Connecting multiple sites through OpenVPN

Question

I am managing three distinct geographical sites which I would like to connect using a central OpenVPN server.

My idea would be to have a network device on each location connect to the OpenVPN server and route specific network traffic through it. I have already split the subnets ( 10.23.1.0/24, 10.23.2.0/24, 10.23.3.0/24 ) so that each location gets a distinct private subnet.

However, it is not clear to me what the networking setup should look like. My first guess would be:

OpenVPN server:

• has IPV4 forwarding enabled
• routes 10.23.1.0/24 to Site A VPN client
• routes 10.23.2.0/24 to Site B VPN client
• routes 10.23.3.0/24 to Site C VPN client

Site A VPN Client:

• has IPV4 forwarding enabled
• routes 10.23.1.0/24 to internal network
• routes 10.23.2.0/24 to OpenVPN Server
• routes 10.23.3.0/24 to OpenVPN server

(Site B and C VPN clients are similar)

Is that a correct way of approaching the issue? Am I missing anything in terms of functionality/security when doing this?

Answer 1

I've based my setup on the following guide: Lans behind OpenVPN.

The first change needed was to enable the client-config-dir setting in my server's configuration

client-config-dir ccd

In that directory, for the site A VPN client I marked it as the internal owner of that route

iroute 10.23.1.0 255.255.255.0

Then, I switched to a subnet topology ( still not the default ), defined and pushed the internal routes to all the clients:

topology subnet
route 10.23.1.0 255.255.255.0
push "route 10.23.1.0 255.255.255.0 vpn_gateway 1000"

I specifically set a higher metric for the VPN route ( 1000 ) so that devices connected to that network directly do not use it. At least on my local workstation the default metrics are 100 for ethernet and 600 for wireless, so the VPN is used only if none of those are present.

Of course, ipv4 forwarding is enabled on the network devices.

With that being done, all is working as expected.