Put opened vpn connection via shell into green nic as part of local network

Virtual Private Networks
1

Hello,
I don’t normally ask for help, usually somebody has solved the issue previously and you can find it somewhere, but this has me stumped.
I wonder if some wonderful knowledgeable person could point me in correct direction as I’m a network / vpn newbie:

  • I have a remote server say on 213.213.213.213 out there in the internet, and I want to VPN to it so that all my green clients can have access to it.
  • My red network is on 212.212.212.212
  • My green network is running on 10.0.1.? they can all talk to each other and the ipfire on 10.0.1.1
  • My IPFire box has got an openvpn connection open to my server (213.213.213.213) via command line where ipfire can talk to it on 10.8.0.1 and the server can talk to my IPFire box on 10.8.0.6
  • Now I would like my green clients on 10.0.1.2+ to be able to talk to the remote server on a 10.8.0.1 but they cannot, they have no knowledge of 10.8.0.1 or even better bring the remote server into the green dhcp range so it behaves like a local machine.

I am guessing it is probably a routing / firewall issue, although having no experience with routing or iptables I’m just stabbing in the dark.

I can post openvpn configs if it will help, I just didn’t want to clutter this up.

Much appreciate any help you can give me!

Thanks
Mark.

2

Hello,
may be wrong setup :wink:

  1. no one needs acces to 10.8.0 network (it is only a “transfer network”)

  2. do not touch a firewall (IPFire itself initiates all neede rules on start/stop)

  3. give the correct routing info in your (server)setup , will be routed through tunnel

  4. check routing table …- 213.x is an internet-network… it must have a route setting before general internetrouting …the problem: the openVPN (tun) devices appears after (!) starting openVPN and disappears with stopping openVPN … but the routing must be before others (metric)

  5. it has never been a good idea to setup “local” machines/interfaces with public addresses :wink:
    Well - route-setting-script could help …

  6. try to solve …but never use a 10.8. address directly …traceroute can help with source-option

Fred