Openvpn – Setting up OpenVPN server: should I use tun or tap

amazon ec2amazon-vpcopenvpn

I'm trying to set up my first OpenVPN server, and I'm having trouble figuring out whether I should use tun or tap for my particular setup.

I have an Amazon VPC with a few EC2 instances running Windows Server 2012 that will be used as workstations. In the VPC there's also a file server (also running WS2012) that workstations connect to via SMB.

Specifically, I'm trying to set up an OpenVPN server (this one on Ubuntu) to allow remote clients to connect to the VPC, and then use RDP to access the workstations themselves.

I tried using tun, but I still can't get the client to see the workstations on the network (I try to RDP to the workstations and the connection fails, ping also). I know this could be due to many reasons, so I'm trying to discard the things where I could've gone wrong. I guess tun would be the best choice since I don't need to use any non-IP protocols and it would be more efficient, but I'd like to be sure.

By the way, I've been following this guide: https://openvpn.net/index.php/open-source/documentation/howto.html

Thanks in advance.

Best Answer

I use tun for this exact use-case in our VPC (we use linux rather than windows, but that aside its the same). So I'd say tun is acceptable in this case.

Things to look for are:

  • Is the OpenVPN server within the VPC passing traffic? Most Linux distributions do not by default forward IP traffic. This should be easy to test by running a sniffer on the Openvpn server and looking for traffic leaving its network interface destined for another machine in the VPC
  • Is the OpenVPN server NATing the traffic? We use NAT on the OpenVPN server, so other servers within the VPC 'see' the traffic as if it came from the OpenVPN server. In a non AWS network this isn't a requirement, however I've never used OpenVPN with a VPC without NAT so I cannot comment if this works.
  • Is it the security group applied to the instance you are RDP'ing to that is preventing the traffic? Should be easy to temporarily allow all traffic to an instance as a test.
  • Is the local (on the RDP server) firewall blocking any traffic?

As a rule when debugging OpenVPN I find running a network sniffer on the ethernet nic of the OpenVPN box AND on the ethernet nic on a destination machine helps tremendously with identifying where the traffic is being stopped or blocked.

Related Topic