Linux – Multiple Subnets on OpenVPN

You can simplify the solution...

If you're looking for a way to link all of these servers (not routers or gateways devices) as though they were on one flat network, I'd suggest looking at the n2n peer-to-peer offering from ntop.

This tool allows you to traverse intermediate devices; helpful if you don't have access to firewalls or have complex routing issues. In my case, I use n2n for monitoring client systems from a central location. It's cleaner than site-to-site VPNs, and I can work around overlapping subnets/IP addresses. Think about it...

Edit:

I recommend using the n2n_v2 fork and hand-compiling.

An example configuration of n2n would look like the following:

On your supernode, you need to pick a UDP port that will be allowed through the firewall in front of the supernode system. Let's say UDP port 7655, with name edge.mdmarra.net:

# supernode -l 7655 -f -v 
# edge -d tun0 -m CE:84:4A:A7:A3:40 -c mdmarra -k key -a 10.254.10.1 -l edge.mdmarra.net:7655

On the client systems, you have plenty of options. You should choose a tunnel device name, a MAC address (maybe), a community name, a key/secret an IP address and the address:port of the supernode. I tend to use a more complete command string:

# edge -d tun0 -m CE:84:4A:A7:A3:52 -c mdmarra -k key -a 10.254.10.10 -l edge.mdmarra.net:7655

These can be run in the foreground for testing, but all of the functionality is in the edge command. I will typically wrap this in the Monit framework to make sure the processes stay up.

You can push individual openvpn directives to your clients using client specific configuration files in the client-config-dir.

In the server config file include the directive:

client-config-dir ccd

and create this directory in case it does not already exist in your openvpn path, for example:

/etc/openvpn/ccd

Now create a config file per client in the ccd directory having the same name as the client's X509 common name. The following options are legal in a client-specific context: push, push-reset, iroute, ifconfig-push, and config.

For example to push routes to a client with CN user1 in his certificate:

echo 'push "route 10.0.0.2 255.255.255.255 10.8.0.1"' >> /etc/openvpn/ccd/user1
echo 'push "route 10.0.2.10 255.255.255.255 10.8.0.1"' >> /etc/openvpn/ccd/user1

For this to work you need to pull configuration directives on your clients from the server using the pull directive.

You may have the directive client in your client-config, which is a helper directive and expands as follows:

pull
tls-client

Do not use route-nopull in combination as it would stop the client pulling routes. If you need redirect-gateway on certain clients to route all traffic through the VPN subnet, you can place this directive just in those client configuration files and not in your server config file for all clients. The redirect-gateway directive automatically executes routing commands to cause all outgoing IP traffic to be redirected over the VPN. See man page.