Hi all expert,

I'm need to setup vpn technology using for browsing internet securely.

AFAIK, VPN connection must operates on two endpoins.
Does this rules applies to LAN or WAN?

if LAN
OpenBSD Router(OpenVPN Server) <----------------- LAN (OpenVPN Client)

if WAN
OpenBSD Router(OpenVPN Client) ----------------------> VPS(OpenVPN Server)

Please help. Thanks.

Hi Peter,

I'm a little unclear on what you are trying to do. Could you elaborate? What exactly do you mean by "browsing internet securely"?

While using a VPN for browsing the internet can solve some problems (like preventing someone on the coffee shop wifi network from spying on you, and hiding your location), it doesn't necessarily "secure" your browsing completely, as the traffic has to leave the VPN at some point to reach the web server (i.e. the connection from the VPN server to the web server).

Assuming this is your network, you control the router, and trust other users on the LAN, there is probably no real benefit in a VPN between the client and the router. You can probably just create a VPN connection from the router to some external VPN server.

If you want to encrypt the LAN traffic too, you can either create two separate VPN connections as you suggested (from client to router, and from router to external VPN server), or just create an end to end VPN connection directly from the client to the VPN server (assuming the firewall rules on the router are set up to allow this).

I hope this helps.

The essential purpose of VPN is to create a tunnel which encompasses a range of IP-addresses and ports. All information passes securely through this tunnel, and the presence of the encryption is concealed from the users thereof. I think it's a good strategy to do this, when possible, at the router level.

If this is done, the router can usually act as a "trusted insider," in that you don't need to further secure the inside connections made to it. The router communicates securely with its counterparts to create, as the name implies, a "virtual private network."

In all cases, digital certificates, not "PSKs == passwords," should be used to secure the connection, and to uniquely identify every participating device. Every party knows that it is communicating with a bearer of a certificate that it has been told to recognize, and every one of these certificates is one-of-a-kind, issued by a trusted authority (you).

Let me state the question clearly.

I don't want to secure the LAN connection at all.
From usual case, OpenVPN client connects to remote OpenVPN server but this setup is very slow. I cann't even browse google search with 2MBps connection.

Therefore, I'm plan to roll out OpenVPN Server on my own OpenBSD router and LAN clients connect to it and tunnel out the connection.
I wonder is this setup possbiel?