OpenVPN Support Forum

Hi all. I've got a hypothetical situation here and I'm curious as to what people think. When using the "client-to-client" option is there a way to create a "span" or "monitor" port which exposes the client-to-client traffic, e.g. for intrusion detection analysis?


Thanks,

Damon

If your kernel and driver support it, you can just enable promiscuous mode on the tun or tap interface.

sorry ecrist, in 'client-to-client' mode the internal routing tables are bypassed on the server.

In 'tun' mode you can mimick 'client-to-client' mode using the right iptables rules - this you can monitor

In 'tap' mode you cannot do this and you'd have to resort to writing an openvpn PF plugin.

Thanks, ecrist, for the help!!! it all turned out easier than I thought before. My kernel really supported it. the issue is solved. cialis