1 OpenVPN Server, multiple "client routers", same subnet, L2

0whatever

Hi,

I'm trying to set up the following:
OpenVPN Server (as server)
OpenVPN "Client Router1" (as Router1) with n clients
OpenVPN "Client Router2" (as Router2) with n clients
OpenVPN "Client Router3" (as Router3) with n clients
OpenVPN "Client Router..." ...
All within the same subnet (let's use 192.168.10.0/24) and < layer 3.

Every "Client Router" should be able to have n clients which are able to access every port on every host from every other client.
The server only has to be the single point where the "Client Routers" can connect.
The actual clients will then be connected to the "Client Routers" and should know nothing about the VPN.
I want to be able to use broadcasts or even protocols like IPX.

(No, this is not a production setup for a company or similar 😉)

Any hints? Or is there a better way to achieve this?

Thanks in advance!

Traffic

0whatever wroteI want to be able to use broadcasts or even protocols like IPX

You require TAP OSI-Layer 2

0whatever

Thank you for the response!

It's clear I have to use TAP devices, however, it's not clear to me how to do the rest of the configuration.

Since I want to use the same subnet for all "Client Routers" I'm not sure how to route the packages properly. Is this even possible? Or is there a better solution which still makes broadcasts possible?

Traffic

0whatever wroteit's not clear to me how to do the rest of the configuration

For Bridging:

0whatever

Traffic wroteFor Bridging:
http://openvpn.net/index.php/open-source/documentation/howto.html#vpntype

http://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html

Thanks again, Traffic. However, it's still not clear to me. If I only wanted to create a site2site network it would be fine, however, I only want to use the server to route the traffic - I do not want to bridge traffic on/from/to the server.

So it's not clear to me how to configure the server/clients.
Does it work to just bridge the network and tap interface on the "client routers"?
Will the server then assign IP-Addresses to all of the clients through the "client routers"?
Is my assumption correct that I do not have to add a bridge on the server (since I do not want to send data from/to the server, except for the clients communicating with each other through the VPN)

I will start playing with configurations next week, I don't have the equipment (rasperrys 😉) yet. However, I would like to understand what I'm doing before I start.

Traffic

--dev tun is OSI Layer 3 (IP level) network - It will not pass IPX or Broadcasts.

--dev tap is OSI Layer 2 (ethernet frame level) network - It will pass IPX and Broadcasts.

Once you get your equipment I suggest you start with --dev tun and play around with it.
If you find you must use IPX etc (for LAN games etc) then you will most probably require
-dev tap (above)

Until you get your equipment, I advise you read the documentation and learn OpenVPN that way.