Hello guys I'm stuck with a problem on my openvpn server : First, I'm French, so sorry for my bad English. Here is my network schema : [img]https://webmail.etp-w.be/openvpn_air.png[/img] So there is a program on my local network which need to gather data on different stations. The stations are running on adsl connection with dynamic ip. I have created a Gentoo box on our VMware to run openvpn. My vmware VMnet is configured to accept promiscuous mode. Openvpn is configured in bridge mode, promiscuous is configured on eth0 and tap1. [b]So now for my problem : When i try to access from a station to my redhat server, there is an arp problem : with wireshark i have seen than arp replies vanish between my br0 and tap0 interface So station ARP request -> Openvpn -> Server : ok Server reply -> Openvpn -> Station : lost on openvpn box If I try to ping from station to server it fail usually When the server contact the different stations, it randomly fail ( sometimes the station learn the mac adress ) When i put a static arp entry on the station it run great.[/b] I have tried a lot of things : rp_filter, arp_proxy, ... and found nothing on google If someone could help me it would be so great. Here is my ifconfig and brctl show br0, i can provide client and server config of openvpn if needed but i think it don't come from it. [code] br0 Link encap:Ethernet HWaddr 00:50:56:8e:00:06 inet addr:172.16.135.34 Bcast:172.16.192.255 Mask:255.255.192.0 inet6 addr: fe80::250:56ff:fe8e:6/64 Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:9584182 errors:0 dropped:115306 overruns:0 frame:0 TX packets:25524802 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:4086431868 (3.8 GiB) TX bytes:5814151952 (5.4 GiB) eth0 Link encap:Ethernet HWaddr 00:50:56:8e:00:06 inet6 addr: fe80::250:56ff:fe8e:6/64 Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:10387199 errors:1062 dropped:3928 overruns:0 frame:0 TX packets:25791826 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:441814149 (421.3 MiB) TX bytes:1608364341 (1.4 GiB) Interrupt:18 Base address:0x2000 tap1 Link encap:Ethernet HWaddr 0a:9d:0e:da:6d:d4 inet6 addr: fe80::89d:eff:feda:6dd4/64 Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:193405 errors:0 dropped:0 overruns:0 frame:0 TX packets:1921898 errors:0 dropped:1104 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:71787935 (68.4 MiB) TX bytes:189792616 (181.0 MiB) bridge name bridge id STP enabled interfaces br0 8000.0050568e0006 no eth0 tap1 [/code] Thanks for your attention Thomas Tribolet

Bridge Openvpn, arp problem

tribestom

Hello guys

I'm stuck with a problem on my openvpn server :

First, I'm French, so sorry for my bad English.

Here is my network schema :

So there is a program on my local network which need to gather data on different stations.

The stations are running on adsl connection with dynamic ip.

I have created a Gentoo box on our VMware to run openvpn. My vmware VMnet is configured to accept promiscuous mode.

Openvpn is configured in bridge mode, promiscuous is configured on eth0 and tap1.

So now for my problem :

When i try to access from a station to my redhat server, there is an arp problem :
with wireshark i have seen than arp replies vanish between my br0 and tap0 interface

So station ARP request -> Openvpn -> Server : ok
Server reply -> Openvpn -> Station : lost on openvpn box

If I try to ping from station to server it fail usually
When the server contact the different stations, it randomly fail ( sometimes the station learn the mac adress )
When i put a static arp entry on the station it run great.

I have tried a lot of things : rp_filter, arp_proxy, ...
and found nothing on google

If someone could help me it would be so great.

Here is my ifconfig and brctl show br0, i can provide client and server config of openvpn if needed but i think it don't come from it.

br0       Link encap:Ethernet  HWaddr 00:50:56:8e:00:06
          inet addr:172.16.135.34  Bcast:172.16.192.255  Mask:255.255.192.0
          inet6 addr: fe80::250:56ff:fe8e:6/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:9584182 errors:0 dropped:115306 overruns:0 frame:0
          TX packets:25524802 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:4086431868 (3.8 GiB)  TX bytes:5814151952 (5.4 GiB)

eth0      Link encap:Ethernet  HWaddr 00:50:56:8e:00:06
          inet6 addr: fe80::250:56ff:fe8e:6/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:10387199 errors:1062 dropped:3928 overruns:0 frame:0
          TX packets:25791826 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:441814149 (421.3 MiB)  TX bytes:1608364341 (1.4 GiB)
          Interrupt:18 Base address:0x2000

tap1      Link encap:Ethernet  HWaddr 0a:9d:0e:da:6d:d4
          inet6 addr: fe80::89d:eff:feda:6dd4/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:193405 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1921898 errors:0 dropped:1104 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:71787935 (68.4 MiB)  TX bytes:189792616 (181.0 MiB)

bridge name     bridge id               STP enabled     interfaces
br0             8000.0050568e0006       no              eth0
                                                        tap1

Thanks for your attention

Thomas Tribolet

maikcat

hi there,

can you post server config?
did you enable ip forwarding on openvpn server?

Michael.

tribestom

Hi

I didn't see my post was moved here.

ip_forward is up

controle ~ # sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

Here is my config :

Server :

port 1194
proto udp
dev tap1
mode server
ca keys/ca.crt
cert keys/VPN.crt
key keys/VPN.key  # This file should be kept secret
dh keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 172.16.135.34 255.255.192.0 172.16.140.10 172.16.140.50
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status-udp.log
verb 3
script-security 2
up /etc/openvpn/openvpn-up.sh
down /etc/openvpn/openvpn-down.sh
keepalive 10 120

Clients :

client
dev tap
proto udp
remote vpn.******.be 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca keys/ca.crt
cert keys/Liege-airport.crt
key keys/Liege-airport.key
comp-lzo
verb 3
keepalive 10 120

I'have tested ping from stations to my network it usually fail. And run good when i put static arp entries.

Thanks for your help.

maikcat

which vmware are you using?

Michael.

tribestom

I'm using VMWare ESXi 5.0.0

I have activated promiscuous mode on VSwitch configuration

On wireshark capture, i see arp replies on br0 coming from my the server but i don't see them on my tap1. interface.

tribestom

Anyone on this ?

I'm still stuck on this problem.

If someone know what can block/drop arp between a bridge interface and a tap one ?

demotest

try restarting the network service after the openvpn service has started.