Hello, I am trying to port the OpenVpn to an embedded platform which has never been using the OpenVpn before. Now, this OS has no support for TUN/TAP, so my question is whether this is a must for a client only configuration? Also, for implementing the TUN, anyone has an effort estimates for such an implementation?

the client and server code are part of the same package - I wouldn't bother try to separate them. Porting a tun/tap adapter to another OS is a different matter - that might be a lot of work. You're talking about a kernel level network driver - they can be VERY tricky.

Thanks janjust! I need this driver, can even satisfy with TUN only, assuming I can easily access Layer 3 in my module. The module is running OSE166 (operating system) with LWIP stack. Can you please explain which capabilities I need from the platform being ported into with regards to the TUN needs? I need to know whether this is doable, and time estimate, need some requirement to start with.

you'd need to talk to the OS supplier (ENEA?) : it's impossible to tell how hard it will be to port a kernel-level network driver to a new OS ; the fact that they're using LWIP does not say much - it just means the OS can do TCP/IP (which you do need, of course) .

I am probably missing something. Why does this considered as a kernel level? TUN requires changes at the IP layer, and the IP stack is fully accessible. What is required from the OS? Is there a list of dependencies from a platform to be able to port this into?

That's more or less the way OpenVPN works: OpenVPN uses a virtual network interface known as a tun (or tap) driver; the OS should regard this interface as a "regular" network interface , so that packets can be routed to and from this interface. The 'tun' interface must accept these packets and must forward them to the OpenVPN process, which will deal with the actual contents. When OpenVPN receives data from the other end of the VPN tunnel it will decode the data and will forward the reconstructed packet out onto the virtual interface.

I understand. So, why can't I sit at the IP layer, performing the tunneling there (ofcourse, have some virtual device, which I will define myself only, but not within the OS). IP layer, in my case, is not part of the OS.

in theory, you could, of course, but it will increase the porting effort quite a bit. OpenVPN is built on the basis of a virtual network interface AND on a GNU-like environment - if those are not present then porting OpenVPN to your OS will take up a lot of time.

I understand. I am trying to get the protocol picture, understand from a high level how it works. When OpenVpn gets the data from the other end (from the IP), how does it know that this data belongs to the virtual device? Is this by analyzing the packet itself (in which will indicate the virtual IP being sent from?

openvpn decodes the data coming from the remote endpoint and will inject the resulting packet into the virtual network interface; whether the i/f decides to drop it or forward it is left to the i/f itself. there are some sanity checks before a packet is sent to the virtual network i/f but openvpn more or less trusts its remote VPN endpoints.

Thanks! Is there anywhere I can look at the TUN requirements? I need to know what is required from a TUN device. Is it a standart?

Porting OpenVpn Client only

the corporal

sir im new here but ill just want to express my problem and hoping that someone can help me anywayz im using usb dongle for my internet or zte usb modem using data internet sim.. then now the sim is already xpire at that moment im using portable openvpn that ive download in other forum site my problem now is when im connecting to vpn it takes only 20-30 minutes then in will disconnect is there any possible solution for this that cant be disconnect using openvpn?

any ideas? help...

dazo

the corporal wrotesir im new here but ill just want to express my problem and hoping that someone can help me anywayz im using usb dongle for my internet or zte usb modem using data internet sim.. then now the sim is already xpire at that moment im using portable openvpn that ive download in other forum site my problem now is when im connecting to vpn it takes only 20-30 minutes then in will disconnect is there any possible solution for this that cant be disconnect using openvpn?

any ideas? help...

Please start a new thread in the forum, as this is not related to the current discussion.

dazo

btk015 wrote All traffic on the client side will be routed to the openvpn server (not only intranet but also internet).
I do see the packet received on the server tun interface and then sent on the server physical interface to it's destination (I send packet from client to an internet destination).
The problem is that this packet(client -> server -> internet) is indeed sent successfully, but when a reply is sent from the internet, I do not get this reply on the openvpn server side.

That sounds like a firewall or routing issue on the openvpn server side. Check if the established/related connections from the internet side to the VPN tunnel is accepted. Also check that you have proper "return routes", so that traffic destined to the VPN subnet is routed via the proper tun/tap adapter.

« Previous Page