OpenVPN is an open-source Virtual Private Network (VPN) technology that creates secure point-to-point or site-to-site connections in routed or bridged configurations. OpenVPN uses a custom security protocol that is Secure Socket Layer (SSL) / Transport Layer Security (TLS) for key exchange. It uses standard encryption and authentication algorithms for data privacy and authentication over TCP or UDP.
The OpenVPN server can push the network configuration, such as the topology and IP routes, to OpenVPN clients. This makes OpenVPN simpler to configure as it reduces the chances of a configuration mismatch between the client and server. OpenVPN also supports cipher negotiation between the client and server. This means you can configure the OpenVPN server and clients with a range of different cipher options and the server will negotiate with the client on the cipher to use for the connection.
For more information on OpenVPN, see www.openvpn.net.
OpenVPN modes:
There are two modes for running OpenVPN:
- Routing mode, also known as TUN.
- Bridging mode, also known as TAP.
Routing (TUN) mode
In routing mode, each OpenVPN client is assigned a different IP subnet from the OpenVPN server and other OpenVPN clients. OpenVPN clients use Network Address Translation (NAT) to route traffic from devices connected on its LAN interfaces to the OpenVPN server.
The manner in which the IP subnets are defined depends on the OpenVPN topology in use. The EX15 device supports two types of OpenVPN topology:
| OpenVPN Topology | Subnet definition method |
|---|---|
| net30 |
Each OpenVPN client is assigned a /30 subnet within the IP subnet specified in the OpenVPN server configuration. With net30 topology, pushed routes are used, with the exception of the default route. Automatic route pushing (exec) is not allowed, because this would not inform the firewall and would be blocked. |
| subnet | Each OpenVPN client connected to the OpenVPN server is assigned an IP address within the IP subnet specified in the OpenVPN server configuration. For the EX15 device, pushed routes are not allowed; you will need to manually configure routes on the device. |
For more information on OpenVPN topologies, see OpenVPN topology.
Bridging (TAP) mode
In bridging mode, a LAN interface on the OpenVPN server is assigned to OpenVPN. The LAN interfaces of the OpenVPN clients are on the same IP subnet as the OpenVPN server’s LAN interface. This means that devices connected to the OpenVPN client’s LAN interface are on the same IP subnet as devices. The EX15 device supports two mechanisms for configuring an OpenVPN server in TAP mode:
- OpenVPN managed—The EX15 device creates the interface and then uses its standard configuration to set up the connection (for example, its standard DHCP server configuration).
- Device only—IP addressing is controlled by the system, not by OpenVPN.
Additional OpenVPN information
For more information on OpenVPN, see these resources:
PDF
