Obviously openvpn has some kind of support inside the code to handle multiple tunnels, since many separate clients can connect to a single server. However, connecting one client to multiple servers to be buggy. I found it is attempting to set up routes for one of the tunnel configs, while setting up IP addresses from the other (based on watching strace).

Does anyone know if it really can do this as a client?

FYI, all searches for "two tunnels openvpn" come up with different cases than what I'm trying to do. What I want to do is connect to more than one remote private LAN with different addresses at the same time.

Have you tried searching the openvpn forums (http://forums.openvpn.net)? There seem to be a number of threads asking the same question, and it appears to be something that openvpn supports. I did a google search for "openvpn client connect to multiple servers" and got lots of hits.

I don't pretend to understand it, but it appears you may need to set up some static routes on the client side for each server IP you connect to, since you probably can't control what is pushed to you from each server.

it should be possible,. as long as the routes do not conflict
I imagine it could get complicated
you would probably need to set your own routes, and might be easier to use iptables to dictate where your traffic goes

OK, turns out it is NOT possible ... within a single process ... unless it is the server. For a client, it is normally done as separate processes, but using a single init script that starts all clients. You have to get manual to take down ONE connection and leave others up, but at least you can.

This also means openvpn considers servers and clients as quite different. Really, such things should be symmetrical during operation. The only asymmetry that should exist is who starts the tunnel, and who authenticate's whose certificates to get to the point of generating a shared session key (not needed if you configure your own shared key).

multiple clients using different ports and different tun/tap
firewall rules routing traffic based on , user , protocol , destination, DSCP....

I'm sure it could be done

can I do it?
not certain, I would have to learn how.

I guess I could mess about with a bunch of VMs

If you know networking, then it's a matter of learning openvpn and its limitations, as well as its flexibilities in other areas. There are many things it cannot do that could have been done in a secure tunneling program. They just didn't do all things and focused first on the common things. Then they added stuff to expand on that.

Unfortunately the documentation is more oriented around "read everything before doing anything" and is weak in the FAQ area for anything but common stuff. The ability for it to manage routes is limited ... you cannot put route and iroute options just anywhere. It treats clients and servers asymmetrically so some things won't work one way when they would work another way.

It can do pretty much anything you want it to do, but you might find some ways of expressing the config inconvenient, such as having to hard code route targets with guessed IP addresses.