1

I have an OpenVPN setup consisting of separate machines on the Internet: one machine runs single OpenVPN server with private address 10.10.0.1 and the other machines run OpenVPN clients with private adresses from the range 10.10.0.0/16. Tun devices are used everywhere (with appropriate route and iroute commands). Everything works, every host is accessible as desired.

However, for the reasons of simplicity of use, I would like to have one OpenVPN client running on the first machine as well. This "local client" would have its own unique IP address, connect to the same OpenVPN server daemon as the other remote clients do and be accessible from within VPN just as the other, "remote" clients on the physically separate machines. In the end, one could login to the first machine through its OpenVPN client IP adress, thus avoiding connecting to the server IP address 10.10.0.1.

Is it possible to "virtualize the OpenVPN client" in this way? I tried the most direct way but when I execute openvpn client.conf on the first machine, although it keeps running and connects to the server daemon, it is only accessible locally on the first machine. Unlike the other OpenVPN clients, it does not respond to ping requests from the other machines in the VPN.

I think if I placed the local client into its separate virtual machine it is certainly possible, but I would like to avoid that and simply run two daemons side-by-side.

  • Your VPN server is already connected to all of the clients and local networks. Why would you want to VPN to itself? That would be adding complexity by any of my understanding, not simplicity. – Cory Knutson Jun 7 '17 at 21:24
  • It isn't clear to me at all why you would want this, or what you think you would gain from it. I am tempted to believe that that you aren't explaining what you need very well. Can you tell us more about what your real goal is here? – Zoredache Jun 7 '17 at 22:00
  • @Cory Knutson, Zoredache, my motivation is this: in case a machine running server becomes inaccessible, another machine in the VPN should take over the role of the server. There are several selected machines that can act as servers when needed; however before the blackout happens, those machines need to be accessible members of VPN, so they run client daemons. After the blackout occurs, one of those machines will need to run server daemon. For ease of use it is best if the already running client daemon is kept running as well. This client then has to connect to VPN server on the same host. – Ján Lalinský Jun 7 '17 at 23:55
  • I have to agree with Zoredache and Cory Knutson. I don't see anything that would prevent you from doing what you describe, but why would you? – quadruplebucky Jun 11 '17 at 14:07
  • 1
    The intended return is that machines are accessible from workstation clients through VPN, even if the machine that runs the primary OpenVPN server goes down. How would you set this up without running client daemon and server daemon on the same machine? – Ján Lalinský Jun 12 '17 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.