2

http://rockhoppervpn.sourceforge.net/ref_site2site_bridge_6.html

The diagram on this page shows all 3 sites using the same subnet, 192.168.0.0/24. Let's say on the hub site where 192.168.0.10 is the gateway interface and 192.168.0.11 is the bridge interface on the vpn server, there is a switch connected to 9 PCs 192.168.0.1–192.168.0.9 and the gateway and VPN server.

When one of these PCs wants to send to 192.168.0.25, if the PCs have a /24 netmask then it will deem it to be on the same subnet and therefore will send an ARP request for the MAC addr of the IP rather than targeting the default gateway; I'm guessing the reason why the sites are on the same subnet because the VPN server is separate from the router. Does the VPN server configure a proxy ARP for its connections so that it can reply to the ARP requests with its own MAC addr? How does the VPN server know what VPN server to tunnel 192.168.0.25 to? I'm assuming there's a tunneled routing protocol IBGP session set up between the VPN servers but surely both of the other VPN servers would advertise 192.168.0.x/24 of their bridge interface, so how does it know which VPN to send it to and that it's not destined to a local PC (seeing as the local bridge has the same subnet as well)?

Improve this question
2
  • 1
    This is a "non-standard" way of doing VPN tunnels. You'd have to dig into the details to know for sure. Guessing is off topic here. But the key word here is "bridging."
    – Ron Trunk
    Jan 7, 2020 at 18:39
  • @RonTrunk you're right. It's bridging an ethernet network in the same broadcast domain so perhaps it sends to both VPN severs and they release it onto their local segments
    – Lewis Kelsey
    Jan 7, 2020 at 18:57

1 Answer 1

Reset to default
2

The VPN you've linked to bridges between the tunnel ends. Accordingly, all locations form a single link-layer segment and a single IP subnet. ARP requests are actually broadcast throughout the VPN.

Since such a VPN setup sends all kinds of non-essential traffic across the tunnels it is most often considered suboptimal. Also, traffic considered as "local" may get lost due to WAN packet loss. The upside is that you don't have to worry about routing and non-routable traffic (broadcasts etc). Additionally, the tunnel bridges forward by MAC addresses and don't care about the network layer - you could run legacy protocols like NetBIOS or IPX without problem (other than unexpected latency and potentially higher packet loss).

Proxy ARP would be required if the tunnel used routing and you still wanted to make a distant node appear as local. Since all tunnel bridge, all nodes are "local".

Improve this answer
1
  • So I actually read Ron's comment first and your answer confirms it but he said the key word is 'bridging' and it immediately reminded me it's just a bridge of the ethernet network in the same broadcast domain so the vpn links would emulate a physically connected network and pass all broadcast traffic. It's a virtual bridge (switch) so it would send traffic to all ports on the vlan as a switch would.
    – Lewis Kelsey
    Jan 7, 2020 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.