Cannot ping/connect across bridged vpn (tap device)

radualexandrupopescu

Hi. I setup a bridged vpn by mostly following this tutorial due to the fact that it was written for the same OS I am using.
But so far I can't figure out how to make it work: although I can connect, I can't ping anything besides my received IP.

Here I posted all the configs and ifconfig and routes: http://pastie.org/3603397

Thank you in advance for any suggestion.

maikcat

can you post the output of

brctl show
iptables -L -v
iptables -L -t nat -v

did you enable ip forwarding on server?

Michael.

radualexandrupopescu

brctl show

bridge name     bridge id               STP enabled     interfaces
br0             8000.0800275dd4ab       no              p2p1
                                                        tap0

I disabled iptables for testing purposes so output is empty:
iptables -L -v

Chain INPUT (policy ACCEPT 36986 packets, 18M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 36557 packets, 8694K bytes)
 pkts bytes target     prot opt in     out     source               destination

iptables -L -t nat -v

Chain PREROUTING (policy ACCEPT 1 packets, 28 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 1 packets, 28 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 3 packets, 617 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 3 packets, 617 bytes)
 pkts bytes target     prot opt in     out     source               destination

If it has any relevance, I don't really need to bridge the tap to an eth but I do need the VPN to behave like a layer 2 network since I may need IPX or other old protocol that do not go well with tun type VPNs.

janjust

is IP forwarding enabled ?
(on linux check using 'cat /proc/sys/net/ipv4/ip_forward')

radualexandrupopescu

cat /proc/sys/net/ipv4/ip_forward

But even if I enable it, it still does not work.

[root@localhost server]# cat /proc/sys/net/ipv4/ip_forward
0
[root@localhost server]# echo 1 > /proc/sys/net/ipv4/ip_forward
[root@localhost server]# cat /proc/sys/net/ipv4/ip_forward
1

janjust

without the IP forward you almost certainly could not ping 'across' the bridge.
Run 'tcpdump -nnel -i br0 icmp' on the bridge and then try to ping a host across it - what does the dump show?

radualexandrupopescu

Empty dump. So I guess no packets get routed from client...
Might it have something to do with my network setup?
Both the server and client are virtual PCs (VirtualBox): the server is bridged to my host LAN device and the client is NAT-ed (but somehow I can connect from it to my LAN IP).

                                +-------------> Other LAN PCs
                                |
Internet <==========> Router <--+
            (192.168.1.1/24)    |
                                +---+> My Workstation <---> Client (NATed)
                                    | (192.168.1.2/24)      (10.0.2.15/24)
                                    |
                                    +> Server (Bridged)
                                       (192.168.1.200/24)

Also, although I can connect to the sever after a while I guess I disconnect and then fail to automatically reconnect.
But if I manually reconnect, it works fine (sometime I need to reconnect 1-2 times before it works but it works). This is the client log. Also, line 305 is "interesting".

janjust

Also, line 305 is "interesting".

that needs to be fixed before it will ever work ... there's no real need to NAT the 10.0 clients when connecting to the VPN server, is there?

also, check whether VirtualBox has any issues when bridging adapters - some vms don't like to put ethN in promisc mode , which is required for bridging

radualexandrupopescu

Well I had to NAT the test client because I needed it to get a different IP (10.0.2.15) than the LAN I have.
Otherwise I would have on the test pc eth0 (or whatever windows names it) with an 192.168.1.10/24 IP and the VPN would give him an 192.168.1.50/24 IP. And I would be stuck with the same problem.
I tried a different approach: setting the OpenVPN server IP to 10.190.239.254 and adding a second IP to the internal interface of the router (the one that at the moment is 192.168.1.1) and then DMZ that IP but seems that DMZ/static port forward is nonfunctional on my router (upnp however seems to work).
The only other option I see at the moment is to remove eth0 from the br0 on the server and set br0 IP to 10.x.y.z and see if I can get it to work by testing with 2 virtual clients both bridged (both with 192.168.1.x IPs on eth0).

I don't think VirtualBox has issues with promis mode since I ran Wireshark on Windows both on eth0 and on tap0, and tcpdump on eth0, tap0 and the special "any" device on the server and in both cases I got output.

Can you think of any reason why the error on line 305 is there? I'm starting to think I might have missed something in my configs.

To definitively rule out VirtualBox issues I will try to make the server on another PC on the LAN (a physical one) using only the tap0 device in the bridge and with a 10.x.y.z ip to see if it is working.

janjust

your original network setup was fine (with the clients at 10.0.2.x) except for the NATting bit.
In order to make it work you'd have to

set up forwarding on your Workstation
add a routing rule on the server to state that all packets coming from 10.0.2.x need to go back to the workstation , and not to your local router/gateway

that way, the 10.0.2.x client should be able to ping the server without any NATting. Once you've achieved that , try connecting again using OpenVPN.

radualexandrupopescu

If I understood correctly what you have suggested I don't think I can do that. VirtualBox does not seem to have that configuration flexibility over the NAT setup or I just don't know how to get to those settings.
Therefore in order to bypass any issues VirtualBox might induce, I rebuild the setup using a LiveCD of Fedora 16 and some minor modification (like only adding tap0 to br0 and adding "client-to-client" to the server.conf - a real surprise for me). The result: it works like a charm.

Thank you again for your support.