Prodotti Ubiquiti e Openvpn

[kidysy]

Buona sera signori e signore.
Vorrei farvi una domanda semplice semplice ..si fa per dire!
Ho un serverino remoto dove su' c'è ubuntu server con openvpn
Vorrei collegare due lan a questo server remoto..
Lee sedi devono le loro rispettive lan..in quanto ho dei servizzi da condividere con tutti
Posso farlo con prodotti ubiquiti!
Esempio,io mi connnetto ad internet con la mia NanostationM5 collegata al router.....di pincopanco
Dalla stessa NM5 posso creare una vpn verso il server openvpn??

Grazie mille

[kidysy]

Allora,ho fatto un po di ricerche ...
con l'EdgeMax si può fare...
Posto una soluzione copiata dal sito di UBNT.com

Readers will learn how to configure a site-to-site VPN using OpenVPN with two Ubiquiti EdgeRouters.

Assumptions: You want to connect two Edgerouters together using OpenVPN. The two routers are configured as follows.

Router 1:
External IP/Name: system1.dyndns.com (can also use an external IP address)
Internal IP: 192.168.1.1

Router 2:
External IP/Name: system2.dyndns.com (can also use an external IP address)
Internal IP: 192.168.2.1

If your routers use different IPs or you have different names, change them where they appear in these instructions.

Steps

Step 1: On Router 1, access the command line and create a pre-shared key (NOT in Configure mode, but in Operational Mode).

generate vpn openvpn-key /config/auth/secret

Step 2: Transfer the pre-shared key to the other machine

Either:

Option A. This option assumes that the username of the remote system is still ubnt. If you changed the default username, change ubnt in the following command to that new username. This also assumes that the remote machine can accept remote ssh connections, i.e. that port 22 (SSH/SCP) is accepting input from the internet. If the remote system is not accepting SSH/SCP commands from the
internet, use option B:

sudo scp /config/auth/secret ubnt@system2.dyndns.com:/config/auth/secret

Or:

Option B: View the pre-shared key on Router 1:

sudo cat /config/auth/secret

Copy the contents onto your clipboard.

Login to Router 2 using ssh. Create the file:

cat > /config/auth/secret

Paste the text from your clipboard.

Hit CTRL-D to save the file.

Change permissions on the file you just created:

chmod 600 /config/auth/secret

Step 3: Configure Router 1

# Enter configuration mode

configure

# Configure the OpenVPN to use vtun0

set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site

# Assign ports for use by OpenVPN

set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194

# Assign a local address for use by OpenVPN

set interfaces openvpn vtun0 local-address 10.99.99.1

# Assign a remote address for use by OpenVPN

set interfaces openvpn vtun0 remote-address 10.99.99.2

# Tell OpenVPN the public address of the remote system

set interfaces openvpn vtun0 remote-host system2.dyndns.com

# Tell OpenVPN where to find the secret file

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

# Enable Compression (optional: Must do on both sides or neither)

set interfaces openvpn vtun0 openvpn-option "--comp-lzo"

# Enable Float, Ping, and Other Security Options (optional: See OpenVPN Man Page for details)

set interfaces openvpn vtun0 openvpn-option "--float"
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option "--ping-timer-rem"
set interfaces openvpn vtun0 openvpn-option "--persist-tun"
set interfaces openvpn vtun0 openvpn-option "--persist-key"
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"

# Tell EdgeRouter the remote subnet

set protocols static interface-route 192.168.2.0/24 next-hop-interface vtun0

# Commit, Save, and Exit Configuration Mode

commit
save
exit

Step 4: Configure Router 2

# Enter configuration mode

configure

# Configure the OpenVPN

set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site

# Assign ports for use by OpenVPN

set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194

# Assign a local address for use by OpenVPN

set interfaces openvpn vtun0 local-address 10.99.99.2

# Assign a remote address for use by OpenVPN

set interfaces openvpn vtun0 remote-address 10.99.99.1

# Tell OpenVPN the public address of the remote system

set interfaces openvpn vtun0 remote-host system1.dyndns.com

# Tell OpenVPN where to find the secret file

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

# Enable Compression (optional: Must do on both sides or neither)

set interfaces openvpn vtun0 openvpn-option "--comp-lzo"

# Enable Float, Ping, and Other Security Options (optional: See OpenVPN Man Page for details)

set interfaces openvpn vtun0 openvpn-option "--float"
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option "--ping-timer-rem"
set interfaces openvpn vtun0 openvpn-option "--persist-tun"
set interfaces openvpn vtun0 openvpn-option "--persist-key"
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"

# Tell Edgerouter the remote subnet

set protocols static interface-route 192.168.1.0/24 next-hop-interface vtun0

# Commit, Save, and Exit Configuration Mode

commit
save
exit

You should be done!

Extra Commands

You can use these extra command line options after the tunnel is created.

Check on the status of the tunnel

show interfaces openvpn
show interfaces openvpn detail
show openvpn status site-to-site

Restart the tunnel

reset openvpn interface vtun0

Notes: The remote-address and local-address are unique addresses used by OpenVPN. They should not be part of the local subnet of either machine.

To set-up a tunnel between Router 1 and a third Router (Router 3), change vtun0 to vtun1. Change the local and remote port to another port (such as 1195). Change local-address and remote-address to something else (i.e., 10.99.99.3 and 10.99.99.4).

[kidysy]

La questione è interessante ma:
Io non devo connettere due edgemax tra di loro ma devo passare per un server esterno
Quindi dovrò dire al serverino openvpn quali lan si connettono!

Sono in alto mare!!! Help

Red... gettami una corda...ma non al collo

[thema3x]

ah ah ah, bella la corda al collo, ci piace

Ciao

TheMa3x

[redfive]

Ti servono comunque due dispositivi che agiscano come vpn client per connetersi al vpn server ed eventualmente far passare il traffico da lui, ma a sto punto ..... non fai prima a prendere 2 ER-X, ed utilizzare direttamente openvpn server/client tra le 2 sedi ?
ciao

[thema3x]

I cloud concept... zero VPN ... pochi NAT ... i dispositivi client remoti puntano alla farm, attrezzata per erogare tutti i servizi necessari a chi li chiede dietro a "1" NAT.

Ciao

TheMa3x

[kidysy]

Salve..! perdonate la risposta ..lungaaaa!!(Nel tempo)
In realtà la questione è più complessa ...in quanto le due sedi sono connesse alla rete tramite due Router LTE ...e come ben sapete ormai le comp..telefoniche hanno messo tutti dietro NAT !!!
Unica soluzione è quella di passare tramite una VPS che funge da server vpn e due client (vpn) con cui posso raggiungere i servizzi nelle rispettive reti!!
Giustamente Red..individua la problematica di avere due apparati per instradare il traffico (VPN) verso il server che dovrà instradare il traffico verso le due sedi!!
Come si dice?? ci sto sbattendo il muso!!

[thema3x]

Azzz ...

TheMa3x

[redfive]

Nel mio home-lab, uso 2 connessioni 4G in LB, una è Vodafone, ...va be, questi per avere un pubblico utilizzabile ( perchè danno un pubblico sulla ppp) vogliono il contratto business e si paga il traffico in uscita con b2b ... , ma la TIM, ho chiesto al 119 di avere un pubblico raggiungibile , e in una settimana tutto è andato a posto (ti richiamano, hanno voluto sapere il motivo, videosorverglianza, anche il modello delle telecamere...), dinamico, ma pubblico ed utilizzabile per connessioni vpn...
Comunque, resta il fatto che ti servono 2 apparecchi che supportino OpenVpn.... gli ER-X, lo fanno egregiamente, sono ultra economici, e puoi configurarli sia come server che come client ( come server lo uso per connessioni H2L, sia da win, che da linux ed android)...
ciao