Working of openvpn in bridge mode

maruth

Hi,

When openvpn server works in the tap mode, the eth0 interface on which the server runs is put in promiscuous mode, a tap interface is also created in promiscuous mode and the virtual bridge is assigned a logical ip address(i.e the ip address same as the eth0 Interface).

I tried understanding the necessity for the creation of the bridge. I went through a lot of documents, but otherthan the literal meaning of the bridge, I could not get to read the necessity for the creation of the bridge in openvpn server mode.

1. When openvpn sends out a packet it reads from tap0 encrypts the packet and sends it out on eth0 if my understanding is correct. Similarly when it reads a packet it reads from eth0 decrypts and throws the decrypted packet in tap0. Then why is this bridge needed?

2. Why should the eth0 and tap0 be put in promiscuous mode. Anyway the openvpn server would receive only packets that are destined to the machine on which it runs. The packets would have the L2 address of the the eth0 interface. Then why is it needed to put both eth0 and tap interface in promiscous mode.

Can someone please clarify both of the above 2 questions.

Thanks,
Maruth

janjust

your analysis is mostly correct: in 'tap' mode there is no need to create a bridge; a lot of people get confused by this.
Bridged mode requires 'tap', not the other way round. Bridged mode also requires that the ethN and tapN interfaces are put into promiscuous mode. If you are interested only in passing non-IP packets (ethernet frames, really) over your VPN then there is absolutely no need to put ethN or tapN in promisc mode.
However, if you want to join two networks and/or if you want to pass broadcast traffic from the LAN to the VPN , then some sort of bridging is required.

maruth

Hi,

Thanks a lot for the quick response.

I did not get the meaning of joining two networks that you had mentioned below clearly.

1. I thought that in tap mode, openvpn server has to run on the same subnet as it local (eth0) interface. Please let me know if my understanding is correct.

2. If the machine on which the openvpn server and client are running are on 2 different networks, in the tap mode would'nt we specify the open client ip address to be in the same subnet as that of the openvpn server in the server configuration file? In this case I am not clear how we join 2 different networks when both the openvpn server and client are running in the same subnet?

Can you please clarify.

Thanks,
Maruth

janjust

1. I thought that in tap mode, openvpn server has to run on the same subnet as it local (eth0) interface. Please let me know if my understanding is correct.

nope this is not correct; 'tap' mode without bridging is nearly the same as 'tun' mode + topology subnet

2. If the machine on which the openvpn server and client are running are on 2 different networks, in the tap mode would'nt we specify the open client ip address to be in the same subnet as that of the openvpn server in the server configuration file? In this case I am not clear how we join 2 different networks when both the openvpn server and client are running in the same subnet?

the client is assigned an IP by the server using the statement

server 10.8.0.0 255.255.255.0

(just like in 'tun' mode).

Transparently joining two networks is trickier and requires bridging.