I'm trying to set up my first OpenVPN server, and I'm having trouble figuring out whether I should use tun or tap for my particular setup.

I have an Amazon VPC with a few EC2 instances running Windows Server 2012 that will be used as workstations. In the VPC there's also a file server (also running WS2012) that workstations connect to via SMB.

Specifically, I'm trying to set up an OpenVPN server (this one on Ubuntu) to allow remote clients to connect to the VPC, and then use RDP to access the workstations themselves.

I tried using tun, but I still can't get the client to see the workstations on the network (I try to RDP to the workstations and the connection fails, ping also). I know this could be due to many reasons, so I'm trying to discard the things where I could've gone wrong. I guess tun would be the best choice since I don't need to use any non-IP protocols and it would be more efficient, but I'd like to be sure.

By the way, I've been following this guide: https://openvpn.net/index.php/open-source/documentation/howto.html

Thanks in advance.

  • Tunnel is probably fine. Your problem is likely that the tunnel interface gets its own subnet, it isn't on the same subnet as the server's regular network connection. You need to push routes with your OpenVPN server config, and the server's OS needs some configuration as well. I have no idea how to tackle this with Windows though, sorry. – ThatGraemeGuy Jan 15 '15 at 9:16

I use tun for this exact use-case in our VPC (we use linux rather than windows, but that aside its the same). So I'd say tun is acceptable in this case.

Things to look for are:

  • Is the OpenVPN server within the VPC passing traffic? Most Linux distributions do not by default forward IP traffic. This should be easy to test by running a sniffer on the Openvpn server and looking for traffic leaving its network interface destined for another machine in the VPC
  • Is the OpenVPN server NATing the traffic? We use NAT on the OpenVPN server, so other servers within the VPC 'see' the traffic as if it came from the OpenVPN server. In a non AWS network this isn't a requirement, however I've never used OpenVPN with a VPC without NAT so I cannot comment if this works.
  • Is it the security group applied to the instance you are RDP'ing to that is preventing the traffic? Should be easy to temporarily allow all traffic to an instance as a test.
  • Is the local (on the RDP server) firewall blocking any traffic?

As a rule when debugging OpenVPN I find running a network sniffer on the ethernet nic of the OpenVPN box AND on the ethernet nic on a destination machine helps tremendously with identifying where the traffic is being stopped or blocked.

  • This answer seems accurate. Without NAT, you'd need to disable the "IP ssource/dest check" on the tunnel server instance, and the client subnet would need to be outside the supernet for the VPC and routed to the tunnel servet via the VPC routing tables. – Michael - sqlbot Jan 15 '15 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.