I have a few questions about our existing OpenVPN server setup and a requirement that we have to expand our access.
Our current setup is as follows:
- 1 OpenVPN server (in TAP mode)
- Multiple VM servers with host machine physically connected to the same subnet as OpenVPN server
- Multiple VM servers connected to OpenVPN server as clients to access the above subnet
- Multiple end users connected to OpenVPN server as clients to access the above subnet
For current usage, this setup works without issues. Each connected device/user gets an IP and all is well. However, we have a requirement to be able to connect with iOS/Android devices, and I understand from documentation and from https://community.openvpn.net/openvpn/wiki/BridgingAndRouting that this requires OpenVPN setup for TUN. Also, it appears that each instance of OpenVPN server can only run in one mode, you cannot have both TAP and TUN on the same OpenVPN config.
These are the questions:
If we setup another instance of OpenVPN on the current OVPN server, and set that to TUN mode: will a client device connecting to that OpenVPN be able to ONLY see what is local on the OVPN server? Or will it be able to see all devices on the subnet because of the TAP OVPN setup that already exists?
If the answer to the above is that that client device will only be able to see what is on the OVPN server and nothing else, are there alternatives to this setup that people have used to facilitate mobile device access? Could we setup a OVPN server on one of the VMs that is now connecting via TAP as a client, and use TUN there to allow access in to that one machine?
Unfortunately, due to limitations in the environment, we cannot switch the existing TAP OVPN to TUN and leave it (unless I am misunderstanding the TUN configuration and that would work as an alternative to our current setup and allow all the current VMs and client devices to connect as well as Android/iOS to connect?).
Thank you for any insight you can provide on this issue.