Author: Nikos Mavrogiannopoulos
In this scenario we describe a VPN server which provides multiple subnets to connecting users, and some of these subnets are routed by some of the users themselves. That is, a simple to setup site to site link. For simplicity we examine an IPv4 setup like the following. Modification for other setups should be trivial.
10.10.1.0/24
domain: .site1.com
------------
| Site1 |
------------
/ \
/ \
------------ ------------
| Site2 | | Client1 |
------------ ------------
10.100.2.0/24
domain: .site2.com
In that scenario Site1 advertises the 10.10.1.0/24, and we would like it to route 10.10.2.0/24 through 'Site2' when they are connected.
The following instructions require ocserv 0.10.10.
In order to enable this setup the server must have preconfigured the routes that each client will serve. This can be done with the following configuration settings in ocserv.conf of Site1.
split-dns = site1.com
split-dns = site2.com
ipv4-network = 192.168.1.0/24
route = 10.10.1.0/24
config-per-user = /etc/ocserv/config-per-user/
expose-iroutes = true
The 'ipv4-network' entry contains the addresses that the VPN clients will
be assigned to. The 'route' entry adds the routes that are directly routed by
the VPN server. The 'config-per-user' option instructs ocserv to read for
each user connecting the additional configuration file placed in
/etc/ocserv/config-per-user/ which has the name of the user. If the
user is named 'Site2' ocserv will open /etc/ocserv/config-per-user/Site2.
The 'expose-iroutes' option instructs ocserv to expose/advertise any 'iroute' options found in the per-user configuration files to all connecting clients (except the one serving it).
Hence, in our scenario the Site2 file will contain the following.
iroute = 10.100.2.0/24
This will instruct ocserv to setup route 10.100.2.0/24 via Site2 once it connects.
We skipped intentionally the 'split-dns' options in the config file above. For the connecting VPN clients to be able to resolve both .site1.com and .site2.com sites the Site1 DNS server must be instructed to contact the Site2 DNS server for the '.site2.com' addresses. That configuration is DNS-server specific. In dnsmasq, for example, that can be achieved by adding a configuration line such as "server=/site2.com/10.10.2.1" in its config file.
Site2 will be a typical openconnect client. It will only need to allow forwarding to and from the routes of Site1 (i.e., 10.10.1.0/24) and to and from VPN client addresses (i.e., 192.168.1.0/24).
No special configuration is needed for any of the openconnect clients.