11 May
2019
11 May
'19
8:50 a.m.
Correct. Your approach saves you a lot of work in
maintaining custom
configs. They are a lot of work, if you have a lot of users.
Indeed. We offer OpenVPN connectivity to our local hams (the Netherlands) using
certificates
created especially for that. The users get their fixed IP derived from the certificate
subject
name (looked up in DNS/hosts) so they also can run services under their own callsign.
There are 220 valid certificates at this time, and always about 20 systems connected plus
those
that connect when required.
Those that want to route subnets can get a GRE(6) or L2TP/IPsec tunnel and run BGP over
that.
There currently are 34 users of that service, 30 of them are connected.
This mode is also used to provide connectivity to regional clusters of systems that are
not yet
connected by radio all over our country.
It requires some one-time setup but at least there is no maintenance when users want to
announce
more subnets etc.
Of course more systems like this could be setup in other countries/regions to serve those
that
are on dynamic IP, are behind CGNAT, can only use IPv6, etc.
A "cloud" hosted Linux (virtual) machine with a fixed IP is all that you really
require, a
service from the ISP to BGP-announce a subnet and route that to you is a good addition.
Alternatively you could use something like a MikroTik, Edgerouter or Juniper instead of
the
Linux VM. A little less flexible in some areas but easier to setup and maintain.
Rob