Comparing tun mode to tap mode

As we have seen so far in this chapter, there are many similarities, but also some significant differences between a tun-style VPN and a tap-style VPN. In this section, we will discuss those similarities and differences. Most of the differences stem from the single fact that a tun-style VPN is a non-broadcast, point-to-point IP-only network, whereas a tap-style network provides a fully virtual, Ethernet-like network with broadcast support. In short, a tun-style network provides layer 3 network connectivity, whereas a tap-style network provides almost all the functionality of a layer 2 network.

Especially with the topology subnet option, a tun-based setup resembles a non-bridged tap-based setup:

• The option server 10.200.0.0 255.255.255.0 sets up a VPN with a server address of 10.200.1/24. Each client will receive a single /24 IP address, starting at 10.200.0.2/24.

• The way the VPN traffic is encrypted and digitally signed (HMAC) is identical.

• Most scripting capabilities...