Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Site-To-Multisites with One Instance, is it possible or not ?

    Scheduled Pinned Locked Moved OpenVPN
    5 Posts 4 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B Offline
      boujid
      last edited by

      Hi

      i seek an exact answer about the question :

      is it possible to configure Site-To-Site OpenVPN with th following architecture :
      headquarter : OpenVPN server (PfSense) running one instance
      branches : each branch having OpenVPN client (PfSense) connecting to the same instance in the headquarter

      is it possible or not ? (please note i am talking about Site-To-Site and not Client-To-Site)

      Thanks a lot

      1 Reply Last reply Reply Quote 0
      • D Offline
        deadmalc
        last edited by

        I think as far as openvpn is concerned you are actually talking about client-to-site.
        As you have the main Site running openvpn server and openvpn clients connecting.
        I assume what you want is to have routes pushed out from the client to the site and visa-versa.
        So that you have a network that is centralised and access controlled in headquarters?

        I think Site-To-Site and Client-To-Site is more IPSec terminology??
        Could be wrong..

        1 Reply Last reply Reply Quote 0
        • B Offline
          boujid
          last edited by

          thanks for your reply but the answer is no

          i am talking about site-to-site not client-to-site
          let's say 1 headquarter and 4 branches
          headquarter network : 192.168.11.0/24, 192.168.12.0/24, 192.168.13.0/24
          branch1 network : 192.168.1.0/26
          branch2 network : 192.168.1.64/26
          branch3 network : 192.168.1.128/26
          branch4 network : 192.168.1.192/26

          all the branches will use same services in headquarter, and the headquarter will use the same services from its branches
          so the firewall rules are the same for the 4 branches

          in the Headquarter i want to use 192.168.1.0/24 as remote network, the differentiation  between network branches (routing) i am thinking about the common name in Client Specific Overrides

          so the OpenVPN server (headquarter) will have ONE instance
          the 4 branches will connect to the same instance (same IP, same port)

          in summary, it's about
          OpenVPN Site-To-site (not Ipsec, nor Client-to-site)

          my question is it possible or not ?

          i am asking because we have the same architecture working on a commercial product
          we want to switch to PfSense, so the question can we do it with ONE instance or we must configure 4 instances in the Server each one destined to a branch ?

          Thanks

          1 Reply Last reply Reply Quote 0
          • V Offline
            viragomann
            last edited by

            What you try to achieve is a site to multi-site vpn.
            Yes, this is possible.

            The setup is similar to that: https://doc.pfsense.org/index.php/OpenVPN_multi_purpose_single_server

            Just set up an access server and set all the routing and client options in "client specific overrides". Don't enter a "Remote network" in the server setting, since each of your /26 subnets needs a different virtual gateway.

            If you also want get access between the clients LAN subnets, you have to enter all client network except the one of the respective client to "IPv4 Local Network/s" in client specific overrides.

            1 Reply Last reply Reply Quote 0
            • DerelictD Offline
              Derelict LAYER 8 Netgate
              last edited by

              You have to put "Remote Networks" in the server settings. That is what creates the FreeBSD route into the OpenVPN instance. This is the OpenVPN route directive.

              Then, in the CSOs, you put the actual remote site networks. These must be contained within the server route above. This creates the OpenVPN iroute directives which tell OpenVPN what to do with the traffic when it gets it - as in what client to send it to.

              So in the example given, server local networks would be 192.168.11.0/24, 192.168.12.0/24, 192.168.13.0/24, server remote networks could be 192.168.1.0/24, and the CSOs would contain the /26 for each client in the IPv4 Remote Networks there.

              I would probably opt for something more like:

              Server remote network: 172.29.160.0/19

              CSOs: 172.29.160.0/24, 172.29.161.0/24, 172.29.162.0/24, etc

              Or even: 172.29.160.0/22, 172.29.164.0/22, 172.29.168.0/22, 172.29.172.0/22 so each site has 4 /24 subnets to do with as they see fit without changes to the VPN. The /19 would allow growth to 8 branches of 4 /24s each, while the address "collision" possibility with other sites would be limited to 172.29.160.0/19.

              You should probably use Peer to Peer (SSL/TLS) mode for the server for this.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.