1

We are a small company that manufactures machines for the industry. What I need today is an access to the machines when they are in our workshop (construction and adjustment) but also, and this is where it gets complicated, an access when they are on the customer's site.

Our machines have a precise numbering in 2 series, 100'000 and 200'000. So I imagined (so that my colleagues can easily find the machine to connect to and so that the configuration is easier), a solution of numbering by IP address based on 10.XXX.XXX.0/8.

Thus, machine 100'114 will have as addresses the range 10.100.114.0/8, so the PLC 10.100.114.11, the monitor 10.100.114.12, various peripherals 10.100.114.21, 22, 23,... In the same logic, the machine 200'103 will have the network 10.200.103.0/8.

Then I changed our company network to 10.0.0.0/8 and each machine can communicate with our staff in the workshop without any problem and the machine's computer has access to the Internet to download the necessary software and/or operating system (Linux) updates.

On our OPNSense 10.0.0.1/8 router, I configured the OpenVPN server with the range 192.168.0.0/16 and the "client specific replacement" to set a specific IP address. For our 100'114 machine, it will be 192.168.100.114.

Now, I want to access from the 10.0.0.51/8 desktop computer to entire network of my machine. For example to manage the 100'114 PLC I will access to 10.100.114.11/8 via 192.168.100.114/16 but I can't get the routes to work.

I managed to open the VPN tunnel: UDP4 TUN 1194 but no communication goes through.

Worse, the communication in the machine does not work anymore, because OpenVPN, during the connection, removes the default route 10.0.0.0 in the configuration. Do I nee to write all static routes on Up and Down sections of the openVPN script to keep them?

I was thinking the next push route will be enough :

push "route 10.100.114.0 255.255.255.0 192.168.100.114"

In fact I am lost with the route parameters to configure on OpnSense, OpenVPN server side, OpenVPN client side...

Note that on the PC in the machine I have 2 network cards, the first eth0 is for the internal communication of the machine, the second eth1, in DHCP, connected to the client network.

Who can help me? Is my approach good? Do I need to use NAT solution ?

Improve this question
7
  • 3
    A single /8 subnet requires all nodes to be "on link" - no routers are used. Instead, you need to use e.g. /24 subnets so that you can route in between.
    – Zac67 ♦
    Apr 18 at 13:57
  • ok thanks, that's the answer I was hoping not to get. But in this case, can I have on the same router and switch several /24 that communicate with each other? In the case of access to the machine in our workshop.
    – Meloman
    Apr 18 at 14:05
  • I'd say reconfiguring the router to switch between locally attached networks (for in-house service) and VPN links (for normal maintenance/monitoring) is the best option.
    – Zac67 ♦
    Apr 18 at 14:30
  • You cannot dictate what IP addressing is used on another's network that you do not control, and trying to do that will often result in serious problems for your client. This is an all too common scenario. What happens if your client's addressing conflicts with the addressing you want to impose? If the client's network is using addressing in the 10.0.0.0/8 range, you may never be able to make it work. Worse, the network and firewalls at many companies simply will not let you even form the VPN because it is a major security risk (think of the Target disaster).
    – Ron Maupin ♦
    Apr 18 at 17:20
  • I'll point to the elephant in the room... why aren't you using IPv6?
    – Ricky
    Apr 18 at 18:34

1 Answer 1

Reset to default
1

As already commented, putting all devices into a 'flat' /8 subnets removes your ability to route. You'd end up juggling with numerous L2 VPN links which you should really want to avoid. And I won't even get started with NAT and proxy ARP as I don't think you'd want to go there.

Instead, you should consider using /24 or longer (when mapping per machine set) or possibly shorter prefixes (when mapping per customer), depending on your strategy and the average customer's size.

Our machines have a precise numbering in 2 series, 100'000 and 200'000. So I imagined (so that my colleagues can easily find the machine to connect to and so that the configuration is easier), a solution of numbering by IP address based on 10.XXX.XXX.0/8.

You're S/N scheme would require you to map each batch separately in your routing. Depending on how those things are integrated on the customer side, a customer-based numbering plan might be more feasible in the long run.

Also, wasting fewer addresses would make locating free subnets within 10.0.0.0/8 much easier.

I'd set up a central router with each customer subnet connected via VPN.

Then I changed our company network to 10.0.0.0/8 and each machine can communicate with our staff in the workshop without any problem

I would never connect a customer device directly into my production network - that is really asking for trouble. Instead, you should set up a customer VLAN (or a handful, as required), separated by router and firewall.

Then, if a machine comes into your workshop, configure a VLAN accordingly and change the central router to route into that VLAN instead of the usual VPN link. Just add a direct route with lower metric/cost temporarily and delete it afterwards.

I can't go into the intricacies of configuring OPNsense as I don't know much of it and it's off topic here anyway, but the setup described above has a much lower complexity than your original plan and should be rather straightforward. It might be a little more trouble changing it around but that's all scriptable.

Improve this answer
1
  • Thanks for answer, I'll think about your approach and study possibilities on OPNSense for routing multiple /24 ranges.
    – Meloman
    Apr 19 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.