andreas74a
Hello guys,
when I look for differences between TUN and TAP I just find discussions that the TAP-device should be bridged to the ethernet device of the VPN server host. As far as I understand in all other cases TUN-device shall be better. Hm, why?
My use case: A single server rented some where in the web - OpenVPN installed shall do this:
Many (even small) customers have technicians and some where in the world technical installations with a UMTS/LTE-router. Technicians shall service the technical installations remote via Internet, our VPN-Server and these UMTS/LTE-routers.
Each customer gets its own OpenVPN-instance to hide different customers to each other.
It would be nice, when the technician can access devices behind the router direct routed without D-NAT.
Solution with TUN-devices is very complicated:
- technician needs a route "goal-net via VPN-Server"
- server OS needs an "ip rule all VPN-subnet in table X" and "ip route table X to dev tunX"
- OpenVPN-server needs an "internal route (iroute) goal-net linked to the client certificate of the remote router"
example:
client-special server-config for technician:
push "route 172.16.1.0 255.255.255.0 10.8.0.1"
in Linux:
ip rule add from 10.8.0.0/24 table 1
ip route 172.16.1.0/24 table 1 dev tun1
client-special server-config for remote installation:
iroute 172.16.1.0 255.255.255.0
Naturally the UMTS/LTE-router is configured for routing and is the default router for all devices behind it. 😉
Solution with TAP-devices look quite more logic and quite more familiar to regular routing:
- technician needs a route "goal-net via remote router"
example:
client-special server-config for technician:
push "route 172.16.1.0 255.255.255.0 10.8.0.3" (IP-address of the remote router)
And naturally the UMTS/LTE-router is configured for routing and is the default router for all devices behind it. 😉
Additionally since TAP isn't a pointopoint device but an ethernet device it has a regular MAC-address (I assume the administrate address space is used) and you can use the whole IP-address space:
10.8.0.1 - server
10.8.0.2 - technician1
10.8.0.3 - router of 1st remote installation
10.8.0.4 - router of 2nd remote installation
... and so on
And if you analyze the network traffic e.g. with tcpdump or wireshark then the packets are looking familiar to regular ethernet packets.
AND NOW MY EXCITING QUESTION!!! Why shall I use the TUN-devices anyway? Please don't say since I don't wanna bridge to the ethernet device. :lol:
Best to all of you
Andreas
