Openvpn – Using iroute in OpenVPN server

networkingopenvpnroutingvpn

I am attempting to establish network routing between two machines that always connect from 2 different networks, after consulting both articles:
https://community.openvpn.net/openvpn/wiki/RoutedLans
Routing issue In OpenVPN

i am left with three questions:

  1. how\where do i set the "Client name" – in order to add their CCD folder with the iroute line (or is it possible to view in the logs the name the client 'gives itself' by default)
  2. assuming it is only possible using a certificate, is it possible to create a CCD folder for any client without certificate? (sort of like a default client, unless a certificate is in use)
  3. i do not have a ccd folder in my openvpnfolder as both articles suggest, can i simply create it myself?

Linux@OpenVpn1:~$ cd /etc/openvpn/

easy-rsa/ orig/

i tried following both articles to the letter, but i seem to be missing something, i would've tried creating the folder myself, but without knowing the client name (or how to set it), it wouldn't have any meaning.

please assist.

Best Answer

how\where do i set the "Client name" - in order to add their CCD folder with the iroute line (or is it possible to view in the logs the name the client 'gives itself' by default)

As answered by @Michael Hampton, the client name is the CN of the client certificate (e.g. /CN=Bob Smith/O=Evil Corp/OU=White cat wrangling and storage will match a CCD config for Bob Smith).

assuming it is only possible using a certificate, is it possible to create a CCD folder for any client without certificate? (sort of like a default client, unless a certificate is in use)

If it is only possible to use a certificate, then I am not sure how this situation would apply. I suspect the best way of doing that is to run two servers, one requiring the use of certs, and the other not. You could for example use TCP for one, and UDP for the other (or a different port). The other option would be to have a default cert you re-use (but you need to enable that on the openVPN server (--duplicate-cn).

The only way I know of to not require certificates involves adding --client-cert-not-required to the server options, which allows any users to use only passwords. I would reconsider this requirement if that is at all possible.

You can though have a default config for users that do not have a CCD config (https://openvpn.net/index.php/open-source/documentation/manuals/openvpn-20x-manpage.html for --client-config-dir)

If no matching file is found, OpenVPN will instead try to open and parse a default file called "DEFAULT", which may be provided but is not required.

i do not have a ccd folder in my openvpnfolder as both articles suggest, can i simply create it myself?

You can, and you can avoid any confusion by providing a fully-qualified path. Something like client-config-dir /etc/openvpn/domain-ccd.

Related Topic