I've been administering two OpenVPN servers for several years now. I want to enable access from iOS; however, my servers use TAP (for good reasons, I [i]think[/i]) and the iOS app doesn't support TAP (grrr). I've been told that most people who use TAP really don't need to use TAP and can use TUN instead. I'm here for help—I don't understand how I can make what I'm doing work without TAP, so I'm hoping someone here can point me in the right direction. [b]DISCLAIMER[/b]: I'm serving OpenVPN using the VyOS/Vyatta open source router software, so my configurations will look a little different than what some people might be used to seeing. First, here's what I can currently do with TAP that I need to be able to keep on doing if I'm to switch to TUN: [list] [*] Have addresses/routes/DNS options assigned to clients using DHCP. [*] Access my entire internal network and any machines or servers on it from the VPN, just as if I was sitting in the building on the WiFi or ethernet. [*] "Discover" devices broadcast through different methods. For example, I want to be able to discover shared network drives, shared servers, and Bonjour printers. [*] Detect my network-connected DVR. [*] See other Macs on the network that I can (with credentials) activate screen sharing and screen control on. [*] Send internet-bound traffic straight to the internet while my private network-bound traffic goes through the VPN. [*] Have multicast packets sent from machines on the private ("green zone") network go to VPN-connected machines and vice versa. [*] Allow any machines on my private ("green zone") network to access any VPN-connected machines and vice versa.[/list] Second, here's my current configuration (I've only included the parts relevant to my routing and VPN config—firewall, NAT, DNS, and other configs are omitted). The 172.16.122.1 subnet is my private ("green zone") network with DVR, computers, network drives, printers, etc. The 192.168.122.254 subnet is my demilitarized zone containing all of my publicly-facing servers. [code]interfaces { bridge br0 { address 172.16.122.1/24 aging 300 hello-time 2 max-age 20 priority 0 stp false } ethernet eth0 { *** public facing interface omitted for security reasons *** } ethernet eth1 { bridge-group { bridge br0 } duplex auto hw-id 00:14:d1:20:0d:e8 smp_affinity auto speed auto } ethernet eth2 { address 192.168.122.254/24 duplex auto hw-id 00:14:d1:20:0c:6c smp_affinity auto speed auto } openvpn vtun0 { bridge-group { bridge br0 } mode server openvpn-option "--comp-lzo --push route-delay 10 --push route 192.168.122.0 255.255.255.0 172.16.122.1 --push dhcp-option DOMAIN nickhq.com" server { name-server 172.16.122.1 subnet 172.16.122.0/24 topology subnet } tls { ca-cert-file /config/auth/openvpn/keys/ca.crt cert-file /config/auth/openvpn/keys/server.crt dh-file /config/auth/openvpn/keys/dh1024.pem key-file /config/auth/openvpn/keys/server.key } } } service { dhcp-server { disabled false shared-network-name PRIVATE_POOL { authoritative disable subnet 172.16.122.0/24 { default-router 172.16.122.1 dns-server 172.16.122.1 domain-name nickhq.com lease 86400 start 172.16.122.5 { stop 172.16.122.250 } } } } dns { forwarding { cache-size 150 listen-on eth1 listen-on eth2 listen-on vtun0 listen-on br0 system } } ... }[/code]

Using OpenVPN: [list][*]Broadcast packets cannot be routed over a Layer-3 TUN VPN [*]You will probably have to run two servers .. [list=2]one Layer-2 TAP, which will support any protocol. one Layer-3 TUN, which will not.[/list] [*]You will have to accept the limitations imposed by those layers.[/list]

I will re-qualify my earlier statement: "[i]Using OpenVPN [/i]..." [u]Only[/u]! However, it [i]may [/i]be possible to simulate broadcast domains using other 3rd party software .. Using iptables or a broadcast repeater but I cannot recommend those. I am simply stating what OpenVPN can do. For example:[quote="beamerblvd"]I want to be able to discover shared network drives[/quote]"[i]Using OpenVPN [/i]..." [u]Only[/u]! this can only be achieved using TAP. It is possible to use TUN and a WINS/Samba server as well but, technically, you will [u]not[/u] be "[i]discovering[/i]" shares via broadcasts, you will be implementing the SMB protocol and contacting a central server. So, once again, broadcasts are [u]not[/u] supported by TUN. (Configuring WINS/Samba is beyond the scope of my experience .. tried it:didn't like it) It is possible to use network shares over TUN by specifying host/share (eg. //192.168.1.101/movies). However, I don't know if bonjour has a similar server solution. Finally, using a router to run OpenVPN is most likely going to throw even more incompatibilities at you :( And so .. I would recommend running OpenVPN on a dedicated Linux server in TUN mode and then learn all about your other requirements as you go .. Be Prepared to read a Lot! and probably be disappointed quite often. * This is from a IPv4 stand-point only.

Can I replace my TAP-based tunnels with TUN?

beamerblvd

I've been administering two OpenVPN servers for several years now. I want to enable access from iOS; however, my servers use TAP (for good reasons, I think) and the iOS app doesn't support TAP (grrr).

I've been told that most people who use TAP really don't need to use TAP and can use TUN instead. I'm here for help—I don't understand how I can make what I'm doing work without TAP, so I'm hoping someone here can point me in the right direction. DISCLAIMER: I'm serving OpenVPN using the VyOS/Vyatta open source router software, so my configurations will look a little different than what some people might be used to seeing.

First, here's what I can currently do with TAP that I need to be able to keep on doing if I'm to switch to TUN:

Have addresses/routes/DNS options assigned to clients using DHCP.
Access my entire internal network and any machines or servers on it from the VPN, just as if I was sitting in the building on the WiFi or ethernet.
"Discover" devices broadcast through different methods. For example, I want to be able to discover shared network drives, shared servers, and Bonjour printers.
Detect my network-connected DVR.
See other Macs on the network that I can (with credentials) activate screen sharing and screen control on.
Send internet-bound traffic straight to the internet while my private network-bound traffic goes through the VPN.
Have multicast packets sent from machines on the private ("green zone") network go to VPN-connected machines and vice versa.
Allow any machines on my private ("green zone") network to access any VPN-connected machines and vice versa.

Second, here's my current configuration (I've only included the parts relevant to my routing and VPN config—firewall, NAT, DNS, and other configs are omitted). The 172.16.122.1 subnet is my private ("green zone") network with DVR, computers, network drives, printers, etc. The 192.168.122.254 subnet is my demilitarized zone containing all of my publicly-facing servers.

interfaces {
    bridge br0 {
        address 172.16.122.1/24
        aging 300
        hello-time 2
        max-age 20
        priority 0
        stp false
    }
    ethernet eth0 {
        *** public facing interface omitted for security reasons ***
    }
    ethernet eth1 {
        bridge-group {
            bridge br0
        }
        duplex auto
        hw-id 00:14:d1:20:0d:e8
        smp_affinity auto
        speed auto
    }
    ethernet eth2 {
        address 192.168.122.254/24
        duplex auto
        hw-id 00:14:d1:20:0c:6c
        smp_affinity auto
        speed auto
    }
    openvpn vtun0 {
        bridge-group {
            bridge br0
        }
        mode server
        openvpn-option "--comp-lzo --push route-delay 10 --push route 192.168.122.0 255.255.255.0 172.16.122.1 --push dhcp-option DOMAIN nickhq.com"
        server {
            name-server 172.16.122.1
            subnet 172.16.122.0/24
            topology subnet
        }
        tls {
            ca-cert-file /config/auth/openvpn/keys/ca.crt
            cert-file /config/auth/openvpn/keys/server.crt
            dh-file /config/auth/openvpn/keys/dh1024.pem
            key-file /config/auth/openvpn/keys/server.key
        }
    }
}
service {
    dhcp-server {
        disabled false
        shared-network-name PRIVATE_POOL {
            authoritative disable
            subnet 172.16.122.0/24 {
                default-router 172.16.122.1
                dns-server 172.16.122.1
                domain-name nickhq.com
                lease 86400
                start 172.16.122.5 {
                    stop 172.16.122.250
                }
            }
        }
    }
    dns {
        forwarding {
            cache-size 150
            listen-on eth1
            listen-on eth2
            listen-on vtun0
            listen-on br0
            system
        }
    }
    ...
}

Traffic

Using OpenVPN:

Broadcast packets cannot be routed over a Layer-3 TUN VPN
You will probably have to run two servers ..
- one Layer-2 TAP, which will support any protocol.
  one Layer-3 TUN, which will not.
You will have to accept the limitations imposed by those layers.

beamerblvd

So is it just the one bullet (about multicast packets) that would break over TUN? Or are many of these other things (Bonjour, discovering machines, etc.) dependent on broadcast packets and therefore won't work over TUN?

beamerblvd

Also, I thought that broadcast packets could work—though different—on either layer. My understanding was that Layer 2 broadcast packets were sent to the broadcast MAC address while Layer 3 broadcast packets were sent to the broadcast IP address. Isn't any broadcast packet sent to 172.16.122.255 on (for example) port 2323 by definition a Layer 3 packets since it's sent to an IP address?

Traffic

I will re-qualify my earlier statement: "Using OpenVPN ..." Only!

However, it may be possible to simulate broadcast domains using other 3rd party software .. Using iptables or a broadcast repeater but I cannot recommend those. I am simply stating what OpenVPN can do.

For example:

beamerblvd wroteI want to be able to discover shared network drives

"Using OpenVPN ..." Only! this can only be achieved using TAP. It is possible to use TUN and a WINS/Samba server as well but, technically, you will not be "discovering" shares via broadcasts, you will be implementing the SMB protocol and contacting a central server. So, once again, broadcasts are not supported by TUN. (Configuring WINS/Samba is beyond the scope of my experience .. tried it:didn't like it)

It is possible to use network shares over TUN by specifying host/share (eg. //192.168.1.101/movies). However, I don't know if bonjour has a similar server solution.

Finally, using a router to run OpenVPN is most likely going to throw even more incompatibilities at you 🙁

And so .. I would recommend running OpenVPN on a dedicated Linux server in TUN mode and then learn all about your other requirements as you go .. Be Prepared to read a Lot! and probably be disappointed quite often.

* This is from a IPv4 stand-point only.