I currently use a windows server. This windows server retrieves data from a remote database, and therefore is connected to the remote VPN server permanently. So we use openVPN in client mode with certificates provided by the remote server.

Now, we would like to allow employees to connect remotely. Typicaly homeworking or work during conferences. That is why we would like to add to this server an openVPN instance but this time in server mode.

From a technical point of view I do not see what could be a problem to use two instances of openVPN at the same time since we use two differents virtual network cards. And both subnets are distinct. The default gateway is never changed (and never will). It could avoid a lot of problems.

I managed to install two TAP cards (used by openVPN). I do not know how to "link" an instance of openVPN to a specific network card. Does having two network cards TAP enough? How to proceed to get one client and one server of openVPN at the same time, on the same machine ?

Original post

I am using a Windows server.

I have to use openVPN as a client and as a server on the same time on the same machine. Is it possible ?

If yes, what are the constraints?

If not, are there other alternatives?

I know there are possibilities on a Linux with the power of iptables but I do not really know if this is possible on a windows host.

  • If you ask about alternatives, you need to explain what are you trying to achieve by this exotic configuration. I can't even imagine a valid use case here. Anyway, it should work if you create at least two TAP-Win32 virtual interfaces. – sam_pan_mariusz Oct 12 '15 at 15:39
  • @sam_pan_mariusz I edited my post for more precision. – Atnaize Oct 15 '15 at 14:49
  • OK, from the original post I assumed that you want to connect the machine to itself via OpenVPN. Now I know what's going on. I will try to answer later, this is quite a simple case. – sam_pan_mariusz Oct 16 '15 at 6:32

Having an OpenVPN TLS server and client on the same machine is possible (I've run this way under Ubuntu some time ago and don't expect Windows makes a problem here). Simply set them to use different ports and virtual TAP-Win32 network cards.

Preferably, configure the client instance to include nobind option so it uses a random, dynamic port. This will let you avoid port conflicts between instances easily (by default OpenVPN always binds to the default port 1194, even in client mode). The server needs to bind to a port, you can optionally set it with port $PORT if the default one is inappropriate for you. In both server and client use dev-node $GUID to assign a separate, instance-specific TAP adapter. GUIDs can be read from registry or with the console command openvpn --show-adapters.

  • By exemple, I have Ethernet 2 (TAP-Windows Adapter V9) and Ethernet 3 (TAP-Windows Adapter V9 #2). What do I have to write after dev-node? Should I dev-node Ethernet 2? – Atnaize Oct 29 '15 at 15:59
  • Please extend your question to provide the output of openvpn --show-adapters. – sam_pan_mariusz Oct 31 '15 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.