3

I currently have the following network set up:

  • A few desktops connect to my modem (which doubles as a Wifi router) via Ethernet cables.
  • A few laptops connect to my modem via Wifi.
  • All PCs are in the same private subnet, and run Windows.
  • A Raspberry Pi 3 connects to my modem via Wifi (which I currently use as my CCTV).

I intend to turn my Pi into a OpenVPN server, so that I can access my resources on my PC, and play LAN game while being away from home. From what I've gathered, bridge mode with TAP seems to be the most suitable solution. I would try something like this:

  • Create a TAP interface and bridge it with my Pi's wireless interface.
  • On the modem, forward OpenVPN port to my Pi's IP address.
  • Config so that remote devices will be in the same subnet as local devices.

However, according to this link https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

Make sure to only bridge TAP interfaces with private ethernet interfaces which are protected behind a firewall. Never bridge a TAP interface with the same ethernet interface you use to connect to the internet, as that would create a potential security hole.

So my questions are:

  • When they say potential security hole, what vulnerability does they mean?
  • Does the wireless interface on my Pi counts as a private interface or a internet connected interface in this case (after all, everything is behind a modem)?
Improve this question

1 Answer 1

Reset to default
3

Your rpi interface is not directly connected to the Internet, and thus the warning does not apply.

You are behind a modem/NAT, as you say your are forwarding the OpenVPN port. So the other ports are firewalled e.g. inaccessible.

The problem here would be if you had your rpi like my lamobo R1, which is the router for the Internet, and the machine doing NAT.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .