Single server, multi site, shared key OpenVPN config?
-
Is it possible to have multiple site-to-site tunnels running to a central OVPN server, using a single server config on the hub, and similar configurations on the remote firewalls?
I am trying to set something like that up to replace IPsec, and I have a single server with the following config:
Site to Site (Shared Key)
Proto: TCP (There's a reason for using TCP!)
Port: 1194
Tun (layer 3)
Tunnel network: a.b.c.d/24The client has matching settings, but if I specify the same a.b.c.d/24 tunnel subnet, it automatically assumes that it should use the 2nd address in that subnet, which means only a single client would be able to connect.
If I do not specify a tunnel subnet, the tunnel never comes up...Is it even possible using the pfSense GUI?
-
Shared Key requires one server per client.
With PKI you only need one server instance, but unique certificates per client.Personally I like to use PKI with one server per client to spread the load across multiple OpenVPN instances. Hard to get 1 Gbps+ OpenVPN traffic with only one Instance.
-Rico
-
@fearnaboinne said in Single server, multi site, shared key OpenVPN config?:
Is it possible to have multiple site-to-site tunnels running to a central OVPN server, using a single server config on the hub, and similar configurations on the remote firewalls?
Yes, but you must use SSL/TLS mode with certificates to have multiple clients on a single server.
Is it even possible using the pfSense GUI?
OpenVPN itself cannot operate with multiple clients in shared key mode, it's not a pfSense limitation.
-
I was afraid of that... Wanted to stay away from creating certs, too bad....
I'll have to go the cert-route after all I guess!
Thanks for the quick response!
-
If you really want to avoid certificates, and IPsec is not an option, consider using the WireGuard package instead. It may be closer to what you are after in terms of design.
You may be able to have one "server" with many peers, depending on your needs.
-
What is the problem with creating Certs?
-Rico
-
@rico it's just a pain in the proverbial behind...
