I have a machine set up as a gateway providing DHCP and DNS to its internal network.
I am trying to run an OpenVPN server on the same machine so that clients connected from the internet appear as if they are on the internal network, using a bridge.
Here is a diagram:
The gateway works fine, in that internal machines connected via eth1 receive an IP address by DHCP, can resolve each other by DNS and can access the internet.
The VPN also works so that clients can connect, receive an IP address by DHCP, resolve internal machines and each other by DNS, and send and receive data to and from the gateway.
The problem is that clients connected via the VPN cannot send/receive data from other internal machines. In the diagram the Remote client cannot ping or SSH to the Internal server.
Here is /etc/network/interfaces from the gateway:
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 237.xx.xx.80
netmask 255.255.255.0
gateway 237.xx.xx.251
auto brdg
iface brdg inet static
address 192.168.106.1
netmask 255.255.255.0
bridge_ports eth1 tap0
bridge_maxwait 0
pre-up openvpn --mktun --dev tap0
As you can see, I have bridged the OpenVPN tap0 device with the internal network interface eth1 to create the brdg device.
Here is the output from brctl show brdg:
bridge name bridge id STP enabled interfaces
brdg 8000.00d0680d02fd no eth1
tap0
and here is some of the output from ifconfig:
eth0 Link encap:Ethernet HWaddr 00:d0:68:0d:02:fc
inet addr:237.xx.xx.80 Bcast:237.xx.xx.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
brdg Link encap:Ethernet HWaddr 00:d0:68:0d:02:fd
inet addr:192.168.106.1 Bcast:192.168.106.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
eth1 Link encap:Ethernet HWaddr 00:d0:68:0d:02:fd
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
tap0 Link encap:Ethernet HWaddr 2a:5b:99:5b:f1:35
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
IP forwarding is enabled (cat /proc/sys/net/ipv4/ip_forward returns 1) and iptables is configured to provide NAT and firewall controls.
Here is the output from iptables -L -v:
Chain INPUT (policy DROP 135 packets, 6784 bytes)
pkts bytes target prot opt in out source destination
372 40197 ACCEPT all -- lo any anywhere anywhere
280 31587 ACCEPT all -- brdg any anywhere anywhere
932 92280 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
2 96 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
1 42 ACCEPT udp -- any any anywhere anywhere udp dpt:1194
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
18 3478 ACCEPT all -- brdg any anywhere anywhere
2 168 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1439 170K ACCEPT all -- any any anywhere anywhere
and here is the output from iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 158 packets, 8850 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 109 packets, 7935 bytes)
pkts bytes target prot opt in out source destination
65 4770 MASQUERADE all -- any eth0 anywhere anywhere
Chain OUTPUT (policy ACCEPT 172 packets, 12581 bytes)
pkts bytes target prot opt in out source destination
Here are some of the commands used to set up iptables:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A OUTPUT -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i brdg -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p UDP --dport 1194 -j ACCEPT
iptables -A FORWARD -i brdg -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Here is the output from route -n:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
237.xx.xx.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.106.0 0.0.0.0 255.255.255.0 U 0 0 0 brdg
0.0.0.0 237.xx.xx.251 0.0.0.0 UG 0 0 0 eth0
Using traceroute I get a single hop from the Internal server to the gateway, but nothing from the Internal server to the Remote client:
traceroute to 192.168.106.1 (192.168.106.1), 30 hops max, 60 byte packets
1 192.168.106.1 0.623 ms 0.591 ms 0.700 ms
traceroute to 192.168.106.10 (192.168.106.10), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
I get a single hop from the gateway to the Internal server, but nothing from the gateway to the Remote client:
traceroute to 192.168.106.15 (192.168.106.15), 30 hops max, 60 byte packets
1 192.168.106.15 0.996 ms 0.980 ms 0.994 ms
traceroute to 192.168.106.10 (192.168.106.10), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
I also get a single hop from the Remote client to the gateway, but nothing from the Remote client to the Internal server:
Tracing route to 192.168.106.1 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 192.168.106.1
Tracing route to 192.168.106.15 over a maximum of 30 hops
1 * * * Request timed out.
2 * * * Request timed out.
Running tcpdump -i brdg on the gateway shows the following when the Remote client (192.168.106.10) pings the Internal server (192.168.106.15):
14:36:41.266664 ARP, Request who-has 192.168.106.15 tell 192.168.106.10, length 28
14:36:46.583540 ARP, Request who-has 192.168.106.15 tell 192.168.106.10, length 28
And the following when the Internal server (192.168.106.15) pings the remote client (192.168.106.10):
14:42:35.660414 ARP, Request who-has 192.168.106.10 tell 192.168.106.15, length 46
14:42:35.661040 ARP, Reply 192.168.106.10 is-at 00:ff:2a:17:8f:61 (oui Unknown), length 28
14:43:08.659495 ARP, Request who-has 192.168.106.10 tell 192.168.106.15, length 46
14:43:08.660158 ARP, Reply 192.168.106.10 is-at 00:ff:2a:17:8f:61 (oui Unknown), length 28
So it appears packets from the VPN are not reaching the Internal server.
Finally, here is my openvpn server.conf:
port 1194
proto udp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server-bridge
push "explicit-exit-notify 3"
keepalive 10 120
comp-lzo
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
and client.ovpn:
client
dev tap
proto udp
remote 237.xx.xx.80 1195
resolv-retry infinite
nobind
pkcs12 client1.p12
ns-cert-type server
comp-lzo
verb 3
I've been looking at this for a few days now, and read lots of pages on how to set this stuff up, but I didn't find an example where the openvpn server is running on a gateway that is already providing NAT to an internal network interface.
Any help would be appreciated!
