5 I updated my understanding, so that if a noob reads this they'll be reading correct info.
source | link

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS Routers, as well as how Virtual IP Address Pools fit in the process.

In the past, I just assumed that VPN Servers built into Routers established a virtual tunnel exit point as a point of entry for remote clients to connect to a remote network, and pointed the remote clients to DHCP Servers that existed on the Remote LAN, but then I started noticing that Several VPN Solutions mention something called Virtual IP Address Pools ("VIPAPs"), which made me question if there's more going on then I'd previously thought.

  • What exactly are "VIPAPs" why do they exist? What purpose do they serve?
  • Are "VIPAPs" separate from DHCP? (which also has a pool of reserved addresses)
  • Are "VIPAPs" dynamically generated based on the DHCP pool range?
  • If "VIPAPs" have statically set ranges, should they perfectly overlap DHCP range or should they be part of a reserved space outside of DHCP pool range?

Here's my Current Understanding:

I believe that in the past you used to have WAN -> Basic Firewall/Router and establish port forwarding of ports associated with VPN connections to a VPN server on the LAN. Such as a OpenVPN Server or StrongSWAN VPN Server. Now adays a mini OpenVPN Server exists on pfSense Firewalls, and a mini StrongSWAN VPN Server exists on VyOS Routers (and if you put these on the edge you don't need to forward ports.)

strongswan.org mentions something about a Virtual IP address pool. Let's pretend we have a 1 ethernet port computer acting as a StrongSWAN VPN Server. My understanding is that by default port forwarding (or DMZ) sort of remaps the WAN IP to the Laptop's private IP so it's accessible from the internet when behind a Firewall/NAT'd Router. And by default, the Server's Ethernet Port has a Private IP address 10.0.0.100, and a Virtual Network Adapter tunnel interface with an IP address in a 3rd subnet that's only used for routing through the virtual tunnel. Then whenever a remote client connects to the VPN Server, the VPN Server attaches a Virtual IP Address to it's Ethernet Port, which represents the client.

How it gets that Virtual IP Address for the client is the part that's confusing me.

Normally when I attach a new computer to my network, it uses ARPgets an IP from DHCP's DORA process which occurs at layer 2 broadcast to find a DHCP server who then hands out a Layer 3 IP address and. It gets DNS and subnet info from the O stage of DORA process. ARP being layer 2 can't cross overA VPN client would be coming into the network at layer 3/the route to, and not have a layer 2 presense on the remote clientnetwork, and thus couldn't use DHCP which operates at layer 2. 

Maybe when a client connects to a VPN Server, the VPN server makes a virtual network interface on the VPN Server to give the client a Layer 2 presence on the remote network, and the VPN server does ARPServer initiates DHCP DORA process by proxy on behalf of the remote client, and then the DHCP server on the remote network assigns an IP address with DNS info to a virtual network interface that exists on the VPN Server and this virtual network interface. represents the remote client? (Not saying it works like that, just saying I'm trying to visualize how it might work.)

But if it's that simple then why does something called Virtual IP Address Pool exist? Or am I getting my concepts mixed up and VIPAPs have nothing to do with remote DHCP resolution?

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS Routers, as well as how Virtual IP Address Pools fit in the process.

In the past, I just assumed that VPN Servers built into Routers established a virtual tunnel exit point as a point of entry for remote clients to connect to a remote network, and pointed the remote clients to DHCP Servers that existed on the Remote LAN, but then I started noticing that Several VPN Solutions mention something called Virtual IP Address Pools ("VIPAPs"), which made me question if there's more going on then I'd previously thought.

  • What exactly are "VIPAPs" why do they exist? What purpose do they serve?
  • Are "VIPAPs" separate from DHCP? (which also has a pool of reserved addresses)
  • Are "VIPAPs" dynamically generated based on the DHCP pool range?
  • If "VIPAPs" have statically set ranges, should they perfectly overlap DHCP range or should they be part of a reserved space outside of DHCP pool range?

Here's my Current Understanding:

I believe that in the past you used to have WAN -> Basic Firewall/Router and establish port forwarding of ports associated with VPN connections to a VPN server on the LAN. Such as a OpenVPN Server or StrongSWAN VPN Server. Now adays a mini OpenVPN Server exists on pfSense Firewalls, and a mini StrongSWAN VPN Server exists on VyOS Routers (and if you put these on the edge you don't need to forward ports.)

strongswan.org mentions something about a Virtual IP address pool. Let's pretend we have a 1 ethernet port computer acting as a StrongSWAN VPN Server. My understanding is that by default port forwarding (or DMZ) sort of remaps the WAN IP to the Laptop's private IP so it's accessible from the internet when behind a Firewall/NAT'd Router. And by default, the Server's Ethernet Port has a Private IP address 10.0.0.100, and a Virtual Network Adapter tunnel interface with an IP address in a 3rd subnet that's only used for routing through the virtual tunnel. Then whenever a remote client connects to the VPN Server, the VPN Server attaches a Virtual IP Address to it's Ethernet Port, which represents the client.

How it gets that Virtual IP Address for the client is the part that's confusing me.

Normally when I attach a new computer to my network, it uses ARP layer 2 broadcast to find a DHCP server who then hands out a Layer 3 IP address and DNS info. ARP being layer 2 can't cross over layer 3/the route to the remote client. Maybe when a client connects to a VPN Server, the VPN server makes a virtual network interface on the VPN Server, and the VPN server does ARP by proxy on behalf of the remote client, and then the DHCP server on the remote network assigns an IP address with DNS info to the network interface.

But if it's that simple then why does something called Virtual IP Address Pool exist? Or am I getting my concepts mixed up and VIPAPs have nothing to do with remote DHCP resolution?

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS Routers, as well as how Virtual IP Address Pools fit in the process.

In the past, I just assumed that VPN Servers built into Routers established a virtual tunnel exit point as a point of entry for remote clients to connect to a remote network, and pointed the remote clients to DHCP Servers that existed on the Remote LAN, but then I started noticing that Several VPN Solutions mention something called Virtual IP Address Pools ("VIPAPs"), which made me question if there's more going on then I'd previously thought.

  • What exactly are "VIPAPs" why do they exist? What purpose do they serve?
  • Are "VIPAPs" separate from DHCP? (which also has a pool of reserved addresses)
  • Are "VIPAPs" dynamically generated based on the DHCP pool range?
  • If "VIPAPs" have statically set ranges, should they perfectly overlap DHCP range or should they be part of a reserved space outside of DHCP pool range?

Here's my Current Understanding:

I believe that in the past you used to have WAN -> Basic Firewall/Router and establish port forwarding of ports associated with VPN connections to a VPN server on the LAN. Such as a OpenVPN Server or StrongSWAN VPN Server. Now adays a mini OpenVPN Server exists on pfSense Firewalls, and a mini StrongSWAN VPN Server exists on VyOS Routers (and if you put these on the edge you don't need to forward ports.)

strongswan.org mentions something about a Virtual IP address pool. Let's pretend we have a 1 ethernet port computer acting as a StrongSWAN VPN Server. My understanding is that by default port forwarding (or DMZ) sort of remaps the WAN IP to the Laptop's private IP so it's accessible from the internet when behind a Firewall/NAT'd Router. And by default, the Server's Ethernet Port has a Private IP address 10.0.0.100, and a Virtual Network Adapter tunnel interface with an IP address in a 3rd subnet that's only used for routing through the virtual tunnel. Then whenever a remote client connects to the VPN Server, the VPN Server attaches a Virtual IP Address to it's Ethernet Port, which represents the client.

How it gets that Virtual IP Address for the client is the part that's confusing me.

Normally when I attach a new computer to my network, it gets an IP from DHCP's DORA process which occurs at layer 2. It gets DNS and subnet info from the O stage of DORA process. A VPN client would be coming into the network at layer 3, and not have a layer 2 presense on the remote network, and thus couldn't use DHCP which operates at layer 2. 

Maybe when a client connects to a VPN Server, the VPN server makes a virtual network interface on the VPN Server to give the client a Layer 2 presence on the remote network, and the VPN Server initiates DHCP DORA process by proxy on behalf of the remote client, and then the DHCP server on the remote network assigns an IP address with DNS info to a virtual network interface that exists on the VPN Server and this virtual network interface represents the remote client? (Not saying it works like that, just saying I'm trying to visualize how it might work.)

But if it's that simple then why does something called Virtual IP Address Pool exist? Or am I getting my concepts mixed up and VIPAPs have nothing to do with remote DHCP resolution?

4 deleted 720 characters in body
source | link

My current understanding of VPNs is that a remote user on a home network of 192.168.1.0/24 can use a VPN client to connect over the internet via public IP addresses to a remote private network of say 10.0.0.0/8. I think the way it works is that the remote client's VPN client software generates a virtual network adapter and when the VPN connection is successfully established, their virtual network adapter is assigned an IP address from the remote network, such as 10.0.0.101.

(I also read that for VPNs the local and remote subnets can't be in the same, to clarify if 2 home networks had 192.168.1.0/24 there would be issues VPN'ing between the 2 networks because routing would get confused by the overlap.)

I believe that in the past you used to have WAN -> Basic Firewall/Router and establish port forwarding of ports associated with VPN connections to a VPN server on the LAN. Such as a OpenVPN Server or StrongSWAN VPN Server. Now adays a mini OpenVPN Server exists on pfSense Firewalls, and a mini StrongSWAN VPN Server exists on VyOS Routers (and if you put these on the edge you don't need to forward ports.)

My current understanding of VPNs is that a remote user on a home network of 192.168.1.0/24 can use a VPN client to connect over the internet via public IP addresses to a remote private network of say 10.0.0.0/8. I think the way it works is that the remote client's VPN client software generates a virtual network adapter and when the VPN connection is successfully established, their virtual network adapter is assigned an IP address from the remote network, such as 10.0.0.101.

(I also read that for VPNs the local and remote subnets can't be in the same, to clarify if 2 home networks had 192.168.1.0/24 there would be issues VPN'ing between the 2 networks because routing would get confused by the overlap.)

I believe that in the past you used to have WAN -> Basic Firewall/Router and establish port forwarding of ports associated with VPN connections to a VPN server on the LAN. Such as a OpenVPN Server or StrongSWAN VPN Server. Now adays a mini OpenVPN Server exists on pfSense Firewalls, and a mini StrongSWAN VPN Server exists on VyOS Routers (and if you put these on the edge you don't need to forward ports.)

I believe that in the past you used to have WAN -> Basic Firewall/Router and establish port forwarding of ports associated with VPN connections to a VPN server on the LAN. Such as a OpenVPN Server or StrongSWAN VPN Server. Now adays a mini OpenVPN Server exists on pfSense Firewalls, and a mini StrongSWAN VPN Server exists on VyOS Routers (and if you put these on the edge you don't need to forward ports.)

    Post Reopened by Ron Trunk, JFL, Ron Maupin
3 I tried to edit my question to fit more in the guidelines. By pointing out that it's Networking Theory related to Enterprise Networking Concept/Product VyOS / pointing out that I'm not talking about configuring servers, but that the router is running a service equivalent to a server.
source | link

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network, when they connect to athe StrongSWAN or OpenVPN VPN Service running on aServer that's embedded in VyOS RouterRouters, as well as how Virtual IP Address Pools fit in the process.

In the past, I just assumed that VPN Servers built into Routers established a virtual tunnel exit point as a point of entry for remote clients to connect to a remote network, and pointed the remote clients to DHCP Servers that existed on the Remote LAN, but then I started noticing that Several VPN Solutions mention something called Virtual IP Address Pools ("VIPAPs"), which made me question if there's more going on then I'd previously thought.

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network, when they connect to a StrongSWAN or OpenVPN VPN Service running on a VyOS Router, as well as how Virtual IP Address Pools fit in the process

In the past, I just assumed that VPN Servers established a virtual tunnel exit point as a point of entry for remote clients to connect to a remote network, and pointed the remote clients to DHCP Servers that existed on the Remote LAN, but then I started noticing that Several VPN Solutions mention something called Virtual IP Address Pools ("VIPAPs"), which made me question if there's more going on then I'd previously thought.

I'd like to know the nitty gritty details of how VPN Remote Clients are given Private IP Addresses on a Remote Network when they connect to the StrongSWAN or OpenVPN VPN Server that's embedded in VyOS Routers, as well as how Virtual IP Address Pools fit in the process.

In the past, I just assumed that VPN Servers built into Routers established a virtual tunnel exit point as a point of entry for remote clients to connect to a remote network, and pointed the remote clients to DHCP Servers that existed on the Remote LAN, but then I started noticing that Several VPN Solutions mention something called Virtual IP Address Pools ("VIPAPs"), which made me question if there's more going on then I'd previously thought.

2 I tried to edit my question to fit more in the guidelines. By pointing out that it's Networking Theory related to Enterprise Networking Concept/Product VyOS / pointing out that I'm not talking about configuring servers, but that the router is running a service equivalent to a server.
source | link
    Post Closed as "off-topic" by Ron Maupin
1
source | link