Skaperen i am currently running some tunnels by PSK. they are started symmetrically with the same key (client-client). i am looking for a way to use TLS. one limitation i have is that shared data is the same .. e.g. i can securely share the same key with each host. they can only be started the same way ... that is i cannot designate one as the server very easily they are identical cloud instances) an they may both start at the same time (the logic of become a server if client connection times out could end up with 2 servers listening for each other), is there a way to use TLS (because it is over UDP) symmetrically?
Skaperen Traffic wroteYes they're is :mrgreen: good! is it with client certs at both ends or server certs at both ends?
Skaperen Traffic wroteIt is with client and server certs at both ends .. it is symmetrical. is there an example config?
TiTex take a look at the howto page https://openvpn.net/index.php/open-source/documentation/howto.html the manual https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage and the wiki https://community.openvpn.net/openvpn/wiki
Traffic Technically, what you are looking for is "Meshed VPN" which OpenVPN does not support. This is why there are no examples or Howtos or details in the manual for it. However, it can be foobar'd and your idea is on the right lines .. symmetrical. TLS comes in two flavours: TLS-Server and TLS-Client (From OpenVPN). Using TLS with OpenVPN requires that you designate each node as one or the other. In order to simulate meshing you must designate each node as both by running two instances of OpenVPN on each node (one as server, one as client). For this to work successfully, you must configure both network Firewalls as a server. But what do you do if you want to add a third node ? :shock: The easy answer is to setup your environment correctly and designate a single server and designate all other nodes as clients.
Skaperen this is my latest idea now: 0. both ends are identical and have the same static PSK. 1. symmetric PSK to start via UDP ports 1193|1193. 2. each side generates a random number and exchanges them over the 1st tunnel. 3. the host with the larger number will be (take on the role of) the server. 4. certs are generated by role and exchanged as needed. 5. startup a normal TLS-based tunnel via UDP ports 1194|1194 6, take down the 1st tunnel that was started via UDP ports 1193|1193. there are many of these, so, many tunnels. one host can be a server for one tunnel and be a client for another. port 1194 can be used all around based on differently peered addresses (BTDT with PSK).
