dtmiller1976 Hi all. I've got a hypothetical situation here and I'm curious as to what people think. When using the "client-to-client" option is there a way to create a "span" or "monitor" port which exposes the client-to-client traffic, e.g. for intrusion detection analysis? Thanks, Damon
ecrist If your kernel and driver support it, you can just enable promiscuous mode on the tun or tap interface.
janjust sorry ecrist, in 'client-to-client' mode the internal routing tables are bypassed on the server. In 'tun' mode you can mimick 'client-to-client' mode using the right iptables rules - this you can monitor In 'tap' mode you cannot do this and you'd have to resort to writing an openvpn PF plugin.
EuroChick Thanks, ecrist, for the help!!! it all turned out easier than I thought before. My kernel really supported it. the issue is solved. cialis
