Hacker News Reader

Comment by icebraining | Hacker News Reader

When comparing with OpenVPN, they say the latter "does not allow direct client-to-client communication." Can anyone explain it? I thought point-to-point mode was not only supported, but the default.

View on HN

I think the key word there is "direct" -- AFAIK FreeLAN is P2P, where OpenVPN is "client -> server -> other client"

OpenVPN is client/server in cert authenticated mode and P2P in symmetric mode. What it doesn't do is routing, so for creation of darknets you need a proper routing daemon, and non colliding IPs. Nor does it tunnel NAT (but it can connect from in NAT to outside, so a group in NAT can be bridged by a hub node on the internet).

But the semantics are silly if you can just host your own server.

With freelan, once the client has established a connection with any other known and accessible freelan client, a direct client-client connection can be made to anyone on the network, even if they are behind a NAT/firewall. I believe it's through a combination of tun/tap, UDP-punching, and proxying, but don't know for certain.

OpenVPN establishes a site-to-site or point-to-site VPN, but routing to the client still goes through the gateway server.

Freelan still requires a known "supernode" to broker the initial connection, but after that, they can either communicate directly or through peers.

I can't figure out what they are talking about, and documentation on the main site is little to none. There are a few examples, but the actual binaries and config file locations are not documented on the website. I would have to download and install to read more. I suspect english may not be a first language here. I am also very suspect of anyone who uses real-word valid IP addresses in examples, rather than RFC1918 addresses.

My reading of it is that they appear to be saying that freelan does transparent NAT traversal, whereas OpenVPN would require explicit port-forwarding.

Scratch everything I said below. After reading what little documentation there is on FreeLAN, which isn't much, it looks like just another VPN solution like all the rest with nothing really special about it. The configuration looks different and it is interesting, but I don't see anything that makes it special, and the products claims of superiority over others seem unfounded.

I just happen to be here doing my first OpenVPN implementation this last few days.

It appears that FreeLAN is all about transparent bridging VPN, rather than routing VPN. Thus, the "LAN" part of the FreeLAN product name is particular apt.

It is noteworthy that the words "Ethernet" and "bridging" are absent from the product FAQ. This is most unfortunate.

it is the default... (for most practical definitions).

Reply on news.ycombinator.com