Multiple Interfaces, Same IP

Quicksearch

Calendar

Syndicate This Blog

ATOM 1.0 feed

Comments

Adrian von Bidder about Has Microsoft Won?
Wed, 10.03.2010 13:01
Peter, thanks for the pointer. I'm looking forward to where all this is going. I will, h owever, readily admit th [...]

Peter Eisentraut about Has Microsoft Won?
Wed, 10.03.2010 12:02
I agree that the state of free end-to-end groupware systems is sad. You may be interested to share some of your f [...]

Tobias about Geek Quiz
Fri, 05.03.2010 21:06
A1: 1 Endless Loop? A2: ?

Scott P about HTTP over UDP?
Thu, 25.02.2010 14:09
I actually saw this implemente d in my sniffer the other day. Looks like Microsoft uses it to contact update server [...]

Franklin Piat about Multiple Interfaces, Same IP
Fri, 05.02.2010 22:59
Ask on debian-user mailing lis t. (i.e don't turn debian-pla net into a support "mailing li st").

Friday, February 5. 2010

Multiple Interfaces, Same IP

Playing around a bit with ssh tunneling right now. When I create a kind of VPN concentrator with a few tun interfaces: is there any reason why I can't just assign the same IP on all these tun interfaces? A quick test shows this set up working nicely, with ifconfig tunX localip pointopoint remoteip (the localip part being the same) setting up the routes to chose the right tun device for all remote IP addresses, and ping worked just fine for me. Firewall rules will always have the remote IP and/or the interface name to decide when a packet applies.

Obviously setting up a listening socket at only one of these interfaces is not so trivial now since I can't just listen to the IP, but that's a restriction I'm happy with. Anything else I'm not thinking of right now?

Posted by Adrian von Bidder in Tech at 12:47 | Comments (5) | Trackbacks (0)

< IPv6 sucks.

Comments

Display comments as (Linear | Threaded)

Having multiple interfaces with the same IP address was always the standard configuration of a terminal server with multiple PPP and SLIP links. The default configuration of Portslave always had a single IP address for the local end of all PPP/SLIP connections and there was no documentation on how to do otherwise. A few years ago when such things were common there didn't seem to be any problems doing it. Of course things may have changed since then.

#1 Russell Coker (Homepage) on 2010-02-05 13:20 (Reply)

That works nicely for me for *years* now.

#2 Joerg Jaspert on 2010-02-05 14:19 (Reply)

I think "setting up a listening socket at only one of these interfaces" is the historical reason why it's not commonly done. It also breaks SNMP, which uses the IP address as the primary key in the ipAddressTable. In general, the localip could also be an RFC1918 address if you wanted to conserve routeable addresses, but this might conflict with your peer's setup.

#3 GyrosGeier on 2010-02-05 14:24 (Reply)

Rather than some custom SSH-tunnel-based VPN, do yourself the favour and use OpenVPN instead. It supports tap interfaces, which means that you don't have to have any internal addresses, but it can manage tun interfaces too, either with a separate pool each, or out of one large common pool.

#4 martin f. krafft (Homepage) on 2010-02-05 20:58 (Reply)

Ask on debian-user mailing list. (i.e don't turn debian-planet into a support "mailing list").

#5 Franklin Piat on 2010-02-05 22:59 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry
Submitted comments will be subject to moderation before being displayed.