Is it possible to set up a bridged VPN in AWS to connect multiple clients in a single LAN that will allow broadcasts between them?

Question

I've got an AWS server which I'd like to set up as a VPN for LAN gaming. The games we'll be playing do not support direct IP connection and use broadcasts to show up in other player's lobbies.

The thing is - I'm not sure the bridged VPN will work in AWS. If I bridge the tap0 with eth0, will AWS's DHCP-server give IP addresses to clients? If not, is there a way to still do this? For example with virtual ethernet interfaces? Will I need to set up my own DHCP server then or is there a more simple way to do all this?

Answer 1

I was struggling with a similar setup to run a TAP-based OpenVPN on AWS for a few hours and finally got it to work. @user1686's comments were quite valuable in this regards.

If you're running your OpenVPN server within a cloud environment I'd recommend not using a eth bridge on the server (actually no eth bridges are necessary at all). You only need tap interfaces at each client and the server. However, you need to define some address range within a valid subnet (i.e. 192.168.2.0/24; 192.168.2.211-192.168.2.220) and assign IP addresses to your clients. I was achieving that by pushing ip addresses to the clients. It was important though to explicitly set the IP address of the server's tap0 interface via a OpenVPN startup script.

server.conf (excerpt)

dev tap

# Define your IP address range within a valid subnet
server-bridge 192.168.2.210 255.255.255.0 192.168.2.211 192.168.2.220
client-to-client

# Set server tap0 ip address on startup
up openvpn-server-up.sh

# Set client config dir
client-config-dir ccd

openvpn-server-up.sh

#!/bin/sh
ifconfig tap0 192.168.2.210 netmask 255.255.255.0 broadcast 192.168.2.255

For each client create client config under /etc/openvpn/ccd/ (certificate common name) Example CN=client - ccd/client

ifconfig-push 192.168.2.211 255.255.255.0

Then create a standard TAP client config for each client.

client.conf (excerpt)

client
dev tap
remote <ip> 1194

After setting everything up you should be able to ping your clients and also use apps which rely on Layer2 broadcasts for client discovery (i.e. Warcraft 3).

Cheers

Answer 2

According to your description, the VPN is meant to bridge clients with other clients – so there is no need at all to additionally bridge it to the server's "eth0" interface. (That is, there's no need to set up a kernel 'bridge' device at all – the VPN server program will internally handle client-to-client bridging.)

Neither the games' operation nor the VPN's operation requires bridged access to the server's physical LAN – it is enough for the VPN to be an isolated Ethernet network.

And when the network is isolated from the server's physical Ethernet, then the VM provider becomes irrelevant – it will work on just about anything.

If i bridge the tap0 with eth0, will AWS's DHCP-server give IP addresses to clients?

I don't actually know the answer to that. (It might, since you always get a private DHCP service that isn't shared with other customers. Or it might not, since it's meant for VMs themselves only.)

If not, is there a way to still do this, like for example with virtual ethernet interfaces?

There is no need for any additional "virtual ethernet interface". If the VM is going to run its own gameserver, then tap0 is the interface you need. And if the VM is only meant to relay data, then bridging between clients will happen internally within the VPN software.

Will I need to set up my own DHCP server then?

If you plan on using the VPN as a "site-to-site" bridge (i.e. connecting whole LANs together), then yes, you'll need a DHCP server somewhere.

But if the VPN is strictly client-to-client (i.e. each PC has its own VPN app and its own connection), then in many cases the VPN software itself will be able to assign IP addresses – without DHCP. For example, OpenVPN and ZeroTier both already assign addresses to clients by default.