TAP with LAN DHCP

brendan

i have tried again and again to get TAP working with DHCP from the LAN, but continue to fail. i have found conflicting suggestions about the use of the "server" directive in the conf file, and have tried a lot of different ways to configure things. maybe someone can help.

i want tap config to work so that i manage IPs centrally via DHCP. additionally, i have DDNS updates done from DHCP and A/PTR records are updated accordingly. i want this functionality from the SSL VPN subnet.

my version:
OpenVPN 2.2.1 x86_64-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Sep 9 2011
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

$ ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --enable-pthread --enable-password-save --enable-iproute2 --with-ifconfig-path=/sbin/ifconfig --with-iproute-path=/sbin/ip --with-route-path=/sbin/route

Compile time defines: ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PKCS11 USE_SSL

server config:
mode server
tls-server
port 1194
proto udp
dev tap0
ca ca.crt
cert vpn.crt
key vpn.key
dh dh2048.pem
cipher AES-256-CBC
topology subnet
# server
# server-bridge
server-bridge nogw
# server-bridge 192.168.50.254 255.255.255.0 192.168.50.50 192.168.50.99
# ifconfig-pool-persist ipp.txt
# push "redirect-gateway def1"
# push "dhcp-option DNS 192.168.50.1"
# push "dhcp-option DNS 192.168.25.1"
# push "dhcp-option WINS 192.168.25.1"
route-gateway dhcp
keepalive 10 120
comp-lzo
user nobody
group nobody
ping-timer-rem
persist-tun
persist-key
verb 4
mute 20

using any of the server/server-bridge directives shown in the config, i can establish a tunnel, but no DHCP address is given out. in fact, no traffic on ports 67 or 68 is seen leaving the VPN server. if a OpenVPN-assigned IP is given, i have no DDNS update done and cannot look up the host via name or ip records. if a OpenVPN-assigned IP is not given, no IP is given at all and i see a message similar to this in my logs:
MULTI: no dynamic or static remote --ifconfig address is available for host/ip.add.re.ss:1194

what do i continue to miss, in order to configure TAP with LAN side DHCP?

Mimiko

Please post the logs from OpenVPN server and client which want to connect. Also tap0 is not the bridge itself. You must configure your networking to make a bridge between eth0 and tap0 on system start-up.

brendan

i do have the tap bridged with the "physical" interface on startup. i have this TapUp.sh script called within the conf file:

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="p1p1 p1p3 bond0 bond0.50 tap0"
eth_ip="192.168.50.1"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.50.255"

for t in $tap; do
    /usr/sbin/openvpn --mktun --dev $t
done

for t in $tap; do
    /usr/sbin/brctl addif $br $t
done

for t in $tap; do
    /sbin/ifconfig $t 0.0.0.0 promisc up
done

for e in $eth; do
	/sbin/ifconfig $e 0.0.0.0 promisc up
done

/sbin/ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

i know my networking is a bit crazy. can you tell me if bonding and vlans are an issue? As for logs, here you go...
Server:

[root@vpn openvpn]# /usr/sbin/openvpn --writepid /var/run/openvpn/vpn.pid --cd /etc/openvpn/ --config vpn.conf
Tue Oct  2 14:50:52 2012 us=398625 Current Parameter Settings:
Tue Oct  2 14:50:52 2012 us=398832   config = 'vpn.conf'
Tue Oct  2 14:50:52 2012 us=398859   mode = 1
Tue Oct  2 14:50:52 2012 us=398882   persist_config = DISABLED
Tue Oct  2 14:50:52 2012 us=398909   persist_mode = 1
Tue Oct  2 14:50:52 2012 us=398930   show_ciphers = DISABLED
Tue Oct  2 14:50:52 2012 us=398950   show_digests = DISABLED
Tue Oct  2 14:50:52 2012 us=398970   show_engines = DISABLED
Tue Oct  2 14:50:52 2012 us=398989   genkey = DISABLED
Tue Oct  2 14:50:52 2012 us=399009   key_pass_file = '[UNDEF]'
Tue Oct  2 14:50:52 2012 us=399029   show_tls_ciphers = DISABLED
Tue Oct  2 14:50:52 2012 us=399051 Connection profiles [default]:
Tue Oct  2 14:50:52 2012 us=399073   proto = udp
Tue Oct  2 14:50:52 2012 us=399093   local = 'vpn.bpk2.com'
Tue Oct  2 14:50:52 2012 us=399114   local_port = 1194
Tue Oct  2 14:50:52 2012 us=399134   remote = '[UNDEF]'
Tue Oct  2 14:50:52 2012 us=399154   remote_port = 1194
Tue Oct  2 14:50:52 2012 us=399173   remote_float = DISABLED
Tue Oct  2 14:50:52 2012 us=399193   bind_defined = DISABLED
Tue Oct  2 14:50:52 2012 us=399212   bind_local = ENABLED
Tue Oct  2 14:50:52 2012 us=399232 NOTE: --mute triggered...
Tue Oct  2 14:50:52 2012 us=399266 247 variation(s) on previous 20 message(s) suppressed by --mute
Tue Oct  2 14:50:52 2012 us=399289 OpenVPN 2.2.1 x86_64-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Sep  9 2011
Tue Oct  2 14:50:52 2012 us=399438 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Tue Oct  2 14:50:52 2012 us=399605 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Oct  2 14:50:52 2012 us=420051 Diffie-Hellman initialized with 2048 bit key
Tue Oct  2 14:50:52 2012 us=421135 TLS-Auth MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct  2 14:50:52 2012 us=421205 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Oct  2 14:50:52 2012 us=422950 TUN/TAP device tap0 opened
Tue Oct  2 14:50:52 2012 us=423031 TUN/TAP TX queue length set to 100
Tue Oct  2 14:50:52 2012 us=423143 TapUp.sh tap0 1500 1590   init
Tue Oct  2 14:50:52 2012 Note: Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
Tue Oct  2 14:50:52 2012 Cannot ioctl TUNSETPERSIST(1) tap0: File descriptor in bad state (errno=77)
Tue Oct  2 14:50:52 2012 Exiting
Tue Oct  2 14:50:52 2012 us=451136 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Oct  2 14:50:52 2012 us=451470 GID set to nobody
Tue Oct  2 14:50:52 2012 us=451526 UID set to nobody
Tue Oct  2 14:50:52 2012 us=451567 UDPv4 link local (bound): 192.168.50.1:1194
Tue Oct  2 14:50:52 2012 us=451591 UDPv4 link remote: [undef]
Tue Oct  2 14:50:52 2012 us=451623 MULTI: multi_init called, r=256 v=256
Tue Oct  2 14:50:52 2012 us=451755 Initialization Sequence Completed
Tue Oct  2 14:50:52 2012 us=470383 MULTI: multi_create_instance called
Tue Oct  2 14:50:52 2012 us=470491 my.ip.addr.ess:1194 Re-using SSL/TLS context
Tue Oct  2 14:50:52 2012 us=470542 my.ip.addr.ess:1194 LZO compression initialized
Tue Oct  2 14:50:52 2012 us=470780 my.ip.addr.ess:1194 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct  2 14:50:52 2012 us=470808 my.ip.addr.ess:1194 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Oct  2 14:50:52 2012 us=470851 my.ip.addr.ess:1194 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Tue Oct  2 14:50:52 2012 us=470870 my.ip.addr.ess:1194 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Tue Oct  2 14:50:52 2012 us=470909 my.ip.addr.ess:1194 Local Options hash (VER=V4): '1a6d5c5d'
Tue Oct  2 14:50:52 2012 us=470938 my.ip.addr.ess:1194 Expected Remote Options hash (VER=V4): 'c6c7c21a'
Tue Oct  2 14:50:52 2012 us=471010 my.ip.addr.ess:1194 TLS: Initial packet from my.ip.addr.ess:1194, sid=721e52d0 6775e980
Tue Oct  2 14:50:56 2012 us=723051 my.ip.addr.ess:1194 VERIFY OK: depth=1, /C=../ST=../L=../O=../CN=../emailAddress=root@bpk2.com
Tue Oct  2 14:50:56 2012 us=723619 my.ip.addr.ess:1194 VERIFY OK: depth=0, /C=../ST=../L=../O=../CN=../emailAddress=root@bpk2.com
Tue Oct  2 14:50:57 2012 us=108803 my.ip.addr.ess:1194 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Oct  2 14:50:57 2012 us=108904 my.ip.addr.ess:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  2 14:50:57 2012 us=109011 my.ip.addr.ess:1194 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Oct  2 14:50:57 2012 us=109054 my.ip.addr.ess:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  2 14:50:57 2012 us=245873 my.ip.addr.ess:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Oct  2 14:50:57 2012 us=246017 my.ip.addr.ess:1194 [inspire] Peer Connection Initiated with my.ip.addr.ess:1194
Tue Oct  2 14:50:57 2012 us=246147 inspire/my.ip.addr.ess:1194 MULTI: no dynamic or static remote --ifconfig address is available for inspire/my.ip.addr.ess:1194
Tue Oct  2 14:50:58 2012 us=288316 inspire/my.ip.addr.ess:1194 PUSH: Received control message: 'PUSH_REQUEST'
Tue Oct  2 14:50:58 2012 us=288476 inspire/my.ip.addr.ess:1194 SENT CONTROL [inspire]: 'PUSH_REPLY,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120' (status=1)
Tue Oct  2 14:51:05 2012 us=197739 inspire/my.ip.addr.ess:1194 SIGTERM[soft,remote-exit] received, client-instance exiting

Client:

Tue Oct  2 14:50:31 2012 OpenVPN 2.1_rc15 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Jan 21 2010
Tue Oct  2 14:50:31 2012 MANAGEMENT: TCP Socket listening on 127.0.0.1:19251
Tue Oct  2 14:50:31 2012 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Oct  2 14:50:31 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Oct  2 14:50:31 2012 WARNING: file 'inspire.key' is group or others accessible
Tue Oct  2 14:50:31 2012 LZO compression initialized
Tue Oct  2 14:50:31 2012 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct  2 14:50:34 2012 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Oct  2 14:50:34 2012 Local Options hash (VER=V4): 'c6c7c21a'
Tue Oct  2 14:50:34 2012 Expected Remote Options hash (VER=V4): '1a6d5c5d'
Tue Oct  2 14:50:34 2012 Socket Buffers: R=[110592->131072] S=[110592->131072]
Tue Oct  2 14:50:34 2012 UDPv4 link local (bound): [undef]:1194
Tue Oct  2 14:50:34 2012 UDPv4 link remote: my.ip.addr.ess:1194
Tue Oct  2 14:50:34 2012 MANAGEMENT: Client connected from 127.0.0.1:19251
Tue Oct  2 14:50:34 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:36 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:39 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:40 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:42 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:45 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:46 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:48 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:51 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Oct  2 14:50:52 2012 MANAGEMENT: >STATE:1349203852,AUTH,,,
Tue Oct  2 14:50:52 2012 TLS: Initial packet from my.ip.addr.ess:1194, sid=2edf239e 23f211f3
Tue Oct  2 14:50:55 2012 VERIFY OK: depth=1, /C=../ST=../L=../O=../CN=../emailAddress=root@bpk2.com
Tue Oct  2 14:50:55 2012 Validating certificate key usage
Tue Oct  2 14:50:55 2012 ++ Certificate has key usage  00a0, expects 00a0
Tue Oct  2 14:50:55 2012 VERIFY KU OK
Tue Oct  2 14:50:55 2012 Validating certificate extended key usage
Tue Oct  2 14:50:55 2012 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Oct  2 14:50:55 2012 VERIFY EKU OK
Tue Oct  2 14:50:55 2012 VERIFY OK: depth=0, /C=../ST=../L=../O=../CN=../emailAddress=root@bpk2.com
Tue Oct  2 14:50:57 2012 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Oct  2 14:50:57 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  2 14:50:57 2012 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Oct  2 14:50:57 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  2 14:50:57 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Oct  2 14:50:57 2012 [vpn] Peer Connection Initiated with my.ip.addr.ess:1194
Tue Oct  2 14:50:58 2012 MANAGEMENT: >STATE:1349203858,GET_CONFIG,,,
Tue Oct  2 14:50:58 2012 SENT CONTROL [vpn]: 'PUSH_REQUEST' (status=1)
Tue Oct  2 14:50:58 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120'
Tue Oct  2 14:50:58 2012 OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct  2 14:50:58 2012 OPTIONS IMPORT: route options modified
Tue Oct  2 14:50:58 2012 OPTIONS IMPORT: route-related options modified
Tue Oct  2 14:50:58 2012 ROUTE default_gateway=10.65.16.2
Tue Oct  2 14:50:58 2012 TUN/TAP device tap0 opened
Tue Oct  2 14:50:58 2012 TUN/TAP TX queue length set to 100
Tue Oct  2 14:50:58 2012 NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing
Tue Oct  2 14:50:58 2012 Initialization Sequence Completed
Tue Oct  2 14:50:58 2012 MANAGEMENT: >STATE:1349203858,CONNECTED,SUCCESS,,my.ip.addr.ess
Tue Oct  2 14:51:04 2012 SIGTERM received, sending exit notification to peer
Tue Oct  2 14:51:06 2012 TCP/UDP: Closing socket
Tue Oct  2 14:51:06 2012 Closing TUN/TAP interface
Tue Oct  2 14:51:06 2012 SIGTERM[soft,exit-with-notification] received, process exiting
Tue Oct  2 14:51:06 2012 MANAGEMENT: >STATE:1349203866,EXITING,exit-with-notification,,

Mimiko

Into you script you do not add the phisical interfaces to bridge. Add this:

for t in $eth; do
    /usr/sbin/brctl addif $br $t
done

dropje

There could be one major problem wanting a setup like this.. When serving out DHCP leases you must differentiate local clients with VPN clients. The reason for this is that you can not pass the same gateway to the VPN clients as the local clients. I know for sure this not possible on a Windows DHCP server as you must look at the MAC addresses before serving out a separate pool.

Read more about this subject and a possible solution here:

http://openvpn.net/index.php/open-source/documentation/install.html?start=1

Scroll down to "Notes -- Setting TAP-Win32 address/subnet automatically via DHCP"

brendan

i am managing the bridge interface via ifcfg-* scripts on Fedora. the bond0.50 interface is added to the bridge at boot, and the bridge already has the ip address assigned to it. on start up of the openvpn daemon, all thats needed is handled in the TapUp.sh script.

as for DHCP, i am using the ISC version running on Fedora as well. i have a specific subnet declaration for the VPN clients, and a note in the config that the "option routers" directive is not to be used. the box running the VPN daemon is one of two load sharing DHCP servers, and neither is getting any requests for DHCP.

Mimiko

brendan,

i have this TapUp.sh script called within the conf file

I don't see any calling to this file from the config file. Also:

Tue Oct 2 14:50:52 2012 us=423143 TapUp.sh tap0 1500 1590 init
Tue Oct 2 14:50:52 2012 Note: Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
Tue Oct 2 14:50:52 2012 Cannot ioctl TUNSETPERSIST(1) tap0: File descriptor in bad state (errno=77)

As you can see from this errors, the script can't make the bridge, as the tap device is taken by openvpn before, or so it is. That's why, you have to make the bridge at system start-up, not using the OpenVPN. When starting OpenVPN the bridge already must exists.

brendan

i have continued to go through several iterations of config files. the current is:

mode server
tls-server
local vpn.bpk2.com
port 1194
proto udp
dev tap0 mktun
script-security 2
up TapUp.sh
#down TapDown.sh
ca ca.crt
cert vpn.crt
key vpn.key
dh dh2048.pem
cipher AES-256-CBC
# server
# server-bridge
# server-bridge nogw
server-bridge 192.168.50.254 255.255.255.0 192.168.50.50 192.168.50.99
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.50.1"
push "dhcp-option DNS 192.168.25.1"
push "dhcp-option WINS 192.168.25.1"
# route-gateway dhcp
passtos
keepalive 10 120
comp-lzo
user nobody
group nobody
ping-timer-rem
persist-tun
persist-key
verb 4
mute 20

the errors you cite do not indicate that the bridge could not be made. rather, it indicates that the tap interface could not be added to the bridge because it was already a part of the bridge. this is proven because the tap interface was available to the accept the connection attempt.

Mimiko

Remove mode server from your option, as you use server-bridge. Post log from server and client with this new configuration.