1

enter image description here

The above image shows what I think occurs during an OpenVPN connection. Hosts A and B are connected to the VPN through the VPN server at 1.2.3.4:1194. My question is: if host A wishes to send a packet to host B (say an ICMP echo packet), how does the packet traverse to get to B? My initial thoughts were:

The process creates the packet with a destination of 10.20.0.6, and source of 192.168.0.x (the source ip being 192.168.0.x considering the application is unaware of the VPN connection). From the routing tables pushed to the application's computer, the packet is sent to the virtual interface.

Host A's Virtual Interface encapsulates the packet to be destined for Host B's WAN-facing address (3.4.5.6).

Is this so far correct? How does the router at B know that this packet is destined for host B? Does host A instead put 1.2.3.4 as the destination (rather than 3.4.5.6), and let the VPN server re-route through the server's already-established connection with B? Does the router at B have to be pre-setup to even allow any sort of VPN connection?

1 Answer 1

0

Let's assume you have everything already setup and you issue

$ ping 10.20.0.6

on host A.

Host A checks it's internal routing table to see how it can reach 10.20.0.6, on linux it will look roughly like this

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.20.0.0       10.20.0.1       255.255.255.0   UG    0      0        0 tun0

So host A determines "In order to contact 10.20.0.6, I need to send my message through gateway 10.20.0.1, which I can contact using the tun0 interface"

10.20.0.1 is the VPN address of the OpenVPN server and tun0 is a software defined network interface created by the OpenVPN client program on Host A.

So Host A sends an ICMP echo request with a destination address of 10.20.0.6 to tun0. What then happens is Encapsulation. The OpenVPN client wraps the original packet in an OpenVPN envelope and sends this envelope over to 1.2.3.4:1194.

The OpenVPN server at 1.2.3.4 opens the envelope and checks the address: "Oh, it's for 10.20.0.6." If the OpenVPN server has been configured to allow clients to talk to each other, it will then send the envelope through the established connection with B at address 3.4.5.6.

The OpenVPN client at B opens the received envelope (De-encapsulation) and now has an ICMP echo request for 10.20.0.6 received from the address 10.20.0.5 which is Host A in the VPN network.

To work, OpenVPN requires only TCP or UDP connectivity to port 1194 in the server. If a firewall or misconfigured NAT prevents this, it will not work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .