Re: net-to-net vpn

Den 02-06-2015 kl. 22:30 skrev [email protected]:
> On Tue, June 2, 2015 8:10 am, G.W. Haywood wrote:
>
>> I routinely use OpenVPN to implement VPNs which pass through IPCop
>> machines, but I do not normally run OpenVPN on the IPCop machines
>> themselves.  It is more flexible to run OpenVPN on a machine or
>> machines inside the firewalled perimeter, and the encryption can
>> then be handled by a machine easily capable of the encryption
>> overhead, which can be substantial.
> A good point regarding overhead.
>
> This scheme -- using a machine inside the LAN as a VPN terminal -- is
> mentioned in the documentation of the Debian OpenVPN package.  I found
> the scheme attractive, but I was reluctant to invest time learning how
> to configure the internal firewall of a Debian machine, or to learn
> a firewall configuration tool such as Shorewall.
>
>> Set up machines which run OpenVPN to be able to route packets ...
>> "/bin/echo 1 > /proc/sys/net/ipv4/ip_forward"
> Where is this documented?  I find no man page for "ip_forward".
>
>> and then simply poke appropriate holes in the firewall(s) to allow
>> the traffic.
> Is anything needed other than to forward port 1194 to the VPN machine?
>
>> Machines on the LAN which need access to the VPN(s)
>> will have routing table entries (for the tunnel IPs) which point to
>> the OpenVPN machines rather than the default gateway.
> Is this done internally on each machine which needs access to the VPN?

That is the right way to do it, but I cheat. I run this line in 
/etc/rc.local:
/sbin/iptables -t nat -A POSTROUTING -s ip.of.vpn.sub/net -j SNAT --to 
ip.of.vpn.server

Is easy, but gives you kind of anonymous users on your net.


--
Morten Christensen

------------------------------------------------------------------------------
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user