mlalitha
Hi,
Here are the snippets from my openvpn server.conf file.
# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d
local 10.207.72.62
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev tap0
dev-node tap-bridge
# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0. Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
server-bridge 10.208.72.62 255.255.255.0 10.208.72.81 10.208.72.82
The local VPN is created on "10.207.72.62" but I am creating the server bridge on a different network. If I try pinging from the client to the server 10.208.72.62 which is on a different subnet it does not work.
1) Does this mean that the server bridge should have the same IPaddress as that of eth0 and should the openvpn server also run on the same subnet that is configured on eth0?
2) I am not exactly clear on the role of the ethernet bridge in the server side configuration in tap mode. I see that the tap interface is getting created in the promiscous mode Can someone please let me know how this bridge functions in the server side w.r.t openvpn?
Thanks,
Lalitha.M
Mimiko
The bridge mode is an analog of a simple switch (with firewall capabilities). In order to work, you must make bridging between tap interface ant eth interface and the resulting interface has the local LAN IP.
The promiscuous mode is needed to capture all packets from eth and send them thru the tunnel, like does it the hardware switch or hub.
mlalitha
Hi,
Before running openvpn in the tap mode, I ran the bridge-start script. I tried running open vpn in the tap mode.
I observed that both the bridge br0 and eth0 had same ip address (e.g) 10.207.8.1. Suppose eth0 has hardware ipaddress of aa:bb:cc:dd:ee:ff. I found the same ipaddress and hardware address on the bridge also. Inaddition to it a tap interface was also created in the promiscuous mode.
I ran the openvpn client on another machine and tried capturing the packet on the eth0 of the client through wireshark. I found that all packets destined to server were destined to aa:bb:cc:dd:ee:ff. (which is the hardware address of both eth0 and the br0.
In the server side, I assumed that packets from eth0 would reach the bridge and then tap0 as shown below. If the following assumption is wrong please correct me. Where does openvpn act on the received packets? Does it read from tap0 and decrypt or how does it work? Can you please clarify.
tap0
^
|
bridge br0
^
|
eth0
Thanks,
Lalitha.M
Mimiko
OpenVPN is between tap adapter and the internet (i.e, the channel with the client). All packets going thru tap adapter goes to OpenVPN.
mlalitha
Hi,
Thanks a lot for the info.
I have one last question. Should openvpn server run on the same ip address as that of it is local subnet? For eg. if in eth0 an ip address of 10.201.8.1 is configured, should the openvpn server run on this subnet and also assign the client ip address in the same subnet?
Incase it can run on a different subnet from the local subnet on eth0 what would be the changes in configuration that I will have to make?
Thanks,
Lalitha.M
Mimiko
If OpenVPN is configured as a bridge, than config must contain same network address as the local interface. To use different network address, you have to switch to routed mode.
mlalitha
Hi,
I am having some difficulty in understanding the difference between the server side and client side configuration.
In the client side, I see only a tap interface created. This tap interface has the ipaddress configured by the openvpn server.
1) In the client side, if all the packets that are destined to the same subnet as that of tap0 go through tap0, does open VPN take care of putting it on eth0 after encryption?
tap0
|
openvpn client
|
eth0
2) Why cannot the same configuraton work on the server side?
Can't the openvpn server listen on eth0. Is it not enough if both tap 0 and eth0 are in promiscous mode and do away with the bridge? I think I am missing out something in my understanding. Can you please clarify?
tap 0
|
openvpn
|
eth0
Thanks,
Lalitha.M
Mimiko
Transfering packets from tap to eth is done by the system, as both interface are join toghether in a bridge. The OpenVPN throws decrypted packets to tap interface.
Same bridge configuration may be made on server side too. See the manuals.
mlalitha
Hi,
When a packet is received on eth0 will get pushed to tap0 and will openvpn read from tap0, decrypt the packet and put it back in tap0?
Thanks,
Lalitha.M
Mimiko
No, the packet will be sent encrypted to the client.
