Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking to set up a VPN server and I'm trying to figure out what software to use. My problem is that I have no idea what the term for the arrangement I want is so I can't really google for it. What I want is to have a "virtual" LAN where the only access is by VPN, where having access to the VPN only give you access to other VPN clients; not to the general internet, and not to the server running the VPN.

My primary use case is getting uniform access between clients I own where one or both may be behind a NAT and/or firewall that may not have a consistent IP.

(p.s. Given my budget I'll have to stick with freeware/FOSS.)

Edit: The VPN server is not in the same NAT/Firewall/IP situation. It's able to serve up whatever I want from a static IP.

share|improve this question

I really enjoy working with OpenBSD (PF) along with OpenVPN you can create the type of setup you are looking for...if I understand properly.

When I fist got my hands on PF I found that documentation very enlightening.

share|improve this answer
OK so OpenVPN can do what I'm asking for. What do they call it? (The docs are 40+ pages long and nothing in the table of contents jumps out at me.) – BCS Feb 22 '11 at 16:29
Well, it's a bit complicated but what I would do is giving the VPN users a second IP address in a subnet that only includes VPN users. Somewhere in the OpenVPN setup you have to tell it what IP range it can provide to VPN clients. If you go here and look for the keyword "range" you should land on the explanation. – Alex Feb 22 '11 at 16:41

You can do it with OpenVPN.

There are two gotchas however:

  1. Configure routing/firewall on router in a way that will block packets between tun interface and other interfaces.

  2. enable client-to-client in openvpn config (just add it in .conf file on server)

OpenVPN by default will provide same IP address to client on reconnect. There are cases where it may not happen: pool running out of IPs, configuration moved to other server without files in /var, etc.

To assure same IP on reconnects, use client-config-dir directive. In it you create files with the same name as the DN of client's certificate, then it's just add there

ifconfig-push <ip-of-server-in-vpn> <ip-of-client>

where server's IP is the one on tun interface (private IP)

share|improve this answer
I'm not sure how that relates to the things I'm looking for. How do I prevent the VPN clients from having access (via the VPN) to anything but the other VPN clients (including access to the hosting server)? – BCS Feb 22 '11 at 18:47
using iptables: iptables -I FORWARD -o tun0 -j DROP, iptables -I FORWARD -i tun0 -j DROP. Linux doesn't threat tun interfaces in any special way as far as routing or firewalling is concerned. You need to configure typical routing on a multihomed host. – Hubert Kario Feb 22 '11 at 18:54
OK, but how do I prevent the server from getting a tun0 interface in the first place? – BCS Feb 22 '11 at 18:59
Adding above rules will block access to and from server in VPN. If you can't trust server on which VPN works you'll need to build a two level VPN: the above mentioned one to get access to second, secure one. – Hubert Kario Feb 23 '11 at 21:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.