OpenVPN Access Server System Administrator Guide

2.2.1 One Network Interface on Private Network Behind the Firewall
This configuration is most commonly seen when the Access Server resides in an internal corporate
network, providing VPN access to users outside the corporate network. In this configuration the
Access Server has one network interface connected to the private network (note that other
interfaces may be present on the system but will not be utilized in by the Access Server). This
scenario is illustrated in Figure 2.
PRIVATE IP
NETWORK
PRIVATE IP
Internet Gateway / Firewall
PUBLIC IP
PUBLIC IP NETWORK
(INTERNET)
OpenVPN Access Server System Administrator Guide
PRIVATE IP
OpenVPN
ACCESS
SERVER
Figure 2: Access Server on Private Network Behind a Firewall
In this configuration, it is required that the Internet Gateway be set up to forward desired TCP/UDP
port traffic from the public IP to the Access Server‟s private IP address. At a minimum, one TCP
port (typically port 443) needs to be forwarded,. That can carry both the VPN tunnel traffic and the
Web Client Server/Connect Client traffic. Optionally, the VPN tunneling can be separated from the
Web Client Server traffic, in which case an additional TCP or UDP port (e.g., UDP port 1193)
must be forwarded for the VPN tunnel purposes.
A variation on this network configuration has the Access Server with one interface attached to a
DMZ network provided by the firewall. The same forwarding of client traffic is required (as
above); additionally, the firewall may need to be configured to allow traffic between the Access
Server and the private network behind the firewall.
2.2.2 Two Network Interfaces, One on Public and One on Private Network
This configuration is most commonly seen when the Access Server resides in an internal corporate
network but it also has its own public IP address (see Figure 3). The Access Server communicates
with clients outside the corporate network via its public IP interface. It uses another network
interface to communicate with hosts on the private IP network and to propagate packets between
VPN tunnels and the private network.
6