Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to set up an OpenVPN network with two protected segments.

1) A developer network where all developers can reach each other machines. 2) A support network with two roles, supporter and client. Preferably clients can not initiate connections to the supporter, but the support can initiate connections to clients.

The easy way to set up this would be with two separate OpenVPN configurations, 2 key infrastructures etc.

However, I think this should be also possible with only one OpenVPN configuration, allowing people who are both supporter and developer to use only one certificate for both purposes.

How should I set this up?

(OpenVPN version 2.0.x, openSuse 11.1)

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I've seen an openvpn deployment as server, where clients use pre-shared keys and certificates for authentication, with only one config file and each client with his certificate

further more, the traffic rules between the networks can be settled via netfilter

I'll try to install it this weekend and come up with a howto

@@@@ later edit

1 - follow for issuing certificates with the built-in tools of openvpn

2 - server config

port 1977
proto tcp
dev tap-server

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/certs/server.key
dh /etc/openvpn/certs/dh1024.pem

ifconfig-pool-persist /etc/openvpn/var/pool.txt
keepalive 10 120
#tls-auth /etc/openvpn/certs/ta.key 0
#cipher DES-EDE3-CBC
max-clients 10
status /var/log/openvpn/server-status.log
log-append /var/log/openvpn/server.log
verb 3
mute 10

push "route"
#client-config-dir /etc/openvpn/var/routes

3 - on the client side, along with ca.crt and user.(key,csr,crt)

dev tap
port 1977
proto tcp-client
ping-restart 60
ping 10 
verb 3
ca ca.crt
cert user.crt
key user.key

you can have various settings starting from this schema, following openvpn's examples

share|improve this answer
How are the developer and supporter network segmentated in this config? – Peter Smit Oct 8 '09 at 15:02
separate openvpn (server) instances on different ports with ip addresses from different classes – petre Oct 8 '09 at 16:13

Alternatively if the OpenVPN server is a Linux box, write some iptables rules to control the data flow.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.