Client's TAP interface getting two IPs!!!!!

aalshalan

Hi
I configured an OpenVPN server to work on a bridge-mode. In the configuration file I have this:
server-bridge 10.0.0.5 255.255.0.0 10.0.101.1 10.0.254.254

The VPN client is able to connect and get an IP from the OpenVPN server and get the IP 10.0.101.1 . However, we have a DHCP server in the internal network which also gives the TAP interface another IP 10.0.1.55. When I stop the DHCP server and reconnect to the VPN everything works fine, and the TAP interface will have one IP 10.0.101.1. How do I stop the TAP interface from getting an IP from the DHCP server? Notice I don't want to configure OpenVPN to get the IP addresses from the DHCP server.

Here's what the tap interface look like when running ifconfig:

tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether ea:f7:29:17:58:51
inet 10.0.101.1 netmask 0xffff0000 broadcast 10.0.255.255
inet 10.0.1.55 netmask 0xffff0000 broadcast 10.0.255.255

janjust

you could use an iptables/ipfw rule on the VPN server to block DHCP messages from traversing the VPN ...

the question is whether you really need a bridge in the first place - this is exactly what a bridged setup is supposed to do.

aalshalan

Thanks Jan Just. I'll try that and see if it works.
I'm barely new to OpenVPN and I don't quite understand the major difference between using tun or tap or between bridging and routing. My understanding is that with bridging the connected clients will get internal IPs as if they were part of the internal network whereas in the routing the VPN gateway will act as a proxy for these clients to reach the internal resources!!!

Did I understand it right?

BTW I just bought your book from amazon so I hope it will help giving me a better understanding of how OpenVPN works.

aalshalan

I read Chapter 2 and 3 of your book and now I have a good idea of how TAP and TUN are different and how bridging and routing differ.
In my case, I'm not sure if we are gonna be needing an all-IP network or if ethernet traffic is needed too. I'll have to consult with my client, but now I'll be able to make an educated decision.
Thanks JJ!