Re: net-to-net vpn

Hi there,

On Tue, 2 Jun 2015, [email protected] wrote:

> ... I was reluctant to invest time learning how to configure the
> internal firewall of a Debian machine ...

There's nothing to do.  A Debian machine by default will have no
'firewall' rules.  By which I mean 'iptables' rules which is more or
less what it amounts to on a Linux box.  You basically only need to
start firewalling things when they start listening for connections.
By default a Debian machine won't be listening for much, so it won't
need to be firewalled.  This compares favourably with Windows boxes
for example, most of which by default will listen for all sorts of
things using software of dubious security, and so definitely need to
be firewalled if you're going to allow them to talk to the Internet.

>> Set up machines which run OpenVPN to be able to route packets ...
>> "/bin/echo 1 > /proc/sys/net/ipv4/ip_forward"
>
> Where is this documented?  I find no man page for "ip_forward".

Good question. :)

ip_forward is just a kernel flag, it's on or off.  So it doesn't have
a 'man' page of its own because it's not that big a deal.  There are
numerous such settings in the kernel which control the networking
behaviour in the system.  It can be a bit overwhelming at first, but
you don't need to fiddle with most of it - in fact it's not a good
idea to fiddle with a lot of it until you're a networking guru. :)

https://www.kernel.org/doc/Documentation/sysctl/net.txt
https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

The 'Netfilter' documentation is well worth a read:

http://www.netfilter.org/

There are plenty of other useful documents on networking generally
which are available for the price of a search engine query.

>> and then simply poke appropriate holes in the firewall(s) to allow
>> the traffic.
>
> Is anything needed other than to forward port 1194 to the VPN machine?

No.  Well, not on the firewall, and it doesn't have to be 1194.  You
can choose a different port in the OpenVPN configuration if you wish,
I usually do, and if you're running several distinct VPNs you can
choose a different port for each distinct VPN.

>> Machines on the LAN which need access to the VPN(s)
>> will have routing table entries (for the tunnel IPs) which point to
>> the OpenVPN machines rather than the default gateway.
>
> Is this done internally on each machine which needs access to the VPN?

Yes.  There are options in the OpenVPN configuration file to set up
routes if needed on the VPN endpoint machines themselves, but if the
machine isn't running OpenVPN you need to do it separately.  I usually
put something in the startup scripts, on Linux calling a script from
/etc/rc.local such as '/etc/rc.routes' which is as simple as

#!/bin/sh
/sbin/route add -net [VPN1 configuration]
/sbin/route add -net [VPN2 configuration]
...

I'm using the 'route' utility there purely because I'm an old duffer.
See also the more modern 'ip' utility:

http://linux-ip.net/html/tools-ip-route.html#tools-ip-route-add

which can do all that you need and more.  I recommend becoming
familiar with that tool.  If a Windows box is to be a VPN endpoint
*and* a router (which I don't necessarily recommend) then the same
OpenVPN configuration options are available to set up its routes.
Otherwise you can put something like (for a /24 network):

route add xxx.xxx.xxx.xxx mask 255.255.255.0 ip.address.of.router

in a .bat file somewhere which is called at boot time, or at the
command prompt type

route -p add xxx.xxx.xxx.xxx mask 255.255.255.0 ip.address.of.router

just once to get Windows (theoretically) to make the route persistent
across reboots.  I've seen such 'persistent' routes on Windows boxes
disappear for no apparent reason.

Lastly (I think - anyway I have to go now) if your machines get their
networking information via DHCP, you could push routes to the DHCP
clients that way.  See 'classless static routes' in the documentation
for the DHCP daemon and its configuration ("man 5 dhcpd.conf").

HTH

-- 

73,
Ged.

------------------------------------------------------------------------------
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user