11

I purchased Mountain Lion Server for our office thinking that Bonjour would automatically enable any computers connected via VPN to see all computers and applications (such as Bento) running on the office network. The hope was that those of us working at home would feel just like we were in the office, with all network services working transparently over the VPN connection. However, I see that Bonjour (aka mDNS) is not enabled to work over the VPN by default.

Can I configure Mountain Lion Server to automatically pass Bonjour traffic over the VPN? Is there any reason not to do this?

1

3 Answers 3

4

It's true that a pure layer 2 vpn setup would instantly enables the bonjour service without any other configurations. The difficulty is to find a layer 2 vpn, to install it and configure it. There are probably some proprietary solutions that enable this feature. To my knowledge there is only 1 good layer 2 vpn. It's open source and it's call openvpn. It does layer 3 vpn via the tun adapter and also layer 2 via the tap adapter.

To give more details on the installation of a layer 2 vpn, one need to understand some fundamentals basic of linux and networking. The vpn client will need to be in the same subnet or also know as vlan or even broadcast domain as the other bonjour devices like printer, mac osx server, etc. In order to do so, a linux/unix server serving as the vpn will bridge one of it's network card which is in the same vlan/subnet.

For the more experimented here is a very useful document on the setup.

https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

If it's too technical, this article seems to also be helpful for a more straightforward way of deploying a layer 2 vpn for bonjour.

http://www.wedebugyou.com/2013/01/how-to-use-bonjour-over-vpn/

1

If you use a L2 VPN setup, then broadcasts like mDNS should work just fine as long as VPN clients are on the same subnet as everything else.

If you use a L3 VPN solution, then you'll have to use a technology that can handle mDNS across broadcast domains. Allowing the 224.0.0.251 multicast group across routes should do this usually.

2
  • I'm using L2TP (which I assume is the L2 you speak of), and I believe I've got the same subnet (IP Addresses are 10.0.1.* with subnet masks of 255.255.255.0 for both local machines and VPN clients). Is there something else that could be getting in the way of Bonjour packets crossing the VPN tunnel? Nov 7, 2012 at 21:20
  • yes if the VPN connected computer has the same IP for its router like the VPN servers router has, which causes the VPN connection to confuse where to reach the server with which namespace. there was a hint to change the servers router IP to something which can hopefully not cross other IP adresses at the client side
    – user171888
    May 14, 2013 at 0:56
0

If you don't want to use a bridged VPN (they are more difficult to set up and less efficient, and not all VPN servers support them) then there are a few other options available:

  • You can use Network Beacon to broadcast the same services back to your client that it would have received over Bonjour (e.g. printers and file servers). Probably most useful if you have few devices that you access over the VPN and whose IP addresses do not change.

  • If the devices can register in the global DNS (not just the zeroconf .local domain), and you can setup and run a DNS server with dynamic update support, then you can configure your Mac to search it as well as .local.

  • If you just want Time Machine backups, you can connect to your AFP server using Finder -> Go -> Connect to Server, enter its private IP address (or hostname that uses the private IP address) using the afp:// protocol (for example afp://192.168.x.x), and then it will appear in the list of disks that you can backup to in Time Machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .