lacoursj
Hi,
Struggling to get an ethernet bridge mode tunnel operating between two Ubuntu (natty) machines. Server has tap0 created and bridged to br0:
root@astnorth:/etc/openvpn/keys# ifconfig tap0
tap0 Link encap:Ethernet HWaddr 06:f4:2e:6a:ae:34
inet addr:10.222.222.1 Bcast:10.222.222.255 Mask:255.255.255.0
inet6 addr: fe80::4f4:2eff:fe6a:ae34/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1500 errors:0 dropped:0 overruns:0 frame:0
TX packets:304 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:105141 (105.1 KB) TX bytes:46365 (46.3 KB)
root@astnorth:/etc/openvpn/keys# brctl show br0
bridge name bridge id STP enabled interfaces
br0 8000.00259037502c no eth0
tap0
Client ("phone") connects without any obvious errors, and gets sent 10.222.222.3 as expected (excerpt from /var/log/syslog on server):
Apr 23 21:40:51 astnorth ovpn-server[11848]: phone/X.X.X.X:50613 SENT CONTROL [phone]: 'PUSH_REPLY,route-gateway 10.222.222.1,ping 10,ping-restart 120,ifconfig 10.222.222.3 255.255.255.0' (status=1)
If I ping from the server to the client and watch with "tcpdump -nlei tap0" I get:
root@astnorth:/etc/openvpn/keys# tcpdump -nlei tap0
22:07:57.490383 06:f4:2e:6a:ae:34 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 10.222.222.3 tell 10.222.222.1, length 28
22:07:57.506924 62:68:bf:c8:f6:e4 > 06:f4:2e:6a:ae:34, ethertype ARP (0x0806), length 42: Reply 10.222.222.3 is-at 62:68:bf:c8:f6:e4, length 28
22:07:58.490391 06:f4:2e:6a:ae:34 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 10.222.222.3 tell 10.222.222.1, length 28
22:07:58.505591 62:68:bf:c8:f6:e4 > 06:f4:2e:6a:ae:34, ethertype ARP (0x0806), length 42: Reply 10.222.222.3 is-at 62:68:bf:c8:f6:e4, length 28
So the client seems to get the ARP request fine and answers, but the server ignores the answer.
If I ping from the client to the server and watch with "tcpdump -nlei tap0" on the server:
root@astnorth:/etc/openvpn/keys# tcpdump -nlei tap0
22:10:28.127814 62:68:bf:c8:f6:e4 > 06:f4:2e:6a:ae:34, ethertype IPv4 (0x0800), length 98: 10.222.222.3 > 10.222.222.1: ICMP echo request, id 3513, seq 5, length 64
22:10:28.700387 06:f4:2e:6a:ae:34 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 10.222.222.3 tell 10.222.222.1, length 28
22:10:28.715792 62:68:bf:c8:f6:e4 > 06:f4:2e:6a:ae:34, ethertype ARP (0x0806), length 42: Reply 10.222.222.3 is-at 62:68:bf:c8:f6:e4, length 28
22:10:29.128800 62:68:bf:c8:f6:e4 > 06:f4:2e:6a:ae:34, ethertype IPv4 (0x0800), length 98: 10.222.222.3 > 10.222.222.1: ICMP echo request, id 3513, seq 6, length 64
22:10:29.700477 06:f4:2e:6a:ae:34 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 10.222.222.3 tell 10.222.222.1, length 28
22:10:29.716303 62:68:bf:c8:f6:e4 > 06:f4:2e:6a:ae:34, ethertype ARP (0x0806), length 42: Reply 10.222.222.3 is-at 62:68:bf:c8:f6:e4, length 28
The client seems to know the server MAC already and sends the ICMP, but the server still doesn't know the MAC of the client, and ARPs. Again the client responds and the server ignores the ARP reply.
This sure seems like some kind of firewall problem, and I attempted various iptables configs to solve (on the server):
$IPTABLES -A INPUT -i tap0 -j ACCEPT
$IPTABLES -A INPUT -i br0 -j ACCEPT
$IPTABLES -A FORWARD -i tap0 -j ACCEPT
$IPTABLES -A FORWARD -i br0 -j ACCEPT
These rules were active in the above tests.
I even enabled ipforwarding in the kernel, though I don't see why that would be relevant. It didn't have any effect.
Kind of stumped. Any ideas?
Thanks!
Jeff LaCoursiere
SunFone
lacoursj
Thanks for the tip. I set promisc on both
root@astnorth:~# ifconfig tap0
tap0 Link encap:Ethernet HWaddr 06:f4:2e:6a:ae:34
inet addr:10.222.222.1 Bcast:10.222.222.255 Mask:255.255.255.0
inet6 addr: fe80::4f4:2eff:fe6a:ae34/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:28516 errors:0 dropped:0 overruns:0 frame:0
TX packets:12573 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:4703020 (4.7 MB) TX bytes:2773121 (2.7 MB)
root@astnorth:~# ifconfig eth0
eth0 Link encap:Ethernet HWaddr 00:25:90:37:50:2c
inet6 addr: fe80::225:90ff:fe37:502c/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:447132871 errors:0 dropped:0 overruns:0 frame:0
TX packets:445917958 errors:7983411 dropped:0 overruns:0 carrier:7983411
collisions:10497747 txqueuelen:1000
RX bytes:105091810693 (105.0 GB) TX bytes:109820334747 (109.8 GB)
Interrupt:16 Memory:fb5e0000-fb600000
But the problem remains. I have some additional information, however.
The same server runs a number of LXC containers (this is actually the end object - to get the remote host access to the containers) that have their eth0 bridged to the host's br0/eth0, and if I set an address on eth0 within the container that is in the 10.222.222.0/24 subnet, the remote machine can access it just fine. This actually is 90% of what I am trying to accomplish, but I do still need, unfortunately, the remote machine to access the host on 10.222.222.1.
Thanks for any more clues!
