I fully agree with Sameh,
You can do L2 tunneling, but you should very much ask yourself: do I really
need L2?
Turning on a network analyzer (and measuring the wasted bandwidth by all sorts
of broadcasts) may be enough, for thinking otherwise.
Sure, with your firewall you can block most of it, but if it is just dhcp,
(ip, routes, time, dns)-info, a simple local dhcp-server might be enough.
And finally, the situation you draw, looks like your connection and a server at
your HQ are a single-point-of-failure.
Hans.
From: Sameh Attia [mailto:[email protected]]
Sent: donderdag 20 november 2014 18:52
To: openvpn-users
Cc: Mahmoud Bahgat
Subject: Re: [Openvpn-users] Layer 2 tunnel (VPN)
Mohamed,
I do second David's. You need to take care when doing L2 VPN about your
services and your end point security. Some services for example do extensive
flooding on L2 level which will saturate your branches' WAN pipes. The short
answer is yes; OpenVPN can do L2 tunneling for sure and the long answer is you
have to pay attention to your L2 VPN setup and topology.
Regards
Sameh Attia
--
- Failure is not an option; it is a built-in feature in Windows.
- The two basic principles of system administration:
* For minor problems, reboot
* For major problems, reinstall
dc -e
'603178305900664311156641389051003470569569613466992253686426210705237258P'
On Thu, Nov 20, 2014 at 11:04 AM, David Sommerseth
<[email protected]<mailto:[email protected]>> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 19/11/14 23:07, Mahmoud Bahgat wrote:
> Dear All I hope me email finds you well
>
> Can any one help me please,
>
> I have one HQ and 3-branches, i need to connect these branches to
> HQ layer 2, by the meaning i need to make the clients to get their
> DHCP entry from the HQ, the steps are the branch will redirect any
> client request to HQ layer 2, again the branche will be as *a
> switch* connected to HQ and the HQ will be the *gateway* for the
> clients on the 3 branches, the question is :- _is the OpenVPN offer
> this scenario layer 2 connection _?
Yes. But it will most likely not perform very well, as you would need
to use a bridge. And combining basically 4 networks over a slower
link [1] will impact the network performance.
When you bridge, which is needed when you want to pass DHCP traffic,
all the broadcast traffic on all the networks will be sent to all the
other networks.
For the best performance, have local DHCP servers on each site using a
separate LAN subnets. Then have separate VPN tunnels [2] for each
site using separate VPN subnets and use traditional routing. Use TUN.
This way you can make the tunnel perform best as it only passes
traffic destined to a remote site and the overhead is lower as it only
passes IP traffic and not complete Ethernet headers.
For more information about routing and bridging, see this wiki page:
<https://community.openvpn.net/openvpn/wiki/BridgingAndRouting>
[1] Unless you have really fast Internet connections on all sites with
low latencies - basically meaning at least minimum 20Mbit/s.
Preferably as close to 100Mbit/s as possible. Having even higher
speeds may not be as efficient with OpenVPN, but in some cases that
may help. To understand OpenVPN performance tuning, see this wiki
page:
<https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux>
[2] That is, 3 separate server configurations on different ports for
each branch office. This way you can benefit from the powers of
a multi-core server as well. The keying material (--ca, --key,
--cert, --dh) can be the same across all server configs.
- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlRtrpgACgkQDC186MBRfrr34gCdHRp/bc/HpymXWsCaX2lersXg
TQYAoLBpYdxXwO8zphMKtVQJT7vlRSfP
=Qd/I
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
_______________________________________________
Openvpn-users mailing list
[email protected]<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/openvpn-users
______________________________________________________________________
Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet
de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u
verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat
aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband
houdt met risico's verbonden aan het electronisch verzenden van berichten.
This message may contain information that is not intended for you. If you are
not the addressee or if this message was sent to you by mistake, you are
requested to inform the sender and delete the message. The State accepts no
liability for damage of any kind resulting from the risks inherent in the
electronic transmission of messages.
------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
