How to organize remote access to the central office network of a single server in a branch?

Question

linux

The essence of the problem boils down to the following: it is necessary to "bring" AD DS to the branches. It is planned to put in each branch of the RODC, which somehow must be connected to the central office. Access for client machines to the central office network is not needed, ideally it should not be available at all. At the central office, the role of a router and a firewall is performed by a box with Linux, external ips are static.
Ie, actually, the tunnel from RODC to normal DC is necessary. And it is desirable that you do not have to install any software on the RODC (OpenVPN client, for example). What are the options?
UPD: Okay, NOT stopped at l2tp + ipsec. The question is the following: the provider gives the Internet to the central office via pppoe. L2TP over IPsec over PPPOE = triple encapsulated traffic, inside of which there can be a bunch of encapsulations - will this even work?

Answer 1

I read tons of materials on VPN, decided to stop at IPsec + GRE. It seems like this is the standard mode of VPN operation based on Cisco routers, which in the future will require less effort to reconfigure the equipment, plus it will reduce the overhead during encapsulation (one nested level less!).

Answer 2

Site-to-site VPN with a branch router (as an OpenVPN variant ). Next, configure the firewall.

Answer 3

Better site2site on the border. So at least if rodc fails, everything will continue to work.
If you don’t want to bother with gateways in branches, then you can use RRAS

Answer 4

Will work. Encapsulation will decrease the mtu of each successive layer.
I advise you to google ipsec mtu problem\calculator.