We just created a cluster of 12 nodes and wanted to have OpenVPN for many of the communications need to be 100% secure between each computer (we do not have access to a 100% secure/private environment so we have to have encryption between computers.)

So we have a setup that looks like this:

             |                  |
             |  OpenVPN Server  |
             |                  |
                |            |                .          |
                |            |                .          |
                v            v                .          v
+------------------+  +------------------+  .....  +------------------+
|                  |  |                  |  .   .  |                  |
|  OpenVPN Client  |  |  OpenVPN Client  |  .   .  |  OpenVPN Client  |
|               A  |  |               B  |  .   .  |               n  |
+------------------+  +------------------+  .....  +------------------+

The OpenVPN Server is one of the 12 computers and we noticed it going berserk whenever any client communicates with another client. Looking at the firewall info, we can clearly see that clients do not communicate between each others. Instead, all the data is sent to the server, then forward to another client (i.e. from client A to client B, we see the transfer going from A to Server, then Server to B.)

What I'm wondering is this:

Is A given the public key of B whenever it wants to send data to B? I would imagine it is not because it would require for the OpenVPN client code to know that the data is being sent to B. So if I understand properly, what is happening is:

  1. Client A encrypts its data with the server public key.
  2. Client A sends that encrypted blob to the server.
  3. The server uses its private key to decrypt the blob.
  4. The server determines where it is forwarding the blob.
  5. The server re-encrypts the data with Client B public key.
  6. The server sends that newly encrypted blob to the client.
  7. Client B uses its private key to decrypt the blob.

In other words, it really looks like this:

             |                  |
             |  OpenVPN Server  |<-----------------------+
             |                  |                        |
             +------------------+                        |
                ^       ^    ^                           |
                |       |    .                           |
                |       |    .                           |
                |       |    ..................          |
                |       |                     .          |
                v       v                     v          v
+------------------+  +------------------+  .....  +------------------+
|                  |  |                  |  .   .  |                  |
|  OpenVPN Client  |  |  OpenVPN Client  |  .   .  |  OpenVPN Client  |
|               A  |  |               B  |  .   .  |               n  |
+------------------+  +------------------+  .....  +------------------+

Is that correct? I tried to find something like that in the documentation and could only find things on how to install OpenVPN (which we did and it works, but it seems rather slow! Much slower than I expected.)


Yes, an OpenVPN client-server configuration looks like your second diagram. The tunnels are between the OpenVPN server and the OpenVPN clients. The OpenVPN server decrypts the data coming from the one tunnel and encrypts it into another tunnel.

You can implement your first diagram with OpenVPN using a peer-to-peer architecture instead of a client-server one. You need to setup a VPN tunnel for each pair of machines in your network: each node has n VPN tunnels for a total of n² tunnels (which is not that convenient).

You analysis of what is happening is mostly correct except for one part. The public/private keys are not (directly) used to encrypt/decrypt the packets in to/out of the tunnel. Instead, they are used to authenticate the tunnel and negociate symmetric session keys used for the actual encryption/decryption (and MAC).


You're correct. In your setup you have a collection of "point to point" VPNs between your clients and the server. Communication between clients have to be performed at the server.

Indeed, by default, clients can't see each other unless the server permits it. From the manpage:

          Because the OpenVPN server mode handles multiple clients through
          a  single tun or tap interface, it is effectively a router.  The
          --client-to-client  flag  tells  OpenVPN  to  internally   route
          client-to-client  traffic  rather than pushing all client-origi-
          nating traffic to the TUN/TAP interface.

          When this option is used,  each  client  will  "see"  the  other
          clients  which  are currently connected.  Otherwise, each client
          will only see the server.  Don't use this option if you want  to
          firewall tunnel traffic using custom, per-client rules.
  • Yes. We have --client-to-client turned on. That works great, so any client can talk with any other client. But all the data is first sent to the server and then sent to the other client. I was hoping that clients could talk directly to each others... But it does not look like there is such an option. – Alexis Wilke Sep 14 '16 at 23:56
  • Correct; in this setup the clients are on their own point-to-point network. Traffic terminates at the openvpn server. – Stephen Harris Sep 14 '16 at 23:58
  • If "client-to-client" is disabled, the client might still be able to see each other: the IP packets / Ethernet frames are received by the server network stack which might decide to forward them to the other VPN client (if IP forwarding is enabled in the server). – ysdx Sep 18 '16 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.