EdgeRouter: OpenVPN Site-to-Site

Overview


Readers will learn how to configure a site-to-site VPN using OpenVPN with two Ubiquiti EdgeRouters.

Assumptions: You want to connect two EdgeRouters together using OpenVPN.  The two routers are configured as follows.

Router 1:
External IP/Name: system1.dyndns.com (can also use an external IP address)
Internal IP: 192.168.1.1

Router 2:
External IP/Name: system2.dyndns.com (can also use an external IP address)
Internal IP: 192.168.2.1

If your routers use different IPs or you have different names, change them where they appear in these instructions.

Steps


Step 1: On Router 1, access the command line and create a pre-shared key (NOT in Configure mode, but in Operational Mode).

generate vpn openvpn-key /config/auth/secret

Step 2: Transfer the pre-shared key to the other machine

Either:

   Option A. This option assumes that the username of the remote system is still ubnt. If you changed the default username, change ubnt in the following command to that new username. This also assumes that the remote machine can accept remote ssh connections, i.e. that port 22 (SSH/SCP) is accepting input from the internet. If the remote system is not accepting SSH/SCP commands from the
internet, use option B:

sudo scp /config/auth/secret ubnt@system2.dyndns.com:/config/auth/secret

Or:

   Option B: View the pre-shared key on Router 1:

sudo cat /config/auth/secret

Copy the contents onto your clipboard.

Login to Router 2 using ssh. Create the file:

cat > /config/auth/secret

Paste the text from your clipboard.

Hit CTRL-D to save the file.

Change permissions on the file you just created:

chmod 600 /config/auth/secret

Step 3: Configure Router 1

 # Enter configuration mode

configure

# Configure the OpenVPN to use vtun0

set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site

# Assign ports for use by OpenVPN

set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194

# Assign a local address for use by OpenVPN

set interfaces openvpn vtun0 local-address 10.99.99.1

# Assign a remote address for use by OpenVPN

set interfaces openvpn vtun0 remote-address 10.99.99.2

# Tell OpenVPN the public address of the remote system

set interfaces openvpn vtun0 remote-host system2.dyndns.com

# Tell OpenVPN where to find the secret file

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

# Enable Compression (optional:  Must do on both sides or neither)

set interfaces openvpn vtun0 openvpn-option "--comp-lzo"

# Enable Float, Ping, and Other Security Options (optional:  See OpenVPN Man Page for details)

set interfaces openvpn vtun0 openvpn-option "--float"
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option "--ping-timer-rem"
set interfaces openvpn vtun0 openvpn-option "--persist-tun"
set interfaces openvpn vtun0 openvpn-option "--persist-key"
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"

# Tell EdgeRouter the remote subnet

set protocols static interface-route 192.168.2.0/24 next-hop-interface vtun0

# Commit, Save, and Exit Configuration Mode

commit
save
exit

Step 4: Configure Router 2

 # Enter configuration mode

configure

# Configure the OpenVPN

set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site

# Assign ports for use by OpenVPN

set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194

# Assign a local address for use by OpenVPN

set interfaces openvpn vtun0 local-address 10.99.99.2

# Assign a remote address for use by OpenVPN

set interfaces openvpn vtun0 remote-address 10.99.99.1

# Tell OpenVPN the public address of the remote system

set interfaces openvpn vtun0 remote-host system1.dyndns.com

# Tell OpenVPN where to find the secret file

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

# Enable Compression (optional:  Must do on both sides or neither)

set interfaces openvpn vtun0 openvpn-option "--comp-lzo"

# Enable Float, Ping, and Other Security Options (optional:  See OpenVPN Man Page for details)

set interfaces openvpn vtun0 openvpn-option "--float"
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option "--ping-timer-rem"
set interfaces openvpn vtun0 openvpn-option "--persist-tun"
set interfaces openvpn vtun0 openvpn-option "--persist-key"
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"

# Tell EdgeRouter the remote subnet

set protocols static interface-route 192.168.1.0/24 next-hop-interface vtun0

# Commit, Save, and Exit Configuration Mode

commit
save
exit

You should be done!

Extra Commands


You can use these extra command line options after the tunnel is created.

Check on the status of the tunnel

show interfaces openvpn
show interfaces openvpn detail
show openvpn status site-to-site

Restart the tunnel 

reset openvpn interface vtun0

Notes:  The remote-address and local-address are unique addresses used by OpenVPN.  They should not be part of the local subnet of either machine.  

To set-up a tunnel between Router 1 and a third Router (Router 3), change vtun0 to vtun1. Change the local and remote port to another port (such as 1195). Change local-address and remote-address to something else (i.e., 10.99.99.3 and 10.99.99.4).

If connection to each router is established, but there is no access to devices behind the router, make sure that NAT Hairpin is enabled for each LAN network.  

Related Articles