Xen users - May 2009 - interactions between xen and openvpn

Hi all, first time that i tried to use xen.
My goal is to reach in ssh all the domUs after i manage to get a
connection through openvpn.
Like they were real servers.
I installed  the openvpn server on my dom0 (ubuntu 9.04 + default
package + latest debian-xen-amd64 kernel)
After connecting to the openvpn server I''m able to do direct ssh just
to the dom0.
For reaching domU i had do it with ssh from dom0.
The communication between dom0 and domU is perfect.

I tried also the opposite, with openvpn on the domU.
In this case i can of course ssh directly on domU but not on dom0
avoiding to pass through a domU shells.

I think i''m not able to proper set a return route on the other server.

Here''s my lan details.

dom0 (ubuntu/debian) is
192.168.100.5 on eth0 (the gw for internet is 192.168.100.2, openvpn
port is forwarded to 192.168.100.5)
192.168.3.1 on tun0 (openvpn)

domU (netbsd 5.0) is
192.168.100.7 on xennet0

dom0 openvpn server.conf is like this

dev tun
port 443
server 192.168.3.0 255.255.255.0
client-to-client
push "route 192.168.3.0 255.255.255.0"

domU configuration file is like this

vif = [''mac=00:16:3e:70:01:05,bridge=xenbr0'']
ip = "192.168.100.7"
netmask = "255.255.255.0"
gateway = "192.168.100.2"

my thought is that i had to put on domU a route for 192.168.3.0
(that''s the network used by openvpn client )
towards the local ip of the openvpn server (so in this case 192.168.100.5)
But it''s not working.

Is there a suggested way of reaching this goal?
I don''t care about openvpn position, it can be on dom0 or on one of
domU.
With tun or tap.
I''m using tap because i did it once to reach a lan of real servers.

hope to have putted all the details needed

br
Luca

-- 
http://www.sironi.tk

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

On Fri, May 29, 2009 at 12:27 AM, Luca Sironi <luca@sironi.tk>
wrote:
> Hi all, first time that i tried to use xen.
> My goal is to reach in ssh all the domUs after i manage to get a
> connection through openvpn.
> Like they were real servers.
It''s openvpn thing. Better ask on their forums.
Short story, with bridged setup you should treat domU like any other
real server. What do you have to do to access other real servers on
192.168.100.0/24 address? Possibly by setting up NAT on openvpn
server. Again, this is more of openvpn thing.

-- 
Fajar

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

On Fri, May 29, 2009 at 1:09 AM, Luca Sironi <luca@sironi.tk>
wrote:
> I think it''s a xen thing.
> Probably related to the interactions of xenbr0.
>
> You can have an openvpn server on
>
> 192.168.100.5 that use the 192.168.3.0 network for tun <---> tun
connection.
>
> Logging on openvpn you will have an address on 192.168.3.x
> You can then log on 192.168.100.5
That''s because 192.168.100.5 is the openvpn server, isn''t it?
>
> for reaching a phisical 192.168.100.7 it''s enough to put a
>
> route add -net 192.168.3.0 192.168.100.5
what OS is this? on Linux it should be something like
route add -net 192.168.3.0/24 gw 192.168.100.5

>
> so the external system will know where to route the answers.
> So the behaviour in this case seems different so i can''t aggregate
two
> pc on one at my adsl home line.
Are you sure that''s enough on real server (non-Xen) setup?

I have an openvpn server which is a Xen PV domU (pretty old, it still
runs RHEL4). With tun setup, the easiest way is to do NAT (masquarade)
on openvpn server so all traffic from openvpn client will be seen by
others as coming from openvpn server. Routing might also work, but I
find it cumbersome to manually add routes all hosts I''m trying to
access. NAT is much easier.

The point is from my experience being a Xen domU makes no difference
whatsoever compared to real server w.r.t openvpn.
>
> We''ll see if someone have some good suggestion, i think the
question
> is enough generic to be interesting.
Good luck, hope you''ll find some answers.

-- 
Fajar

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users