DA-660-8/16-LX User’s Manual
Managing Communications
4-22
dev tap0
secret /etc/openvpn/secrouter.key
cipher DES-EDE3-CBC
auth MD5 tun-mtu 1500
tun-mtu-extra 64
ping 40
up /etc/openvpn/tap0-br.sh
Then modify the routing table in
/etc/openvpn/tap0-br.sh
script file.
#----------------------------------Start------------------------------
#!/bin/sh
# /etc/openvpn/tap0-br.sh
# value after “-net” is the subnet behind the remote peer
route add -net 192.168.2.0 netmask 255.255.255.0 dev br0
#---------------------------------- end ------------------------------
NOTE
Select cipher and authentication algorithms by specifying “cipher” and “auth”. To see with
algorithms are available, type:
# openvpn --show-ciphers
# openvpn --show—auths
4.
After configuring the remote peer, we can load the bridge into kernel, reconfigure eth1 and
enable IP forwarding on both
OpenVPN
machine.
# /etc/openvpn/openvpn-bridge start
Then start both of OpenVPN peers,
# openvpn --config /etc/openvpn/tap0-br.conf &
If you see the line “Peer Connection Initiated with 192.168.8.173:5000” on each machine, the
connection between OpenVPN machines has been established successfully on UDP port 5000.
NOTE
You can create link symbols to enable the
/etc/openvpn/openvpn-bridge
script at boot time:
# ln -s /etc/openvpn/openvpn-bridge /etc/rc.d/rc3.d/S32vpn-br
# ln -s /etc/openvpn/openvpn-bridge /etc/rc.d/rc6.d/K32vpn-br
5.
On each OpenVPN machine, check the routing table by typing the command:
# route
Destination Gateway
Genmsk Flags
Metric
Ref Use Iface
192.168.4.0
* 255.255.255.0
U 0 0 0 br0
192.168.2.0 * 255.255.255.0
U 0 0 0 br0
192.168.8.0 * 255.255.255.0
U 0 0 0 eth0
Interface
eth1
is connected to the bridging interface
br0
, to which device
tap0
also connects,
whereas the virtual device
tun
sits on top of
tap0
. This ensures that all traffic from internal
networks connected to interface
eth1
that come to this bridge write to the TAP/TUN device
that the OpenVPN program monitors. Once the OpenVPN program detects traffic on the
virtual device, it sends the traffic to its peer.
6.
To create an indirect connection to Host B from Host A, you need to add the following routing
item:
route add –net 192.168.4.0 netmask 255.255.255.0 dev eth0
To create an indirect connection to Host A from Host B, you need to add the following routing
item:
route add –net 192.168.2.0 netmask 255.255.255.0 dev eth0
Now ping Host B from Host A by typing:
