OpenVPN SiteToSite

Languages:

English

Maintainer

Daniel B.
Firewall Services
mailto:daniel@firewall-services.com

Version

Devel 10:

0.2-20

Contrib 10:

0.2-19

Contrib 9:

0.2-8

smeserver-openvpn-s2s

The latest version of smeserver-openvpn-s2s is available in the SME repository, click on the version number(s) for more information.

Description

smeserver-openvpn-s2s lets you inter-connect several SME servers, and their local networks with secure VPN. It uses OpenVPN as backend.

Requirements

• SME Server 7.X / 8.X

Installation

• install the rpms

yum --enablerepo=smecontribs install smeserver-openvpn-s2s

Configuration

This contrib lets you create as many servers and clients daemon. A server can only be used by one client (it's not a one server for multiple clients solution), so if you wan't to connect several SME to one central server, you'll need to create several server daemon, binding on different ports. Once conected, OpenVPN makes no difference between client and server, we just need to define which endpoint will bind on a local port waiting for a connection of the remote endpoint.

Lets take a simple example. We manage two SME servers

• SME1
  • Local network: 192.168.9.0/24 (192.168.9.1 being the address of the internal interface of SME1)
  • Public DNS domain name: sme1.domain.tld (resolves to the public IP of SME1)

• SME2
  • Local network: 192.168.11.0/24 (192.168.11.1 being the address of the internal interface of SME2)
  • Public DNS domain name: sme2.domain.tld (resolves to the public IP of SME2)

Before the VPN inter-connection

Now, we want to connect both servers, so that the two private networks can see each other.

We will configure SME1 as a OpenVPN client and SME2 as an OpenVPN server. We'll use the shared secret method as it's easier to configure.

So, in SME1 server-manager, we'll have to add a new client (in OpenVPN Site to Site panel) and configure it like this:

Configure a new client daemon

Then, click on the next button, we'll have a page to configure the shared secret key. We can generate such keys using openvpn command (on your SME Server, or on another linux box. I'm not sure if we can do the same under Windows). To create a new key, type the following command on your shell:

openvpn --genkey --secret /dev/stdout

And copy the output in the page of the server-manager, like this:

Enter the secret key

Now, on SME2, we add a new server, and configure it like this:

Configure a new server daemon

On the next page, we have to enter the same key we've used on SME1

Here are the explanation of some settings:

• Daemon ID: just a unique identifier for this connection.
• Description: a human readable description (eg link between SME1 and SME2)
• Status: you can disable a VPN connection if you want, but most of the time you'll want it enabled
• Authentication mechanism: How both ends will authenticate. The easier solution is the Shared Key. You can also use TLS if you want, but it's usually for power users (you need to manage a PKI, you can use PHPki for this if you want)
• Remote Host (available on client only): IP or FQDN to the remote peer
• Remote Port (available on client only): port used by the remote server
• Local Port (available on server only): port on which the openvpn server will bind, waiting for connection of the remote peer. Remote Port on the client and Local Port on the server should be the same
• Local Virtual IP: the IP used internally by OpenVPN. You should choose a IP outside of any local networks
• Remote Virtual IP: the IP used internally by OpenVPN on the other side. Those two virtual IP should be reversed between the client and the server

	Note:
	You don't really need to remember the virtual IP, as once the connection is established, you'll use the internal IP to access the remote server through the VPN. You just need to choose two IP address which won't clash with any other local networks, then, just forget about it

• Remote Networks: Enter in this field the networks reachable through the other end point. For example, on SME1, you'll enter the local networks of SME2: 192.168.11.0/255.255.255.0, on SME2, you'll enter the local network of SME1: 192.168.9.0/255.255.255.0

Additional options

Some advanced settings are not available on the panel, but only with db commands:

Backup and Restore

You should backup the directories /etc/openvpn/s2s/priv and /etc/openvpn/s2s/pub keys and certificates used by this contrib are stored there.

Uninstall

If you want to remove the contrib, just run:

yum remove smeserver-openvpn-s2s

You can then remove the directory /etc/openvpn/s2s if you really want to remove everything (including the private keys and certificates)

Source

The source for this contrib can be found in the smeserver CVS on sourceforge.

Bugs

Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-openvpn-s2s component or use this link

---