-1

is there any VPN program that handles client authentication, data encryption and ends in a tap interface for every authenticated client?

I need 1 shared UDP port (VPN service port) to which clients are connecting with VPN protocol and and I need that every authenticated client ends up in its own tap interface.. this allows me to set up firewall, routing, different dhcp server, ... for every client connected to VPN concentrator separately.

OpenVPN is not an option because I don't know to setup 1 external port -> separate tap interfaces. I don't want to do routing or whatever filtering in the VPN daemon, this is kernel's job.

If it doesn't exist I'm going to write my own app (will be GPL or so, of course).

Thank you!

  • You don't need separate TAP interfaces to do firewalling. – Michael Hampton Feb 24 '13 at 0:20
  • How can I do it with one TAP? I have more networks connected to VPN, all packets (L3 in general - IP, IP6, IPX, ..) goes to one TAP interface and then to kernel.. how to distinguish packets from what client (connected network) it comes? I don't see a way to do this. I really don't want to do filtering or any network analysis in VPN daemon (this is also because I have to use non standard L3 protocols, so the TAP VPN has to be pure L2 transport layer that doesn't care of content). – Filip Svoboda Feb 24 '13 at 0:31
0

Check into OpenVPN's learn-address setting, you can run a script that sets up a custom table for each client, then in your FORWARD table add a rule that jumps to that custom table based on the client's source address (with a final default deny for all forwarding). That's how I handle it here, each client has a file that contains one CIDR entry per line, that becomes their custom table and defines what networks/hosts they are able to access via the VPN (if you need to filter on protocols/ports rather than simply networks/hosts, just do a bit more scripting).

0

OpenVPN is not an option because you don't know how to use it? You have told us what your requirements are. Leave it up to the answers what turns out to be an option or not.

First point: You can use iptables CONNMARK and MARK targets for marking everything from a certain client. This can be used for firewalling and routing. I doubt that you need several DHCP servers as you can set each clients configuration based on its L2 address.

If you really need one interface per DHCP instance this should be possible with virtual interfaces: Enslave veth0 to the VPN-tap bridge and bind the DHCP server to veth1 or similar. The separation of the bridged VPN clients can be done by ebtables.

It's hard to believe that anyone could seriously consider writing a VPN software because he wants to use only one UDP port (why?). Even this could easily be realized by NAT. You just have to be able to associate client configurations to source addresses. And even with completely dynamic client IP addresses this could be enforced by creating a non-encrypted IP tunnel first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.