Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN OVER VPN

    L2/Switching/VLANs
    5
    19
    4.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • PippinP
      Pippin
      last edited by

      It is planned to be included into version 2.5:
      https://community.openvpn.net/openvpn/wiki/StatusOfOpenvpn25
      https://github.com/OpenVPN/openvpn/pull/76

      I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
      Halton Arp

      JKnottJ 1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @Pippin
        last edited by

        @Pippin said in VLAN OVER VPN:

        It is planned to be included into version 2.5:

        What's to be included???

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • PippinP
          Pippin
          last edited by Pippin

          Vlan capability, but I think I was too quickly, it's for tap mode, not tun.

          I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
          Halton Arp

          JKnottJ 1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @Pippin
            last edited by JKnott

            @Pippin said in VLAN OVER VPN:

            Vlan capability, but I think I was too quickly, it's for tap mode, not tun.

            That's curious. As TAP mode is supposed to be equivalent to a bridge, there should be no difference between handling VLANs and any other type of Ethernet frame. The only difference between a VLAN frame and any other is the contents of the Ethertype field and the additional 4 bytes. A TAP VPN should be able to handle any Ethernet frame, including VLAN.

            Ethernet bridges represent the software analog to a physical ethernet switch.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • PippinP
              Pippin
              last edited by

              Please read here:
              https://sourceforge.net/p/openvpn/mailman/message/34991937/

              I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
              Halton Arp

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @Pippin
                last edited by

                @Pippin said in VLAN OVER VPN:

                Please read here:
                https://sourceforge.net/p/openvpn/mailman/message/34991937/

                First off, I have no experience with TAP. My take on that is adding VLAN support to the TAP interface, as would be done on an Ethernet interface. Is that correct? Does TAP support bridging from a physical interface? If so, it should be transparent to VLAN tags.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                PippinP 1 Reply Last reply Reply Quote 0
                • PippinP
                  Pippin @JKnott
                  last edited by

                  @JKnott said in VLAN OVER VPN:

                  First off, I have no experience with TAP. My take on that is adding VLAN support to the TAP interface, as would be done on an Ethernet interface. Is that correct? Does TAP support bridging from a physical interface? If so, it should be transparent to VLAN tags.

                  Neither do I but yes, it's about adding VLAN support to TAP interface.

                  But I think it's OT here...

                  I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
                  Halton Arp

                  1 Reply Last reply Reply Quote 0
                  • R
                    renat_kaa
                    last edited by renat_kaa

                    @max33 I'd like to clarify your request.
                    What do you need?:

                    1. translate VLAN id to client-side network (i don't know the reason)
                    2. just need to access to devices behind VPN tunnel from your client device
                      If 2nd - just give access on VPNserver settings page. You don't need to translate VLAN IDs to tunnel.
                      Take a look this:
                      861589bb-357d-49ae-a2cb-b502e2ac1303-image.png
                      29bd7e5d-f4bc-41dc-94c2-8f8e025869f4-image.png
                      OpenVPN server settings 4c3b3487-b85d-4869-880d-dee1c403d9c4-image.png

                    As a result VPN client doesn't even know about tags, vlans etc.
                    ping from VPN client to VLAN20 gateway (packets between VPN client and VPN server are untagged)
                    6c13ce5d-355d-4fec-8ec7-4134b2f5e44d-image.png

                    1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott
                      last edited by

                      Is VLAN over VPN even necessary? VLANs are normally different IP address ranges. Why not just route the traffic from the VLANs to the other end according to address? Similarly, the other end will then forward to the appropriate VLAN.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • M
                        max33
                        last edited by

                        Thanks to all for taking time to respond

                        I think my question was not clear so i will try to explain : I just want to connect to my switch via vpn client.

                        I confirm that i correctly set my open vpn (the IVP4 local network range) but unable to reach web interface of the switch .

                        Currently schema is :

                        NIC 1 of PFSENSE connected to WAN
                        NIC 2 of PFSENSE connect to Switch Layer 2

                        Two VLAN interface declared on PFSENSE NIC 2
                        VLAN 100 for TELEPHONY - 192.168.10.0/24
                        VLAN 200 for PC - 192.168.0.0/24

                        Switch are on VLAN 200 (Management VLAN 200) on IP 192.168.0.253

                        PC are connected to Phone devices (YEALINK T46) and phone connected to Switch.

                        Phone Device tagged packet in order to manage VOIP traffic on VLANN 100 and PC traffic on VLAN 200

                        All works when i am on local network (connected to switch) but when i am outside in order to manage the network i implemented OPENVPN on pfsense and set the two network on IPV4 Local Network.

                        I got acces to web interface of phone but not on web interface of switch so i am asking myself if it could be due to vlan.

                        I will try to perform more test tonight and come back later.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Looking at that VLAN feature it sounds like it will be in the OpenVPN tap process - sort of like iroutes in the tun process. If it also integrates with, say, tagged VLANs on an OpenVPN assigned interface that would be...interesting.

                          All works when i am on local network (connected to switch)

                          I got acces to web interface of phone but not on web interface of switch so i am asking myself if it could be due to vlan.

                          Is the default gateway on the switch's management interface set properly?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          PippinP 1 Reply Last reply Reply Quote 0
                          • PippinP
                            Pippin @Derelict
                            last edited by

                            @Derelict
                            I think this answers that question:
                            https://github.com/OpenVPN/openvpn/pull/76#issuecomment-493688410

                            I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
                            Halton Arp

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Yeah. that would be interesting.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • JKnottJ
                                JKnott
                                last edited by

                                One question, what's at the other end of the VPN? With a TAP VPN, the network will have to be in the same subnet as this end.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                1 Reply Last reply Reply Quote 0
                                • M
                                  max33
                                  last edited by

                                  HI
                                  Thanks a lot Derelict you got the point , the issue was coming from wrong gateway setting on the switch.
                                  A stupid simple config......

                                  By the way thanks a lot to all people whose taking time to respond....

                                  Have a good day all............

                                  R 1 Reply Last reply Reply Quote 0
                                  • R
                                    renat_kaa @max33
                                    last edited by

                                    @max33 great! have a nice day)

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.