Are there any Distributed/mesh-like/P2P VPNs?

I have my personal VPN, connecting several devices so they can have fixed IP addresses on an always-reachable network (as long as they are connected to the Internet). This is necessary for me, since my devices can be on the move, on different and unpredictable networks (4G network cellphone, laptop at university, home server at home), and I have a backup server that needs to connect to them (and sometimes, I also have to).

I am also thinking about installing something like syncthing, which may also benefit from lower latencies and closer nodes.

Also, I'm lazy, and I like to play/pause the music playing on my home server from my smartphone, that might not be on the same network (it should, but it isn't always the case).

This means I have one OpenVPN server, and the openvpn client running on every device. They all connect to the server, and any traffic from any two nodes has to go through the server, which is relatively far away, and has a very limited throughput. This means latency and slowness. And when I press the "Pause" button, it can take up to 10 seconds to actually pause the music. Even if both nodes are actually on the same LAN (since they talk through the VPN). Meh.

Ideally, there should exist some way of creating a VPN that was able to find shortest paths between nodes, and attempt to connect them directly. Something like the way Skype worked with supernodes?

While the server is far away from here, one of the nodes has a public IP address, and can be reached by the other nodes. It could act as a server from them - even if it isn't the server itself, although it would be a better choice for some nodes.

I imagine I could do something akin to run both a client and a server, and bridge them on that node, but that doesn't look elegant. It's hackish, it complicates the PKI, it splits the VPN. I don't like it.

While I could use a simple VPN like PPTP that really doesn't ensure the communications are secure, I decided I didn't want to bother configuring Bacula to encrypt the connections between the nodes, which means that traffic is plain inside the VPN. The VPN encapsulation is the only security, so it shouldn't be weak. However, anything that solves the "mesh"-like VPN without confidentiality would already be a good start - I'd make sure the traffic started going through SSL/TLS.

This looks like a problem that someone else might've had, and solved by now. Is there anything like this?

There's also the chance I'm looking at this the wrong way, but so far it looks like the best approach to ensure I can always connect to any of my devices remotely, no matter where I am, or they are.

I'm not sure whether it completely fulfils your needs, but you should probably take a look at tinc: http://www.tinc-vpn.org/. It quite closely matches the mesh network orchestrated by a central server as you described, but I'm not sure whether it will succeed in discovering peers in your local network.

The easiest mesh vpn I have found and used is PeerVPN (http://www.peervpn.net/).

PeerVPN Features

• Ethernet tunneling support using TAP devices.
• IPv6 support.
• Full mesh network topology.
• Automatically builds tunnels through firewalls and NATs without any further setup (for example, port forwarding).
• Shared key encryption and authentication support.

Configuration is simple.. one config file you edit and for basic mesh vpn there are only 6 settings you need to specify see the PeerVPN tutorial which is only 1 page: http://www.peervpn.net/tutorial/

The PSK encryption/authentication key can be upto 512 bits (64 bytes).

I've set peervpn up so far on multiple remote servers and it works very well. Also, there is no requirement for a "super-node" as you may encounter in other mesh vpn implementations.

Nodes in peervpn learn about newly added nodes to the VPN automatically w/no need to change configurations. Node to node traffic is also direct and not thru some central vpn hub.

Note: read the default peervpn.conf file to learn about alot of other options you "can" take advantage of. But for the basic mesh vpn as I stated you only need to set 6 options (name of vpn, PSK, local tunnel end point IP address, interface "name" you want to see/use on your linux system & port number to use for "that" vpn ... note you can use peervpn for multiple independent VPNs on a server)