We are a small company that manufactures machines for the industry. What I need today is an access to the machines when they are in our workshop (construction and adjustment) but also, and this is where it gets complicated, an access when they are on the customer's site.
Our machines have a precise numbering in 2 series, 100'000 and 200'000. So I imagined (so that my colleagues can easily find the machine to connect to and so that the configuration is easier), a solution of numbering by IP address based on 10.XXX.XXX.0/8.
Thus, machine 100'114 will have as addresses the range 10.100.114.0/8, so the PLC 10.100.114.11, the monitor 10.100.114.12, various peripherals 10.100.114.21, 22, 23,... In the same logic, the machine 200'103 will have the network 10.200.103.0/8.
Then I changed our company network to 10.0.0.0/8 and each machine can communicate with our staff in the workshop without any problem and the machine's computer has access to the Internet to download the necessary software and/or operating system (Linux) updates.
On our OPNSense 10.0.0.1/8 router, I configured the OpenVPN server with the range 192.168.0.0/16 and the "client specific replacement" to set a specific IP address. For our 100'114 machine, it will be 192.168.100.114.
Now, I want to access from the 10.0.0.51/8 desktop computer to entire network of my machine. For example to manage the 100'114 PLC I will access to 10.100.114.11/8 via 192.168.100.114/16 but I can't get the routes to work.
I managed to open the VPN tunnel: UDP4 TUN 1194 but no communication goes through.
Worse, the communication in the machine does not work anymore, because OpenVPN, during the connection, removes the default route 10.0.0.0 in the configuration. Do I nee to write all static routes on Up and Down sections of the openVPN script to keep them?
I was thinking the next push route will be enough :
push "route 10.100.114.0 255.255.255.0 192.168.100.114"
In fact I am lost with the route parameters to configure on OpnSense, OpenVPN server side, OpenVPN client side...
Note that on the PC in the machine I have 2 network cards, the first eth0 is for the internal communication of the machine, the second eth1, in DHCP, connected to the client network.
Who can help me? Is my approach good? Do I need to use NAT solution ?