One server as "switch" for many clients

niklas

Hi.

I'd really appreciate some help with configuration. I've searched a lot but am still not sure which way to create this setup.

My goal:
To have many (5-20) clients on different locations appear to be on the same subnet. The software that will run on the clients will also use broadcast on subnet.

My proposed solution:
I have an external server (static IP and doman name, no LAN behind) that will run OpenVPN (UDP 1194) and create a vpn-subnet that clients will get IP-addresses from. The clients will all run OpenVPN and connect to the server. The client traffic should go to the right client, or all in case of broadcast. No services or resources on the server needs to be available to the clients.

I first thought that this would be easy with a tun0 on server with "client-to-client" in server.conf. But then I read that that didn't support broadcast, so I'm now thinking on a tap0 on the server.

A lot of the documentation covers bridging tap0 and a LAN/eth1, but I would like to "bridge" all clients connected to the same tap0. I saw a guide that had one tap/vpn-server per client and then bridged all taps (eg. br0 = tap0 tap1 tap2 etc.). But I think that is excessive work keeping track of different ports and not knowing how many vpn-servers I need.

Is there a way to make all the clients "see" each other?

I'm very thankful for help. =)

niklas

Thanks for the reply. Much appreciated.

So client-to-client works for tap. I didn't get that impression from guides or documentation, looked like it was only for tun. I'll start setting it up and testing.

lordbah

Interested in something similar, but I can't see the reply for which you gave thanks. Was it private?

Traffic

niklas wroteSo client-to-client works for tap

That is all she wrote ..

lordbah

Thanks.

Is there any feasible zero-server configuration? What I mean is when there is no obvious choice of one computer to be the server, and if any one computer goes down then communications between all of the other computers should continue to be encrypted. So either never any server, or an initially typical one-server case but when the server goes down the clients elect a new server, or maybe they all try to step up and be the new server but only one succeeds, or something like that. The computers would all have to remain unique in the case I'm thinking of, and there's no $$ for redundant hardware.

Traffic

OpenVPN comes in two basic flavours; point-to-point and 1-Server-to-Many-Clients (one dedicated server). Depending on other factors, you could run multiple server and clients on each host but OpenVPN cannot change its role once activated .. so this:

lordbah wrotewhen the server goes down the clients elect a new server

is not a feature of openvpn.

Pippin

Hello,

If you need a mesh-VPN, take a look at http://www.tinc-vpn.org/