Difference between revisions of "OpenVPN SiteToSite"
m (→Screenshots) |
m (→Configuration) |
||
| Line 30: | Line 30: | ||
Once conected, OpenVPN makes no difference between client and server, we just need to define which endpoint will bind on a local port waiting for a connection of the remote endpoint. | Once conected, OpenVPN makes no difference between client and server, we just need to define which endpoint will bind on a local port waiting for a connection of the remote endpoint. | ||
| − | Lets take a simple example. | + | Lets take a simple example. We manage two SME servers |
* SME1 | * SME1 | ||
** Local network: 192.168.9.0/24 (192.168.9.1 being the address of the internal interface of SME1) | ** Local network: 192.168.9.0/24 (192.168.9.1 being the address of the internal interface of SME1) | ||
| Line 41: | Line 41: | ||
[[File:Ovpn_s2s_rzo_avant_vpn.png|768px|thumb|center|Before the VPN inter-connection]] | [[File:Ovpn_s2s_rzo_avant_vpn.png|768px|thumb|center|Before the VPN inter-connection]] | ||
| − | Now, | + | Now, we want to connect both servers, so that the two private networks can see each other. |
| − | + | We will configure SME1 as a OpenVPN client and SME2 as an OpenVPN server. We'll use the shared secret method as it's easier to configure. | |
| − | So, in SME1 server-manager, | + | So, in SME1 server-manager, we'll have to add a new client (in OpenVPN Site to Site panel) and configure it like this: |
[[File:Ovpn_s2s_add_client.png|768px|thumb|center|Configure a new client daemon]] | [[File:Ovpn_s2s_add_client.png|768px|thumb|center|Configure a new client daemon]] | ||
| − | Now, on SME2, add a new server, and configure it like this: | + | Then, click on the next button, we'll have a page to configure the shared secret key. We can generate such keys using openvpn command (on your SME Server, or on another linux box. I'm not sure if we can do the same under Windows). To create a new key, type the following command on your shell: |
| + | |||
| + | openvpn --genkey --secret /dev/stdout | ||
| + | |||
| + | And copy the output in the page of the server-manager, like this: | ||
| + | |||
| + | [[File:Ovpn_s2s_shared_secret.png|768px|thumb|center|Enter the secret key]] | ||
| + | |||
| + | Now, on SME2, we add a new server, and configure it like this: | ||
[[File:Ovpn_s2s_add_server.png|768px|thumb|center|Configure a new server daemon]] | [[File:Ovpn_s2s_add_server.png|768px|thumb|center|Configure a new server daemon]] | ||
| + | |||
| + | On the next page, we have to enter the same key we've used on SME1 | ||
=== Features === | === Features === | ||
Revision as of 12:06, 20 October 2010
Maintainer
Daniel B.
Firewall Services
mailto:daniel@firewall-services.com
Version
Description
smeserver-openvpn-s2s lets you inter-connect several SME servers, and their local networks with secure VPN. It uses OpenVPN as backend.
Requirements
- SME Server 7.X / 8.X
Installation
- install the rpms
yum --enablerepo=smecontribs install smeserver-openvpn-s2s
Configuration
This contrib lets you create as many servers and clients daemon. A server can only be used by one client (it's not a one server for multiple clients solution), so if you wan't to connect several SME to one central server, you'll need to create several server daemon, binding on different ports. Once conected, OpenVPN makes no difference between client and server, we just need to define which endpoint will bind on a local port waiting for a connection of the remote endpoint.
Lets take a simple example. We manage two SME servers
- SME1
- Local network: 192.168.9.0/24 (192.168.9.1 being the address of the internal interface of SME1)
- Public DNS domain name: sme1.domain.tld (resolves to the public IP of SME1)
- SME2
- Local network: 192.168.11.0/24 (192.168.11.1 being the address of the internal interface of SME2)
- Public DNS domain name: sme2.domain.tld (resolves to the public IP of SME2)
Now, we want to connect both servers, so that the two private networks can see each other.
We will configure SME1 as a OpenVPN client and SME2 as an OpenVPN server. We'll use the shared secret method as it's easier to configure.
So, in SME1 server-manager, we'll have to add a new client (in OpenVPN Site to Site panel) and configure it like this:
Then, click on the next button, we'll have a page to configure the shared secret key. We can generate such keys using openvpn command (on your SME Server, or on another linux box. I'm not sure if we can do the same under Windows). To create a new key, type the following command on your shell:
openvpn --genkey --secret /dev/stdout
And copy the output in the page of the server-manager, like this:
Now, on SME2, we add a new server, and configure it like this:
On the next page, we have to enter the same key we've used on SME1
Features
Additional options
Some advanced settings are not available on the panel, but only with db commands:
More customization
Backup and Restore
You should backup the directories /etc/openvpn/s2s/priv and /etc/openvpn/s2s/pub keys and certificates used by this contrib are stored there.
Uninstall
If you want to remove the contrib, just run:
yum remove smeserver-openvpn-s2s
You can then remove the directory /etc/openvpn/s2s if you really want to remove everything (including the private keys and certificates)
Source
The source for this contrib can be found in the smeserver CVS on sourceforge.
Bugs
Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-openvpn-s2s component or use this link
