Client VPN versus P2P pfsense VPN
-
So I have a question. What is better?
If I have two networks 300 miles apart and I want them to be able to appear as one network is it better to connect the pfsense boxes together via VPN rather than having all the clients at the second location VPN into the first location? What is the difference? Is it just convience to not have all the clients in the second network VPN in or is there actually some advantage? Because in the big picture/purpose the same thing is happening either way correct?
P2P VPN:
ClientA (location 1) <–( rules have to allow Client D (VPN interface) to talk to Client A )----> pfSense <--VPN--> Internet <---VPN--> pfSense <-----> ClientD (location 2)
Client VPN:
ClientA (location 1) <--( rules have to allow Client D (VPN interface) to talk to Client A )----> pfSense <--VPN--> Internet <---VPN--> Alternative router <--VPN---> ClientD (location 2)
Thanks in advance!
-
No its not anywhere close to the same thing - in one you have pfsense having to handle 300 vpn connection, other pfsense 0. In other option each pfsense is handling 1.
What do you think is easier on pfsense to handle?
Lets say there was no load issues with pfsense handling 300 different vpn connections all at the same time. Would you really want to even setup 300 client connections?
So if clients want to talk to each other, do you really want to route the traffic to remote pfsense, and then back down to other client?
-
I would have to agree with the previous post. It seems like a no brainer when having to choose between setting up 1 site to site tunnel or installing, configuring and maintaining X number of VPN clients on the remote side.
Set up the site-to-site tunnel. More efficient, less administration.
-
Okay, that's what I thought. Thanks!
Anyway, I have another question and this one seems even more dumb than the last one. With site-to-site tunneling, does the traffic on the secondary site destined for the internet, travel to the primary site and then out to the internet, or would it not travel over the VPN and just go out the secondary site's WAN interface to the requested website? Because if it is the former then users' download speed at the secondary site would be limited to the upload speed of the primary site's WAN.
Thanks in advance!
-
No normally you would not route "internet" traffic through the site to site connection.
Yes it would be possible to do such a thing. But no normally not what you would do with a site to site, so if going to that site then down the tunnel the traffic goes. If going elsewhere then no it wouldn't go down the tunnel.
-
So that's what it means on the VPN page that says "route all traffic through tunnel"?
-
Everything that goes out your pfsense goes out through the VPN. Cool stuff. Many people prefer it. It avoids deep packet inspection.
