OpenVPN advice for multiple simultaneous clients on same host

[claus]

Hello all

My apologies if I get some terminology a little wrong, this isn't my specialty. I have an Ubuntu Linux host that polls a set of remote sensors (each of which is a Linux host) for data at regular intervals, usually about every 10 seconds. Each physical location has a single network unit providing cellular connectivity, and runs a private LAN on which the individual sensors are uniquely addressed (i.e. there's a private subnet that I can access from my host via the VPN connection, transparently using the host's routing table). The connection from my host to the remote unit is over an OpenVPN connection that I have running as a system service using a configuration file provided by the CradlePoint vendor, and I have had a single location up and running for several months with no issues.

I am now ready to try to get a second location up and running, meaning that I will need to keep a second OpenVPN connection open. The vendor supplied the units all with the same subnet, so I will definitely have to change that so that the routing table doesn't get all bollixed up, but I was hoping someone could weigh in with other things to watch out for as I do my testing. Looking at the configuration files I see the following entries (redacting some things for privacy):

client
dev tun
proto udp
port [port number redacted]
persist-tun
persist-key
keepalive 10 60
cipher AES-256-CBC
auth SHA512
local [local IP address redacted]
remote [remote VPN host IP address redacted] [port number redacted but same as above] udp
route [remote LAN subnet redacted] [remote LAN netmask redacted]

From one unit to the next, the only thing that varies is the remote VPN host IP address; they all use the same port number. I will obviously be changing the local subnets to be unique. I would like to leave the local binding the same as they are all communicating over the same physical interface. What else will I need to change in order to keep them all open at once? I see in the OpenVPN FAQ:

Can I run multiple OpenVPN tunnels on a single machine?​

Yes, of course.
If you are running 2 or more OpenVPN instances on the same machine, you will need a separate virtual TUN/TAP adapter and a separate port (using the port directive) for each instance.
Make sure each TUN/TAP adapter has a unique, non-overlapping subnet using server, server-bridge, or ifconfig.

but this seems more directed to the server side of things, as I don't have any server, server-bridge, or ifconfig entries in my config file. Do the ports need to be different on my side given that they're contacting different server addresses? Keeping multiple services going on the host itself with systemctl seems to be no issue, but I tried to start one using perhaps naive settings and no new TUN device showed up in my 'ip a' output.

Thanks for any input.

 

[eibgrad]

From the OpenVPN client's perspective, the local port is typically ephemeral, meaning it's arbitrary, and automatically determined on-the-fly as each connection is established. It's no different than when you're connected to multiple webservers across different remote public IPs. So that's a NON issue.

As long as each OpenVPN connection is using a different IP network on the server side, then you can address each of them using simultaneous connections since there is no ambiguity from the OpenVPN client's perspective in determining the proper routing. Of course, your *own* local IP network on which the OpenVPN client is running can't conflict with any of those remote IP networks either.

But I do see one potential problem here. The tunnels created by each OpenVPN connection must have their own unique IP networks as as well! And that can only be determined from the OpenVPN server's config file.

 

[claus]

Hm. So if I understand what you're saying, depending on how the OpenVPN server is set up, I may not be able to have multiple tunnels open even if they're contacting different hosts (or, at least, different IPs) to set them up?

I think I see what you're talking about. The subnet for my remote sensors is 192.168.145.x, but when I connect to the VPN server, the actual gateway for that subnet is 192.168.146.5, which presumably was supplied by the VPN server. So unless they serve me a different gateway I'm stuck.

I have access to the remote network device, so I guess it's time to break out the manuals and see if there's any way to manipulate that from there. Assuming I can understand it...

Thank you very much for this information, it helps to clarify what my options are.

 

[eibgrad]

Yes, that's pretty much it. When dealing w/ a routed (TUN) OpenVPN connection, you have three (3) private IP networks to consider (client, tunnel, and server). ALL of them must be unique and non-overlapping. That's why if you're simply duplicating the server config from one system another, you won't be able to manage simultaneous connections because every tunnel will presumably be using (for example) 10.8.0.x. Just like the remote IP network itself, the tunnels have to be unique and non-overlapping too.