I've got an AWS server which I'd like to set up as a VPN for LAN gaming. The games we'll be playing do not support direct IP connection and use broadcasts to show up in other player's lobbies.

The thing is - I'm not sure the bridged VPN will work in AWS. If I bridge the tap0 with eth0, will AWS's DHCP-server give IP addresses to clients? If not, is there a way to still do this? For example with virtual ethernet interfaces? Will I need to set up my own DHCP server then or is there a more simple way to do all this?

  • Why do you want to bridge the VPN with eth0 in the first place? That seems like it has nothing to do with the VPN's described purpose.
    – user1686
    Mar 9, 2020 at 11:14
  • So with what interface should I bridge it? I don't have much experience with networks, can you describe what setup do I really want? Mar 9, 2020 at 11:29

2 Answers 2


I was struggling with a similar setup to run a TAP-based OpenVPN on AWS for a few hours and finally got it to work. @user1686's comments were quite valuable in this regards.

If you're running your OpenVPN server within a cloud environment I'd recommend not using a eth bridge on the server (actually no eth bridges are necessary at all). You only need tap interfaces at each client and the server. However, you need to define some address range within a valid subnet (i.e.; and assign IP addresses to your clients. I was achieving that by pushing ip addresses to the clients. It was important though to explicitly set the IP address of the server's tap0 interface via a OpenVPN startup script.

server.conf (excerpt)

dev tap

# Define your IP address range within a valid subnet

# Set server tap0 ip address on startup
up openvpn-server-up.sh

# Set client config dir
client-config-dir ccd


ifconfig tap0 netmask broadcast

For each client create client config under /etc/openvpn/ccd/ (certificate common name) Example CN=client - ccd/client


Then create a standard TAP client config for each client.

client.conf (excerpt)

dev tap
remote <ip> 1194

After setting everything up you should be able to ping your clients and also use apps which rely on Layer2 broadcasts for client discovery (i.e. Warcraft 3).



According to your description, the VPN is meant to bridge clients with other clients – so there is no need at all to additionally bridge it to the server's "eth0" interface. (That is, there's no need to set up a kernel 'bridge' device at all – the VPN server program will internally handle client-to-client bridging.)

Neither the games' operation nor the VPN's operation requires bridged access to the server's physical LAN – it is enough for the VPN to be an isolated Ethernet network.

And when the network is isolated from the server's physical Ethernet, then the VM provider becomes irrelevant – it will work on just about anything.

If i bridge the tap0 with eth0, will AWS's DHCP-server give IP addresses to clients?

I don't actually know the answer to that. (It might, since you always get a private DHCP service that isn't shared with other customers. Or it might not, since it's meant for VMs themselves only.)

If not, is there a way to still do this, like for example with virtual ethernet interfaces?

There is no need for any additional "virtual ethernet interface". If the VM is going to run its own gameserver, then tap0 is the interface you need. And if the VM is only meant to relay data, then bridging between clients will happen internally within the VPN software.

Will I need to set up my own DHCP server then?

If you plan on using the VPN as a "site-to-site" bridge (i.e. connecting whole LANs together), then yes, you'll need a DHCP server somewhere.

But if the VPN is strictly client-to-client (i.e. each PC has its own VPN app and its own connection), then in many cases the VPN software itself will be able to assign IP addresses – without DHCP. For example, OpenVPN and ZeroTier both already assign addresses to clients by default.

  • Oh, thank you for clarification. So the only thing i need for my purpose is TAP interface? Like, using dev tap0 instead of dev tun in OpenVPN config? Mar 9, 2020 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.