net.admin
Hi all,
I'm trying to understand the pro's and con's of tun or tap in a logical sense. I'd greatly appreciate some guidance as to which way (tun or tap) I should go using this hypothetical.
Site 'A' has an Windows Openvpn server and a Windows node on the same network. Lets say their ip's are 10.1.1.1 and 1.2 respectfully.
Site 'B' has a Windows openvpn client machine and a network printer. Let's say their ip's are 192.1.1.1 and 1.2 respectfully.
Lets say I want to connect to the Windows node (10.1.1.2) at Site 'A' via rdp. My understanding is i use 'dev tun' and create a point to point vpn. I then would use 'push route' to allow the Site 'B' openvpn client machine (192.1.1.1) to see the Site 'A' node and therefore rdp to it. If I'm wrong here, please tell me 🙂
Under this configuration, it's my understanding that the Windows node (10.1.1.2) at Site 'A' will not be able to see the network printer with ip 192.1.1.2. Because of this, does it not make more sense to use 'dev tap' and simply bridge two network segments together? My understanding is I can put them on the same network (such as 192.1.1.x) and simply use the vpn as an ethernet bridge between the two sites.
Logically this scenario would be better suited to a tap setup, or am I misunderstanding something about the differences between the two?
Many thanks
TiTex
net.admin
Thanks Titex. I'll check them out today and get back with the result.
net.admin
Okaaaay,
Please feel free to correct me if I'm wrong, but here's what I understand from the reading (thank you again for the links).
1. In this scenario I CAN use TUN (a routed configuration), BUT I won't be able to directly access or ping the site B printer from Site A.
2. I can use TAP (an Ethernet bridging configuration), and will be able to ping/access everything, BUT there will be more traffic (including broadcast) going across the vpn constantly - instead of a TUN vpn only sending traffic across it when it needs to route it to that network. Once said, everything I have read states that the extra load that traffic creates in minimal (both on the vpn and the cpu if you have modern hardware).
So which to use? If I remove the printer from the scenario, the answer is TUN. Just because it reduces vpn traffic and cpu load. But the printer is important, so removing it isn't viable. So for this scenario the answer is TAP, because if I don't the remote site won't be able to see the local printer.
But, (and this component is outside the Openvpn scope), I could either share the printer from the client machine on Site B and have the Site A machine print to that shared device, or use RDP to connect to the Site A client, with printer mapping enabled, which will bring a redirected printer to the Site A client I'm connecting to. Logically, that makes more sense as the RDP session will keep the traffic across the VPN to a minimum, rather than opening files across it.
The TAP setup is slightly more complicated than the TUN, but looking at the examples, it's not a completely different process.
So for this scenario I feel TUN with an RDP addition is the best solution. But if RDP was out of the equation, it would be a TAP solution.
If I'm missing something obvious, please feel free to tell me!
TiTex
1. you are able to acces/ping devices on your remote site , you just have to apply correct routing/firewalling , traffic that's based on layer 2 trafiic/broadcasts won't work (like netbios for example, or DHCP)
2. in this case it will seem like you are physically connected to the same LAN
net.admin
Thanks TiTex, I hear what you're saying. I'm going to build this scenario with vm's(**) so I can get the routing right. I'm going to run with tun because I feel it has more advantages than disadvantages over tap in general. Being openly cross platformed is important also.
If anyone reads this and is unsure which way to go (tap or tun), please take the time to read the above link provided.
**A side note to anyone running or planning to run an oracle virtual box (vb) to test with. If you run 'tun with udp on a local network', it will work fine. However, if you run 'tun with udp over a wan' (say across the internet in a home/office setup) you will run into trouble with a "replay" error being generated nearly constantly. The connection will work, but it generates a ton of extra traffic and the packet loss (from my testing) is around 5%. Running tcp in the same scenario generated no error or packet loss. I know and respect that tcp is not the preferred choice (over udp), but I wanted to flag it so others can avoid the time I wasted trying to fix a problem with my config, only to find it was a vb problem - nothing to do with openvpn.
Cheers to all and thanks again to TiTex for the help.
