Create VPN for single computers located in different regions

Question

I have a set of single computers (terminals). Each terminal is connected to Internet via xDSL or Dialup connection. Terminal IPs are dynamic. Terminals would like to communicate to each other via sending messages.
Here I see 2 problems:
1) Provide secure communications over Internet.
2) Terminal addressing. The IPs are dynamic. So, any terminal doesn't know IPs of other terminals.
My understanding is that I need to create VPN for my terminals. It would solve the both problems.

What architecture such VPN should have? What are the BKMs?
I think that I need a separate host in Internet with static IP. It will be my VPN server.
Each terminal will have VPN client software and will connect to that server using the server's static IP. After terminal have connected to the server (to the VPN), it receives predefined IP (or hostname) in that VPN and can communicate with other terminals using the predefined IPs. Is the scheme I proposed correct? Can you point me to any resources which may help me to implement it?
I propose node-to-net connection type for every my terminal. Should I use node-to-node connections, instead?

Thanks for your help!
~Alexey

Answer 1

Is each individual terminal running Windows? You might find Hamachi the easiest solution: https://secure.logmein.com/products/hamachi2/

You could use OpenVPN. The easiest way would be for each of your "terminals" to connect to a central host with a known IP as you say. That central host could then route packets itself. The downside is that communication would be indirect, so there will be some cost to latency and you'll have a bill for bandwidth use on the central host which direct communication would avoid.

A direct peer-to-peer VPN where IPs are swapped so that dynamic hosts can communicate directly is more complicated, especially if the dynamic hosts are behind NAT gateways. Some products integrate this kind of functionality but do not expose it as a general purpose VPN that you can use (eg. Skype, and also my product Synctus). But apart from Hamachi, I'm not aware of any publicly available product that will do this in the general case. Again you could use OpenVPN and some home-brew scripting to manage the IP swap.