Traffic problems concerning bridge-device

falk

Hi,

I'm new on openvpn. I try to establish a tunnel between a Ubuntu-server and a Client.
Everything works perfect. The client gets an IP and i can ping this IP from my openvpn-server. But I can't access the network behind the br0/tap0 device. If I start a trace on br0-device I can see a lot ARP-requests but I think these requests doesn't pass the ethernet interface. I have no idea whats the fault :-(
Hope someone can help me.

Here is my config:

port 1194
proto udp
dev tap0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/openvpn.crt
key /etc/openvpn/keys/openvpn.key
dh /etc/openvpn/keys/dh1024.pem
server-bridge 192.168.0.157 255.255.255.0 192.168.0.248 192.168.0.254
client-config-dir ccd
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3

Client-config:

client
dev tap
proto udp
remote *myvpnhost* 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /openvpn/ca.crt
cert /openvpn/client.crt
key /openvpn/client.key
ns-cert-type server
verb 0
ping 10
ping-restart 60

My bridge-device:

brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.00155d63b10f       no              eth0
                                                        tap0

All bridge-nf* files containing a "0" in /proc/sys/net/bridge/

Does anyone have a idea for me?
Thanks a lot
Falk

maikcat

hi there,

did you enable ip forwarding?
using ifconfig command can you check that both eth&tap are in promisc mode?

Michael.

falk

Hi Michael,

thanks for the hint.
All relevant interfaces in promisc mode now, but it doesn't work. I see a lot arp requests on my br0 and eth0 device, but no reply. :-(

Do you have further ideas?

Thank you.
Falk

maikcat

hi there,

did you enable ip forwarding?

also iptables are disabled?

192.168.0.157 whose ip is this?

Michael.

dropje

Bridged setup runs on Layer 2, can't be iptables. Are you running this VPN server on a Virtual Machine? If it's ESX you have to enable promiscuous mode on the concerning physical interface using the vmware client.

falk

Hi,

great hint with the promisc-mode on the hypervisor.
It's running now.

One last question: is it possible to run the startbridge.sh on openvpn startup? I tried the "up"-option but it doesn't run.

Thank you for the great support.
Falk

dropje

Don't know which OS you are running the server but try putting the script inside the init script. For example on Debian:

start_vpn () {
    if grep -q '^[	 ]*daemon' $CONFIG_DIR/$NAME.conf ; then
      # daemon already given in config file
      DAEMONARG=
    else
      # need to daemonize
      DAEMONARG="--daemon ovpn-$NAME"
    fi

    if grep -q '^[	 ]*status ' $CONFIG_DIR/$NAME.conf ; then
      # status file already given in config file
      STATUSARG=""
    elif test $STATUSREFRESH -eq 0 ; then
      # default status file disabled in /etc/default/openvpn
      STATUSARG=""
    else
      # prepare default status file
      STATUSARG="--status /var/run/openvpn.$NAME.status $STATUSREFRESH"
    fi

    log_progress_msg "$NAME"
    STATUS=0

    /etc/openvpn/bridge.sh start 
    start-stop-daemon --start --quiet --oknodo \
        --pidfile /var/run/openvpn.$NAME.pid \
        --exec $DAEMON -- $OPTARGS --writepid /var/run/openvpn.$NAME.pid \
        $DAEMONARG $STATUSARG --cd $CONFIG_DIR \
        --config $CONFIG_DIR/$NAME.conf || STATUS=1
}
stop_vpn () {
  kill `cat $PIDFILE` || true
  rm -f $PIDFILE
  rm -f /var/run/openvpn.$NAME.status 2> /dev/null
  /etc/openvpn/bridge.sh stop 
}

dropje

And my custom bridge.sh script:

#!/bin/bash
#
# Description: Setup bridge and TAP device for bridged OpenVPN
#

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

tun_action() {
    for t in $tap; do
      openvpn $1 --dev $t &>/dev/null
    done
}

bridge_setup() {
    for t in $tap; do
      brctl $1 $br $t &>/dev/null
    done
}

link_up() {
    for t in $tap; do
      ifconfig $t 0.0.0.0 promisc up
    done
}

case "$1" in
    start)
        tun_action --mktun
	bridge_setup addif
	link_up
	;;
    stop)
	bridge_setup delif
        tun_action --rmtun
	;;
    *)
        echo "Usage: $0 {start|stop}"
	exit 1
	;;
esac

falk

Hi,

thank you for your reply. I'm sorry for my delay.
I had the same idea to add this command into the init-script. But it is still present after a software-upgrade?

Thank you
Falk