Basic office to office network

marius.cdm

Hello,

I have fallowed allmost every tutorial on the internet trying to link Server B to Server A from the fallowing diagram without success.

I want to create a bridge between the two offices so they can share resources such as SAMBA without interfering eatch other's NAT.

This is my OpenVPN configuration.

Server A:
openvpn.conf

dev tun
local 86.120.191.55
remote 81.12.159.162
ifconfig 192.168.99.1 192.168.99.2
route 192.168.0.0 255.255.255.0 192.168.99.2
client-to-client
tls-server
cipher AES-256-CBC
persist-tun
persist-key
ping 10
ping-restart 30
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
comp-lzo
verb 3

Server B:
openvpn.conf

dev tun
local 81.12.159.162
remote 86.120.191.55
ifconfig 192.168.99.2 192.168.99.1
route 192.168.0.0 255.255.255.0 192.168.99.1
client-to-client
tls-client
cipher AES-256-CBC
ping 10
ping-restart 30
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/client.crt
key /etc/openvpn/easy-rsa/2.0/keys/client.key
comp-lzo
verb 3

Eatch server acts as an indepentend internet gateway

echo 'Internet access'
$IPT -t nat -A POSTROUTING -o $EXTIF -s $LOCALNET -j SNAT --to-source $IPEXT
$IPT -A FORWARD -i $EXTIF -o $INTIF -m state --state RELATED,ESTABLISHED -j ACCEPT

#here we can set specific IP internet access
$IPT -A FORWARD -i $INTIF -s 0/0  -j ACCEPT
$IPT -A FORWARD -i $INTIF -j DROP

What I am dooing wrong?

maikcat

hi there,

if you want bridging mode then you MUST:

*use tap dev instead of tun

*use server-bridge directive on server

*bridge together eth&tap on server side

there is a tutorial about bridging on doc section...

Michael.

marius.cdm

*bridge together eth&tap on server side

eth0 or eth1?

Can you please paste the link?

maikcat

your lan interface (in case eth1 is your wan)

anyway...

http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

hope it helps

Michael.

marius.cdm

I have read so many tutorials and worked over 200 hours on this and i'm starting to give up any hope. 🙁

Help!

marius.cdm

Ok, i fallowed the tutorial and this is what i came up with.

Server A

dev tap0
port 1194
proto udp
server-bridge 192.168.8.4 255.255.255.0 192.168.8.128 192.168.8.254
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nobody
persist-key
persist-tun
verb 3
mute 20

bridge-start

#!/bin/sh

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.8.4"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.8.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

Server B:

client
dev tap0
proto udp
remote 192.168.202.128 1194
resolv-retry infinite
user nobody
group nobody
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
mute 20

bridge-start

#!/bin/sh

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.8.5"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.8.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

When i start openvpn on ServerB i'm getting an ip address on tap0

br0       Link encap:Ethernet  HWaddr 00:0C:29:BC:9C:2C
          inet addr:192.168.8.5  Bcast:192.168.8.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:febc:9c2c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:107107 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:3432916 (3.2 MiB)  TX bytes:776 (776.0 b)

eth0      Link encap:Ethernet  HWaddr 00:0C:29:BC:9C:22
          inet addr:192.168.202.130  Bcast:192.168.202.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:febc:9c22/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:545489 errors:0 dropped:0 overruns:0 frame:0
          TX packets:310047 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:79562887 (75.8 MiB)  TX bytes:51496992 (49.1 MiB)

eth1      Link encap:Ethernet  HWaddr 00:0C:29:BC:9C:2C
          inet6 addr: fe80::20c:29ff:febc:9c2c/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:379220 errors:0 dropped:0 overruns:0 frame:0
          TX packets:457341 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:31836326 (30.3 MiB)  TX bytes:31398967 (29.9 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:361 errors:0 dropped:0 overruns:0 frame:0
          TX packets:361 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:866411 (846.1 KiB)  TX bytes:866411 (846.1 KiB)

tap0      Link encap:Ethernet  HWaddr 36:C4:7A:00:1F:8B
          inet addr:192.168.8.128  Bcast:192.168.8.255  Mask:255.255.255.0
          inet6 addr: fe80::34c4:7aff:fe00:1f8b/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:291688 errors:0 dropped:0 overruns:0 frame:0
          TX packets:117083 errors:0 dropped:105 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:13418310 (12.7 MiB)  TX bytes:5385858 (5.1 MiB)

I'm running the programs on a VMware enviroment before i can actually deploy it.

Why do i get an ip address on tap0?