Question

Site-to-Site VPN Support - Any Updates?

  • Posted September 8, 2020
  • VPN

I have been searching for any updates to this, but everything I have found so far is years old. Can we do a site to site OpenVPN between networks with the new private networking updates? Or does the system still filter out packets from foreign networks?

With the number of droplets and I create and destroy, it would be nice to just have one VPN server between my local network and my DO private network that they can communicate back and forth with.

Thanks.

Subscribe
Share

Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Hi @knightcrusader,

I have recently (and successfully) configured VPN connection between my DO droplets and home office (with OpenVPN). I do not know if it is a result of any changes made by DO on VPC because I have never configured VPN with DO before. Take a look at my configuration, please. I guess your configuration might be similar.

 ------------------                          ------------------
|   DO Droplet 1   |     10.8.0.0/24        |   Home Office    |
|    (CentOS 8)    |_________VPN_______     |   ISP's router   |
| Internet gateway |-------------------\----| Internet gateway |
|    VPN Server    |          |         \    ------------------
| Front-end Server |          |          \____  |
 ------------------        Internet           | |LAN 192.168.0.0/24
          |                                   | |------------
          |VPC                                | |            |
          |10.106.0.0/20                     -------------   | 
          |                                 |     PC 1    |  |
 -----------------                          | VPN Client/ |  |
|  DO Droplet 2   |                         | VPN Gateway |  |
|  (Ubuntu 20.4)  |                         |  (CentOS 7) |  |
|   VPN Access    |                          -------------   |
 -----------------                                           |
                                             -------------   |
                                            |     PC 2    |  |
                                            |  VPN Access |--
                                            | (Windows 10)|
                                             -------------

I can reach both droplets from my home office, and both PCs from the droplets.

Configuring VPN connection I generally based on DO’s doc: https://www.digitalocean.com/docs/networking/vpc/resources/droplet-as-gateway/

and OpenVPN community How To: https://community.openvpn.net/openvpn/wiki/HOWTO

I put some tips below which can be useful during setting VPN up.

1. If you use DO cloud firewall, you need to add the inbound rule to access particular service available in VPC (behind VPN Server); e.g. to get/send echo from/to DO VPC you need to add following rule

Type 	Protocol    Port Range     Sources
ICMP 	ICMP                       10.106.0.0/20
                                   10.8.0.0/24
                                   192.168.0.0/24

2. Check the firewall settings on each node of VPN network. If it is necessary, add/modify rules to get an access to needed services through VPN network. Just for testing, you can disable firewalls temporarily.

3. Add static routes, if it is necessary. I did it because there were different network devices for Internet and VPN access in my Home Office network. I had to do that directly on PC 2 because it was not possible to add the routes and propagate them with my Home Office router (it is ISP’s router, and I have an access to its basic GUI only). I added static routes for destinations 10.106.0.0/20 and 10.8.0.0/24.

In case of any questions, do not hesitate, ask them here :)

Hi @knightcrusader ,

I understand what you mean, most of the tutorials and documents are still usable however. Have you taken a look at the tinc daemon to setup this connection? https://www.digitalocean.com/community/tutorials/how-to-install-tinc-and-set-up-a-basic-vpn-on-ubuntu-14-04