Overview
This guide provides step-by-step instructions to establish a site-to-site VPN connection between two routers, with one acting as the OpenVPN® server and the other as the client.
Prerequisites
- Two Routers: For this setup, we are using the GCC6010W as the OpenVPN® server and the GWN7052F as the client.
Refer to the table below for a list of supported devices.
Device Series | Models Supported |
GWN70x2 (Wireless Routers) | GWN7052, GWN7052F, GWN7062, GWN7062E, GWN7062ET, GWN7062M |
GWN70xx (Wired Routers) | GWN7001, GWN7002, GWN7003 |
GCC601x (Convergence Devices) | GCC6010W, GCC6010, GCC6011 |
GCC602x (Convergence Devices) | GCC6020, GCC6021 |
OpenVPN® Site-to-Site supported devices
Network Topology
Below is a representation of the network topology used in this guide:
Server Configuration (GCC6010W)
Step 1: Configure the OpenVPN® Server
Go to Networking → VPN > OpenVPN® → OpenVPN® Servers tab, then click on “Add” button to add a new OpenVPN® Server. Refer to the figures and table below to correctly fill in the configuration fields.
Name | The name assigned to the OpenVPN server configuration. This helps identify the configuration in the interface. |
Status | Toggle to enable or disable the OpenVPN server. The server must be enabled to accept connections. |
Protocol | The protocol used by OpenVPN for communication. UDP is preferred for better performance and lower latency. |
Interface | The network interface on which the OpenVPN server will listen. This is typically the WAN interface for external connections. |
Destination | Specifies the allowed destination networks. ‘All’ allows the VPN server to accept connections from any network. Note: When selecting “All”, subsequent new interfaces will be automatically included. |
Local Port | The port number on which the OpenVPN server listens. The default port for OpenVPN is 1194. Note: The OpenVPN® client and server cannot share the local port of the same interface. |
Server Mode | This field allows you to set the authentication mode between the server and the client. The available options are:
Recommendation: SSL + User Authentication is the best choice for security because it combines robust encryption with user authentication, ensuring that both the connection and the identity of the users are secured. This dual-layer protection makes it much harder for unauthorized users to gain access or for data to be intercepted during transmission. Note: after selecting and saving the server mode, you need to configure the corresponding user information under the “Remote User” settings according to the selected server mode. |
Encryption Algorithm | The encryption method used for securing the VPN traffic. AES-256-CBC is a strong encryption algorithm ensuring data confidentiality. |
Digest Algorithm | The algorithm used for message integrity to prevent tampering. SHA256 is a secure hash algorithm that verifies data integrity. |
TLS Identity Authentication | Enables mutual verification between the server and client using TLS. Turning this on enhances security by preventing impersonation attacks. Turn ON to:
Turn OFF to:
|
Allow Duplicate Client Certificates | Allows multiple clients to connect using the same certificate. Disable for higher security, forcing unique certificates per client. Note: cannot be used in PSK mode. |
Redirect Gateway | Forces all client traffic, including internet traffic, to route through the VPN server. This option ensures that the VPN server becomes the default gateway for the client, securing all data transmitted by the client through the VPN tunnel. Use this to protect all client traffic when connected to the VPN. |
Push Routes | Routes that are pushed to the client from the server. This informs the client about accessible networks through the VPN. Example: 192.168.80.0/24 Click on “+” and “–” icons to add ore delete subnets. |
LZO Compression | This option enables or disables data compression for the VPN connection. Compression can reduce the amount of data sent over the VPN, potentially improving performance on slow links by reducing bandwidth usage.
Important Note: If compression is enabled on the server, the client must also enable it (or set it to adaptive) to connect properly. If there’s a mismatch, the network may not be accessible. |
Allow Peer to Change IP | This setting allows the remote VPN client (peer) to change its IP address or port without disconnecting from the VPN server. This is particularly useful in situations where the client’s IP address changes frequently, such as when a client is connecting from a dynamic IP environment or moving between networks.
Recommendation: Enable this option if the remote client frequently changes IP addresses to maintain a stable VPN connection. |
CA Certificates | Certificate authority used for the server, which verifies the server certificate. This is crucial for establishing a secure connection. Select from the drop-down list a CA Certificate or click on “Add” to add new one. |
Server Certificate | The certificate used by the OpenVPN server. This certificate is presented to the client to establish a secure connection. Select from the drop-down list a CA Certificate or click on “Add” to add new one. |
IPv4 Tunnel Network | This setting defines the virtual IP address range used for the VPN tunnel. This network is distinct from both the client’s local network and the server’s local network. The VPN server assigns IP addresses from this range to connected clients, creating a private network over the VPN.
|
OpenVPN® Server Configuration
Step 2: Add a New CA Certificate
Click on “Add” under the CA Certificates section on the OpenVPN® Server configuration page, or navigate to System Settings → Certificates page → CA Certificates tab, Fill in the following fields:
Cert. Name | The name assigned to the CA certificate for easy identification. Example: MyVPN_CA |
Key Length | This setting specifies the size of the cryptographic key used in the certificate, measured in bits. The key length determines the strength of the encryption, the larger the key, the more secure the encryption, but it also requires more processing power.
Recommendation: 2048 bits is typically recommended for most scenarios as it offers strong security without significantly impacting performance. For environments requiring the highest security, 4096 bits may be preferred, though at the cost of increased processing overhead. |
Digest Algorithm | The hash algorithm used to sign the certificate. SHA256 is more secure than SHA1 and is recommended. |
Expiration (D) | Defines the validity period of the certificate in days. Longer periods reduce the need for renewal. |
SAN | SAN (Subject Alternative Name): Specifies an additional identifier for the certificate, either an IP address or a domain name.
Note: If required by specific configurations (like SSL proxies), the SAN field might need to be set to “None” for compatibility. |
IP Address/Domain | If SAN is set to IP Address or Domain, specify the IP Address or Domain. |
Country / Region | Country where the organization is located. Example: United States of America |
State / Province | State or province where the organization is based. Example: California |
City | City where the organization is located. Example: SanFrancisco |
Organization | The name of the organization for which the certificate is issued. Example: TechCorp |
Organizational Unit | The specific department or unit within the organization. Example: ITDepartment |
Email address associated with the certificate for contact purposes. Example: admin@techcorp.com |
OpenVPN® – Add CA Certificate
Step 3: Add a Server Certificate
Click on Add under the server certificate section on the OpenVPN® Server configuration page, or navigate to System Settings → Certificates page → Certificates tab, Fill in the following fields:
Cert. Name | The name assigned to the Server certificate for easy identification. Example: MyVPN_Server |
CA Certificates | Select the CA certificate that issued this server certificate. Example: MyVPN_CA |
Certificate Type | Specifies the type of certificate being created, typically ‘Server’ for VPN server use. |
Key Length | This setting specifies the size of the cryptographic key used in the certificate, measured in bits. The key length determines the strength of the encryption, the larger the key, the more secure the encryption, but it also requires more processing power.
Recommendation: 2048 bits is typically recommended for most scenarios as it offers strong security without significantly impacting performance. For environments requiring the highest security, 4096 bits may be preferred, though at the cost of increased processing overhead. |
Digest Algorithm | The hash algorithm used to sign the certificate. SHA256 is more secure than SHA1 and is recommended. |
Expiration (D) | Defines the validity period of the certificate in days. Longer periods reduce the need for renewal. |
SAN | SAN (Subject Alternative Name): Specifies an additional identifier for the certificate, either an IP address or a domain name.
Note: If required by specific configurations (like SSL proxies), the SAN field might need to be set to “None” for compatibility. |
IP Address/Domain | If SAN is set to IP Address or Domain, specify the IP Address or Domain. |
Country / Region | Country where the organization is located. Example: United States of America |
State / Province | State or province where the organization is based. Example: California |
City | City where the organization is located. Example: SanFrancisco |
Organization | The name of the organization for which the certificate is issued. Example: TechCorp |
Organizational Unit | The specific department or unit within the organization. Example: ITDepartment |
Email address associated with the certificate for contact purposes. Example: admin@techcorp.com |
OpenVPN® – Add Server Certificate
Step 4: Add a Client Certificate
Click on “Add” under the Client Certificate section on the Remote Users configuration page, or navigate to System Settings → Certificates page → Certificates tab, Fill in the following fields:
Cert. Name | The name assigned to the Server certificate for easy identification. Example: MyVPN_Client_Cert |
CA Certificates | Select the CA certificate that issued this server certificate. Example: MyVPN_CA |
Certificate Type | Specifies the type of certificate being created, typically ‘Client’ for VPN client use. |
Key Length | This setting specifies the size of the cryptographic key used in the certificate, measured in bits. The key length determines the strength of the encryption, the larger the key, the more secure the encryption, but it also requires more processing power.
Recommendation: 2048 bits is typically recommended for most scenarios as it offers strong security without significantly impacting performance. For environments requiring the highest security, 4096 bits may be preferred, though at the cost of increased processing overhead. |
Digest Algorithm | The hash algorithm used to sign the certificate. SHA256 is more secure than SHA1 and is recommended. |
Expiration (D) | Defines the validity period of the certificate in days. Longer periods reduce the need for renewal. |
SAN | SAN (Subject Alternative Name): Specifies an additional identifier for the certificate, either an IP address or a domain name.
Note: If required by specific configurations (like SSL proxies), the SAN field might need to be set to “None” for compatibility. |
IP Address/Domain | If SAN is set to IP Address or Domain, specify the IP Address or Domain. |
Country / Region | Country where the organization is located. Example: United States of America |
State / Province | State or province where the organization is based. Example: California |
City | City where the organization is located. Example: SanFrancisco |
Organization | The name of the organization for which the certificate is issued. Example: TechCorp |
Organizational Unit | The specific department or unit within the organization. Example: ITDepartment |
Email address associated with the certificate for contact purposes. Example: admin@techcorp.com |
OpenVPN® – Add Client Certificate
Step 5: Add remote user
Navigate to the Router Web UI → VPN → Remote Users, then click on “Add” button to add a new VPN user.
Name | The name assigned to the VPN user configuration for easy identification. Example: VPN_Client_User |
Status | Toggle to enable or disable the VPN user. |
Server Type | Specifies the type of VPN server the user will connect to. OpenVPN® is selected for this setup. |
Server Name | Select the name of the VPN server that this user will connect to. This field corresponds to the OpenVPN server configured earlier. The user information must match the server’s authentication mode:
Example: If your VPN server is named Office_VPN_Server, you would select that from the dropdown to ensure the user connects to the correct server. |
Username | The username the client will use to authenticate with the VPN server. Example: vpnuser Note: this field is only relevant if the OpenVPN server’s Server Mode is set to SSL + User Authentication or User Authentication. If the server is using only SSL, these fields will not be required. |
Password | The password associated with the username for authentication. Note: this field is only relevant if the OpenVPN server’s Server Mode is set to SSL + User Authentication or User Authentication. If the server is using only SSL, these fields will not be required. |
Client Subnet | Specifies the subnet of the client’s local network that will be accessible from the server side over the VPN. This is a crucial part of setting up a site-to-site VPN, allowing both networks (client and server) to communicate with each other. Because of the Client Subnet configuration, traffic can flow in both directions, making it possible for devices on the server side to access the client side’s network, and vice versa. Example: If your client’s local network is 192.168.70.0/24, entering this subnet will allow devices on the server side to access the client’s network resources over the VPN. |
Client Certificate | Select the client certificate that will be used for this user to authenticate or click on “Add” to add a new one. Example: VPN_Client_Cert |
OpenVPN® – Add VPN User
Step 6: Export Certificates
Go to System Settings → Certificates and export both the CA and Client certificates, including their keys, to your local machine. These files are essential for configuring the OpenVPN® client.
Client Configuration (GWN7052F)
Step 1: Import CA and Client Certificates
Navigate to System Settings > Certificates, and import the CA and Client certificates that were exported from the server previously.
On the CA Certificates and Certificates tab, click on “Import” button then select “.crt and .key files” and upload both files .crt file and .key file for both the CA Certificate and also the Client Certificate.
Step 2: Add a New OpenVPN® Client
Navigate to the VPN page, switch to the OpenVPN® Clients tab, and click the Add button to create a new OpenVPN® client. Complete the required fields as shown in the figure and table below:
Name | The name assigned to the OpenVPN client configuration for easy identification. Example: Office_VPN_Client |
Status | Toggle to enable or disable the OpenVPN client. |
Protocol | Select the protocol for the VPN connection. UDP is recommended for better performance. |
Interface | Select the network interface through which the VPN connection will be established. Example: WAN1 (WAN) |
Destination | Specifies which network interfaces the VPN client can use for communication.
Note: Choose the option that best fits your network setup and security needs. |
Local Port | The local port on which the VPN client will listen. Default: 1194 |
Remote OpenVPN® Server | Enter the WAN IP address or domain name of the remote OpenVPN server. Example: 192.168.5.148 |
OpenVPN® Server Port | Specify the port on which the OpenVPN server listens. Example: 1194 |
Authentication Mode | This setting determines how the VPN client will authenticate with the OpenVPN server:
|
Username | The username the client will use to authenticate with the VPN server. Example: vpnuser Note: The Username field are only relevant when User Authentication or SSL + User Authentication is selected. If the server is set to SSL or PSK, these fields are not needed. |
Password | The password associated with the username for authentication. Example: [Hidden] Note: The Password field are only relevant when User Authentication or SSL + User Authentication is selected. If the server is set to SSL or PSK, these fields are not needed. |
Encryption Algorithm | Choose the encryption algorithm used to secure the VPN connection. Example: AES-256-CBC |
Digest Algorithm | Select the hash algorithm used to verify the integrity of the VPN traffic. Example: SHA256 |
TLS Identity Authentication | This option enables mutual authentication between the server and the client using a TLS pre-shared key. It provides an additional layer of security by ensuring that both parties verify each other’s identity before establishing the VPN connection.
Note: ensure that the server and client configurations match for successful connection and the desired level of security. |
Routes | This field allows you to specify the IP address and subnet mask for routes that should be sent through the VPN tunnel. These routes define which networks on the client side will be accessible from the server side once the VPN connection is established. Click on + and – icons to add or remove networks. Example: If you want devices on the server side to access the 192.168.80.0/24 network on the client side, enter this route in the field. This ensures traffic destined for the 192.168.80.x network is sent through the VPN tunnel. |
Deny Server Push Routes | Toggle to deny server-pushed routes, forcing the client to use only the manually specified routes. By default disabled. |
IP Masquerading | This option enables Network Address Translation (NAT) for the VPN client, making all client traffic appear as if it originates from the VPN server’s IP address. This is useful for simplifying routing and ensuring seamless communication between the server’s network and the client’s network. Note: If IP masquerading does not work, go to Firewall → Basic Settings and enable “Flush Connection on Reload” to ensure firewall rules are applied correctly. |
LZO Compression | Choose whether to enable data compression over the VPN tunnel. Default is On Note: If LZO Compression is enabled on the server side, the client side must also have it enabled or set to “Adaptive” to ensure the VPN connection works correctly. If not matched, the network may become inaccessible. The “Adaptive” option allows the client to adjust its compression setting according to the server’s configuration, ensuring compatibility. |
Allow Peer to Change IP | This setting permits the remote VPN peer (client) to change its IP address or port without disconnecting from the VPN. This is particularly useful in environments where the client’s IP address changes frequently, such as with mobile clients or clients on dynamic IP addresses. Default: Disabled |
CA Certificates | Select the CA certificate to verify the VPN server’s identity. If it’s not already imported, go to System Settings → Certificates to add it. |
Client Certificate | Select the client certificate for VPN authentication. If it hasn’t been imported yet, go to System Settings → Certificates to add it. |
Add a New OpenVPN® Client
Testing the Connection
Step 1: Verify Connection Status
- OpenVPN® Client:
- Go to VPN → OpenVPN® Clients.
- Check the Connection Status column. It should display Connected if the VPN client is successfully connected.
- OpenVPN® Server:
- Go to VPN → OpenVPN® Servers.
- Click the Connected Clients icon (small computer icon) next to the server name to view active client connections. Check the figure below:
- Verify that the client’s IP address, username, and uptime are listed, indicating a successful connection.
Step 2: Test Connectivity from Client to Server
Ping the server-side LAN from a device on the client-side LAN to ensure connectivity.
Step 3: Test Connectivity from Server to Client
Ping the client-side LAN from a device on the server-side LAN to ensure bidirectional communication.
