Re: [Openvpn-devel] man page and options.c contradict

2014-10-24 Thread Steffan Karger
On 10/24/2014 11:41 AM, Arne Schwabe wrote: > Am 24.10.14 11:15, schrieb Gert Doering: > And an important distinction is that the p2p mode does not use Diffie > Hellman, meaning that it provides no Perferct Forward Security. No, I think there's another distinction. There's 'static key mode' (--sec

Re: [Openvpn-devel] man page and options.c contradict

2014-10-24 Thread Arne Schwabe
Am 24.10.14 11:15, schrieb Gert Doering: > Hi, > > On Fri, Oct 24, 2014 at 01:04:17AM -0600, Reinoud Koornstra wrote: >> I understood the term mode wrong. >> So the main mode can be p2p or server to denote the openvpn protocol inside >> tcp or udp(stateless) session. Initially I thought the term mo

Re: [Openvpn-devel] man page and options.c contradict

2014-10-24 Thread Gert Doering
Hi, On Fri, Oct 24, 2014 at 01:04:17AM -0600, Reinoud Koornstra wrote: > I understood the term mode wrong. > So the main mode can be p2p or server to denote the openvpn protocol inside > tcp or udp(stateless) session. Initially I thought the term mode is used to > denote server, client or udp. Op

Re: [Openvpn-devel] man page and options.c contradict

2014-10-24 Thread Reinoud Koornstra
Ok, Thanks. I understood the term mode wrong. So the main mode can be p2p or server to denote the openvpn protocol inside tcp or udp(stateless) session. Initially I thought the term mode is used to denote server, client or udp. Hi, On Thu, Oct 23, 2014 at 03:42:54PM -0600, Reinoud Koornstra wrote:

Re: [Openvpn-devel] man page and options.c contradict

2014-10-24 Thread Gert Doering
Hi, On Thu, Oct 23, 2014 at 03:42:54PM -0600, Reinoud Koornstra wrote: > Ok, clear, to TCP cannot be used in point to point mode (p2p) then, because > in case of tcp we must have a client and a server? Please READ what I write, so I don't have to repeat it. TCP imposes an imbalance between the p

Re: [Openvpn-devel] man page and options.c contradict

2014-10-23 Thread Reinoud Koornstra
Ok, clear, to TCP cannot be used in point to point mode (p2p) then, because in case of tcp we must have a client and a server? Inside the tun or tap interface, can we specify the protocol and port number used for any communications inside the tun/tcp interface or do we allow any protocol/port for c

Re: [Openvpn-devel] man page and options.c contradict

2014-10-23 Thread Gert Doering
Hi, On Thu, Oct 23, 2014 at 02:04:10PM -0600, Reinoud Koornstra wrote: > In my understanding, there is no client or server in p2p mode. True, as far as the OpenVPN protocol is concerned. False, as far as TCP is concerned, because you MUST have a client and a server in TCP - it's not a symmetric

Re: [Openvpn-devel] man page and options.c contradict

2014-10-23 Thread Reinoud Koornstra
In my understanding, there is no client or server in p2p mode. In this case you're trying to establish a secure connection between two gateways using openvpn like a tunnel. Is my understanding wrong about this? Besides this, I still stumble upon the issue of specifying just tcp in the remote sectio

Re: [Openvpn-devel] man page and options.c contradict

2014-10-23 Thread Gert Doering
Hi, On Thu, Oct 23, 2014 at 01:24:45PM -0600, Reinoud Koornstra wrote: > The idea in my case is to have a point-to-point connection where both hosts > listen on port 443 tcp instead of port 1194 udp to setup the point-to-point > connection. If both listen, who calls out? In TCP mode, you need to

[Openvpn-devel] man page and options.c contradict

2014-10-23 Thread Reinoud Koornstra
Hello Everyone, I read the manpage here: doc/openvpn.8 remote 198.19.34.56 443 tcp However, when you configure this in your configuration file, you cannot do this: in src/openvpn/options.c: /* * If "proto tcp" is specified, make sure we know whether it is * tcp-client or tcp-server.