View source for Site to Site OpenVPN IPSEC Tunnel

I've accomplished the following using 2 Raspberry Pi's at different locations.  Even thought the following is using raspbian there is no reason s to why it should not work with any Linux flavour.

= Installation =

== Debian ==
<pre>
apt-get install openvpn
</pre>

== CentOS ==
<pre>
yum install openvpn
chkconfig openvpn on
</pre>

= Enable Routing =

== Temporary ==
By default the file '''/proc/sys/net/ipv4/ip_forward''' contains the number 0.  This means that the system will not allow routing.  To temporary enable routing change the 0 to a 1.  The reason I say temporary is because this file does not allow permenate routing.  On a reoot the system will turn routing off.
<pre>
echo 1 > /proc/sys/net/ipv4/ip_forward
</pre>

'''NOTE''': I could not get the above command to work unless I was logged in as root.  Even using the command with sudo would not work.

== Permanent ==
<pre>
vi /etc/sysctl.conf
</pre>

Remove the # from the line
<pre>
#net.ipv4.ip_forward=1
</pre>

Reboot to enable IP forwarding if you have not already applied the temporary setting.

= Security Key =
Create a security key so the 2 servers can establish a tunnel.
<pre>
openvpn --genkey --secret /etc/openvpn/syd-per.key
</pre>

The contents of this new file '''/etc/openvpn/syd-per.key''' needs to be copied to the other server that the tunnel will be established with.

If you would rather use a certificate rather than a key I would suggest referring to [http://blog.wains.be/2008/07/15/a-vpn-for-remote-users-with-openvpn/ Sébastien Wains] site.

= Tunnel Configuration =

== Site A ==
<pre>
vi /etc/openvpn/sydney-perth.conf
</pre>


<pre>
remote connection.dyndns.org
float
port 8000
dev tun
ifconfig 172.30.30.1 172.30.30.2
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo
ping 15
secret /etc/openvpn/syd-per.key
route 192.168.10.0 255.255.255.0
chroot /var/empty
user nobody
group nogroup
# If using RedHat replace with
# group nobody
log sydney-perth.log
verb 1
</pre>

== Site B ==
<pre>
vi /etc/openvpn/sydney-perth.conf
</pre>


<pre>
remote 136.15.3.121
float
port 8000
dev tun
ifconfig 172.30.30.2 172.30.30.1
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo
ping 15
secret /etc/openvpn/syd-per.key
route 192.168.5.0 255.255.255.0
chroot /var/empty
user nobody
group nogroup
# If using RedHat replace with
# group nobody
log sydney-perth.log
verb 1
</pre>

= Create Folder =
<pre>
mkdir /var/empty
</pre>

= Start Tunnel =

== Automaic ==
<pre>
vi /etc/default/openvpn
</pre>

<pre>
AUTOSTART="all"
</pre>

<pre>
service openvpn start
</pre>

== Manually ==
While the openvpn service is stopped..
<pre>
openvpn --config /etc/openvpn/sydney-perth.conf
</pre>

= Network Map =
{|
|Site
|Subnet
|Tunnel IP
|-
|A
|192.168.5.0/24
|172.30.30.1
|-
|B
|192.168.10.0/24
|172.30.30.2
|}