Administrace komentářů

What is the difference between bridging and routing?

Bridging and routing are two methods of linking systems via a VPN.
Bridging advantages

    * Broadcasts traverse the VPN -- this allows software that depends on LAN broadcasts such as Windows NetBIOS file sharing and network neighborhood browsing to work.
    * No route statements to configure.
    * Works with any protocol that can function over ethernet, including IPv4, IPv6, Netware IPX, AppleTalk, etc.
    * Relatively easy-to-configure solution for road warriors.

Bridging disadvantages

    * Less efficient than routing, and does not scale well.

Routing advantages

    * Efficiency and scalability.
    * Allows better tuning of MTU for efficiency.

Routing disadvantages

    * Clients must use a WINS server (such as samba) to allow cross-VPN network browsing to work.
    * Routes must be set up linking each subnet.
    * Software that depends on broadcasts will not "see" machines on the other side of the VPN.
    * Works only with IPv4 in general, and IPv6 in cases where tun drivers on both ends of the connection support it explicitly.

What are the fundamental differences between bridging and routing in terms of configuration?

When a client connects via bridging to a remote network, it is assigned an IP address that is part of the remote physical ethernet subnet and is then able to interact with other
machines on the remote subnet as if it were connected locally. Bridging setups require a special OS-specific tool to bridge a physical ethernet adapter with a virtual TAP style device.
On Linux, for example, brtcl is this tool. On Windows XP or higher, select your TAP-Win32 adapter and your ethernet adapter in Control Panel -> Network Connections, 
then right click and select Bridge Connections.

When a client connects via routing, it uses its own separate subnet, and routes are set up on both the client machine and remote gateway so that data packets will seamlessly traverse the VPN.
 The "client" is not necessarily a single machine. It could be a subnet of several machines.

Bridging and routing are functionally very similar, with the major difference being that a routed VPN will not pass IP broadcasts while a bridged VPN will.

When you are bridging, you must always use --dev tap on both ends of the connection. If you are routing you can use either --dev tap or --dev tun, but you must use the
same on both ends of the connection. --dev tun tends to be slightly more efficient for the routing case.