0

I have the following use case for which I need to figure out a VPN solution.

  • 100+ remote locations
  • Each remote location has several users that should be able to connect to only that remote location
  • Users are not in the same location as the remote location
  • Users should have access to the local network of the remote location
  • Different locations should not have access to each other

My idea is to have a central VPN server and than have each remote location and all users connect to that and somehow route traffic destined for the remote locations lan from the client, to the server, to the remote location.

I need to use a central vpn server as some of the network infrastructure is outside of my control and won't allow for incoming connections so the VPN has to be initiated from the remote location.

So far I've tried pfsense and openvpn and while I can set up the tunnel I cannot reach the remote lan in a client <--> server <--> client setup (I can in a simpler client <--> server setup). I'm also worried about managing such a large amount of locations and users with pfsense.

Improve this question
4
  • 1
    You can use anyconnect VPN + DMVPN for remote locations. You can group users and create different VPN groups with different SPLIT tunnel routes. DMVPN can be used for centralised VPN solution. It can be designed in redundant fashion with underlaying VRFs improving security.
    – Viktor Borisov
    Sep 24, 2020 at 6:04
  • I can set up the tunnel I cannot reach the remote lan - then something is missing in your config. Without giving us any details, we won't be able to help you. Make sure client VPN <=> VPN hub works and VPN hub <=> remote location does. Then check out your routing tables and policies.
    – Zac67 ♦
    Sep 24, 2020 at 6:25
  • I removed the off-topic request for recommendations. Recommendations are off-topic for almost all SE sites, except Software Recommendations and Hardware Recommendations.
    – Ron Maupin ♦
    Sep 24, 2020 at 13:08
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 22:33

1 Answer 1

Reset to default
1

My idea is to have a central VPN server and than have each remote location and all users connect to that and somehow route traffic destined for the remote locations lan from the client, to the server, to the remote location.

That is pretty much the standard configuration - hub-spoke for headquarters to branch office connections and a central VPN gateway for roaming users. We're using OpenVPN for the clients in this exact scenario, albeit with fewer branch locations.

On the client VPN gateway you need to set up groups with the required access privileges - likely one group for each location. With that number of locations/groups, look out for a solution that supports an API or scripting for setup.

Each of these groups you either directly grant access to their remote location, or you assign a distinct address pool that lets you decide who-goes-where on the hub gateway.

If there are connectivity problems, make sure

  • the client can ping its tunnel gateway inside
  • the client can ping the central gateway
  • the client can ping their branch gateway
  • you've set up all routes from the VPN gateway to the branch networks and the opposite(!) direction, either statically or using a routing protocol like OSPF
  • you've permitted the VPN clients access to their respective location on all intermediate gateways and firewalls.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.