Home / server / Questions / 180394
Accepted
aleroot
Asked: 2010-09-13 09:55:34 +0800 CST

Two tiny network VPN(site-to-site) : Bridged or Routed?

  • 772

I want to setup a VPN between two small office network :

1st Network : ADSL Router with DHCP - 3 Server(Static IP) - 20 WorkStation(DHCP)

2nd Network : ADSL Router with DHCP - 1 Server(Static IP) - 5 WorkStation(DHCP)

I wanna insert in each network a Linux OpenVPN Server for linking this two small network, for this scenario wich type of VPN is better ? Bridged or Routed ?

If i bride this two network, could i have some problem with two DHCP Server ?

I Want that the client of 1st Network get IP Address from DHCP Server located in 1st Network and not also from DHCP Server located in the 2nd Network...

vpn openvpn bridge

2 Answers

  1. Best Answer

    To keep this as easy as possible, make sure that the two offices are on different subnets, e.g. 192.168.10.0/24 for the first one and 192.168.20.0/24 for the second one. Then use OpenVPN to build the VPN connection, using a completely separate subnet (e.g. 192.168.254.0/24). Then add routes for the office of the other network to thew ADSL router, pointing at the machine running the OpenVPN Server/Client.

    Now you have the following situation:

    1. Traffic from network 1 for network 2 will go the ADSL router (the default gateway), which routes them to the OpenVPN machine, and from there they go through the tunnel.
    2. Traffic from network 2 for network 1 will do the same
    3. Return traffic will also follow the routes.
    4. Computers in need of an IP address use broadcasting, which cannot go across network boundaries (unless you have a DHCP proxy in place). This guarantess that computers on network 1 will always receive their IP settings from the DHCP server on network 1.

    I would recommend bridged networking for the OpenVPN instances, but, since they are not located on your default gateways, the extra routes are still needed.

    • 0

  2. You definitely don't want to bridge the networks. All that broadcast traffic and you want to keep both networks separate for security and administrative purposes.

    I'd argue that it makes more sense to get two good perimeter router/firewalls (losing the ADSL routers) that support site-to-site IPSec tunnels instead of buying two OpenVPN servers with an arguably more complex routing configuration, two more servers to manage, etc.

    Almost every "business class" router/firewall these days supports IPSec tunnels; pick your favourite vendor or buy an ALIX-based pfSense firewall kit from NetGate for less than $250.

    • 0