Multi-nic example

karrelsj

Hello all,

I have used the search button and am having troubles finding a good multi-nic example configuration. I was wondering if anyone could offer a good link to something along the lines of the following:

client1 -----\                                                 internal node 1 [10.0.0.100]
client2 -------->    openvpn_server                            internal node 2 [10.0.0.101]
client...-----/        [eth0: external ip]                     internal node ...
                       [eth1: 10.0.0.1]

I will spare you the garbage I have in my configuration files right now, but in short I have an internal VM lan running on 10.0.0.0 (as an example). I was wanting to add a new VM to that LAN with 2 nics, one nic with a publicly assigned IP, and the other nic connected to the internal vm lan. I was looking at bridged mode of giving clients connecting through the internet full access to the internal lan as just another one of the nodes.

With that said, does anyone have a good reference to a mult-nic bridged configuration?

janjust

please draw a better diagram of your desired network setup; providing internet access via an OpenVPN server is a common scenario; running an OpenVPN server on a VM is also common. Combining the two is also often done, and all without the need for bridging...

karrelsj

I changed IPs around for security sake. Sorry for being lazy on the first diagram.

Diagram prior to vpn.

[openvpn#] ifconfig

br0       Link encap:Ethernet  HWaddr de:0e:91:7a:35:dc  
          inet addr:10.0.0.3  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::dc0e:91ff:fe7a:35dc/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:28 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:6484 (6.4 KB)  TX bytes:468 (468.0 B)

eth0      Link encap:Ethernet  HWaddr 76:12:e7:21:c5:76  
          inet addr:192.168.100.150  Bcast:192.168.100.255  Mask:255.255.255.0
          inet6 addr: fe80::7412:e7ff:fe21:c576/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:63034 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1336 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6271429 (6.2 MB)  TX bytes:167754 (167.7 KB)
          Interrupt:9

eth1      Link encap:Ethernet  HWaddr e6:8b:47:93:ea:5f  
          inet6 addr: fe80::e48b:47ff:fe93:ea5f/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:347 errors:0 dropped:0 overruns:0 frame:0
          TX packets:45 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:71625 (71.6 KB)  TX bytes:2812 (2.8 KB)
          Interrupt:10 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:43 errors:0 dropped:0 overruns:0 frame:0
          TX packets:43 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4332 (4.3 KB)  TX bytes:4332 (4.3 KB)

tap0      Link encap:Ethernet  HWaddr de:0e:91:7a:35:dc  
          inet6 addr: fe80::dc0e:91ff:fe7a:35dc/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:4356 (4.3 KB)

[openvpn#] brctl show

bridge name    bridge id                   STP enabled    interfaces
br0              8000.de0e917a35dc      no                eth1 tap0

[openvpn#] route

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.100.0   *               255.255.255.0   U     0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 br0
default         192.168.100.1   0.0.0.0         UG    0      0        0 eth0

[openvpn#] cat server.conf

proto udp
port 1194
dev tap0

server-bridge 10.0.0.3 255.255.255.0 10.0.0.2000 10.0.0.210

push "route 10.0.0.0 255.255.255.0"

ca /etc/openvpn/cookbook/ca.crt
cert /etc/openvpn/cookbook/server.crt
key /etc/openvpn/cookbook/server.key
dh /etc/openvpn/cookbook/dh2048.pem
tls-auth /etc/openvpn/cookbook/ta.key 0

persist-key
persist-tun
keepalive 10 60

user nobody
group nobody

daemon
log-append /var/log/openvpn.log

[client1#] cat client.conf

client 
proto udp 
remote 192.168.100.150
port 1194 
dev tap
nobind 

ca /etc/openvpn/cookbook/ca.crt 
cert /etc/openvpn/cookbook/client1.crt
key /etc/openvpn/cookbook/client1.key
tls-auth /etc/openvpn/cookbook/ta.key 1

janjust

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

karrelsj

I did purchase and use your cookbook, nice work!

Thanks for the catch. There were two really obvious problems that I was overlooking thinking it was something much more difficult.

1) The ip range as you found for me.
2) I had the client configuration still set for TUN.

For some reason I had logging at level 0 and when I turned that up the problems came to the front right away. Everything is up and running now. Thanks.