Our devs are working on application where we need to frequently distribute small amounts of data to multiple locations which may change dynamically (servers may join and leave rather often). Some servers are on cloud providers like AWS, DO, some are HW in IDC.

I've been tasked with finding a reasonable solution to this. I am thinking whether it is possible to create a subnet on top of IPSec VPN (using openswan/libreswan). I know that I can setup routing between different subnets joined via VPN, however that is rather a manual job. In light of those servers coming and going often it would be rather hard to do. So I am wondering if it would be possible to utilize VPN setup (preferably IPSec, or possibly OpenVPN) to organize those servers into single "virtual LAN" with it's own subnet range and being able to connect IPs within this subnet (and possibly also use broadcast address?).

  • openvpn would be your best bet, plus it runs as a service on Linux with openvpn@config as the service name – Jacob Evans Feb 11 '17 at 5:00
  • @JacobEvans thanks, I am open to OpenVPN as well. Do you have any example configurations for such setup or link to where it is discussed? The idea is that only traffic targeting specific subnet (which would be the virtual subnet) would go over VPN, everything else would use default routing then. – Alexey Kamenskiy Feb 11 '17 at 6:41
  • @JacobEvans also in case of OpenVPN does it support broadcasting over VPN? AFAIK IPSec has some issues with it. – Alexey Kamenskiy Feb 11 '17 at 6:44
  • you don't need broadcast, the clients get 2 IPs, a tunnel IP and their existing IPs, – Jacob Evans Feb 11 '17 at 13:30
  • @JacobEvans well, it's for the application that will use it. Actually need broadcast. I've already setup test environment but ping to broadcast address doesn't get any response. Not sure why. – Alexey Kamenskiy Feb 11 '17 at 13:32

You can use OpenVPN to create an Ethernet tunnel. Just use the example configuration file of OpenVPN with these changes:

  1. Use dev tap mode.
  2. Configure server-bridge directive with your desired IP subnet information
  3. Use client-to-client directive.

You also need to generate the keys for server and each client.

Basically it is just a standard OpenVPN Ethernet tunnel configuration and there should be a lot of guides about it on the Internet.

  • Yes, I've done that already, and I can ping hosts between each other no problem, but I can't send broadcasts (trying with ping -b from one of clients and trying same from server). – Alexey Kamenskiy Feb 11 '17 at 10:20
  • Actually in my setup I don't need server-bridge option, because there are no bridges involved, each site has a single server there. I am using tap (instead of tun) and client-to-client. But the problem is I need to use broadcast address for broadcasting small portions of information across all the nodes. But it does not seem to work with default setup. Not sure if I am missing something – Alexey Kamenskiy Feb 11 '17 at 10:49
  • what do you need broadcast for, you should be unicast or multicast – Jacob Evans Feb 11 '17 at 13:31
  • @JacobEvans The same reason why need to have dynamically joined/removed VPN peers -- need to deliver data to all nodes that joined the network. Multicast requires nodes first to join to multicast groups as far as I understand. Unicast is simply not an option in this case. – Alexey Kamenskiy Feb 11 '17 at 13:54
  • if they can connect to the vpn, why can't they subscribe (pub/sub) to a communication channael/multicast address? to answer you will need GRE for boardcast, which can be tunneled inside IPSEC. – Jacob Evans Feb 11 '17 at 14:15

Depending on your exact needs and resources, you may look into DMVPN. It is a hub-and-spoke VPN technology that uses (m)GRE over IPSec and can use NHRP to allow dynamic creation of spoke-to-spoke tunnels. The mGRE would allow all of your different sites to use a single "overlay" subnet to route traffic between, and if you have devices you can put at each spoke location that support NHRP, they can dynamically build a tunnel from one site to another, which reduces the overall latency and load on the hub device. One of the biggest benefits of using DMVPN is the simplicity of the configuration. Once you have the hub setup for GRE, IPSec, and NHRP, the spoke config is all you have to do from then on, as the hub will dynamically react to having additional spokes.

  • that's rather complicated for a dynamic setup – Jacob Evans Feb 11 '17 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.