenVPN configurations, 2 key infrastructures etc.

However, I think this should be also possible with only one OpenVPN configuration, allowing people who are both supporter and developer to use only one certificate for both purposes.

How should I set this up?

(OpenVPN version 2.0.x, openSuse 11.1)

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

I've seen an openvpn deployment as server, where clients use pre-shared keys and certificates for authentication, with only one config file and each client with his certificate

further more, the traffic rules between the networks can be settled via netfilter

I'll try to install it this weekend and come up with a howto

@@@@ later edit

1 - follow http://www.openvpn.net/index.php/open-source/documentation/howto.html#pki for issuing certificates with the built-in tools of openvpn

2 - server config

local 1.2.3.4
port 1977
proto tcp
dev tap-server

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/certs/server.key
dh /etc/openvpn/certs/dh1024.pem

server 172.17.188.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/var/pool.txt
client-to-client
keepalive 10 120
#tls-auth /etc/openvpn/certs/ta.key 0
#cipher DES-EDE3-CBC
max-clients 10
persist-key
persist-tun
status /var/log/openvpn/server-status.log
log-append /var/log/openvpn/server.log
verb 3
mute 10

push "route 10.0.0.56 255.255.255.255"
#client-config-dir /etc/openvpn/var/routes

3 - on the client side, along with ca.crt and user.(key,csr,crt)

remote 1.2.3.4
client
dev tap
nobind
port 1977
proto tcp-client
persist-key
persist-tun
ping-timer-rem
ping-restart 60
ping 10 
verb 3
ca ca.crt
cert user.crt
key user.key

you can have various settings starting from this schema, following openvpn's examples

share|improve this answer
    
How are the developer and supporter network segmentated in this config? –  Peter Smit Oct 8 '09 at 15:02
    
separate openvpn (server) instances on different ports with ip addresses from different classes –  petre Oct 8 '09 at 16:13
add comment

Alternatively if the OpenVPN server is a Linux box, write some iptables rules to control the data flow.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.