-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 19/11/14 23:07, Mahmoud Bahgat wrote: > Dear All I hope me email finds you well > > Can any one help me please, > > I have one HQ and 3-branches, i need to connect these branches to > HQ layer 2, by the meaning i need to make the clients to get their > DHCP entry from the HQ, the steps are the branch will redirect any > client request to HQ layer 2, again the branche will be as *a > switch* connected to HQ and the HQ will be the *gateway* for the > clients on the 3 branches, the question is :- _is the OpenVPN offer > this scenario layer 2 connection _?
Yes. But it will most likely not perform very well, as you would need to use a bridge. And combining basically 4 networks over a slower link [1] will impact the network performance. When you bridge, which is needed when you want to pass DHCP traffic, all the broadcast traffic on all the networks will be sent to all the other networks. For the best performance, have local DHCP servers on each site using a separate LAN subnets. Then have separate VPN tunnels [2] for each site using separate VPN subnets and use traditional routing. Use TUN. This way you can make the tunnel perform best as it only passes traffic destined to a remote site and the overhead is lower as it only passes IP traffic and not complete Ethernet headers. For more information about routing and bridging, see this wiki page: <https://community.openvpn.net/openvpn/wiki/BridgingAndRouting> [1] Unless you have really fast Internet connections on all sites with low latencies - basically meaning at least minimum 20Mbit/s. Preferably as close to 100Mbit/s as possible. Having even higher speeds may not be as efficient with OpenVPN, but in some cases that may help. To understand OpenVPN performance tuning, see this wiki page: <https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux> [2] That is, 3 separate server configurations on different ports for each branch office. This way you can benefit from the powers of a multi-core server as well. The keying material (--ca, --key, --cert, --dh) can be the same across all server configs. - -- kind regards, David Sommerseth -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRtrpgACgkQDC186MBRfrr34gCdHRp/bc/HpymXWsCaX2lersXg TQYAoLBpYdxXwO8zphMKtVQJT7vlRSfP =Qd/I -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server from Actuate! Instantly Supercharge Your Business Reports and Dashboards with Interactivity, Sharing, Native Excel Exports, App Integration & more Get technology previously reserved for billion-dollar corporations, FREE http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
