Connect "tun only"-client to tap server

sbender

Hi,

I have a tap based server that is runnig fine with a number of tap based clients, they have transparent access to the network the server is sitting in.
Now I wanted to connect an iPhone user using the new "official" client from the App Store.
I imported a profile, but the app told me only 'tun' profiles are supported.
So I just changed the profile from 'dev tap' to 'dev tun', but then the client fails to connect with the following messages:

2013-01-18 15:03:10 LZO-ASYM init swap=0 asym=0
2013-01-18 15:03:10 EVENT: ASSIGN_IP
2013-01-18 15:03:10 TUN Error: tun_builder_error: ifconfig addresses are not in the same /30 subnet (topology net30)
2013-01-18 15:03:10 EVENT: TUN_SETUP_FAILED tun_builder_error: ifconfig addresses are not in the same /30 subnet (topology net30) [ERR]
2013-01-18 15:03:10 EVENT: DISCONNECTED
2013-01-18 15:03:10 Raw stats on disconnect:
 BYTES_IN : 4459
 BYTES_OUT : 4242
 PACKETS_IN : 45
 PACKETS_OUT : 43
 TUN_SETUP_FAILED : 1

Is there a way to get this running?

Thank you!

maikcat

only by changing server config to tun... :?

Michael

sbender

Hi,

ok, that's bad...

Is there a good tutorial for 'tun' to connect OpenVPN clients in a way they can see the complete network of the server?

Thank you!

maikcat

hi there,

in a way they can see the complete network of the server?

what exactly do you mean by the complete network?

yes tun based can "see" the whole ip remote range,
but tun is layer3 (tap is layer 2) and cant pass broadcasts...

Michael.

sbender

Hi,

I mean the clients should be able to connect to other machines that are in the same network as the server is.
I think I will not need broadcast services, as clients knonw the services they need to connect to.

I read for tun based communication severaly changes in the routes of the clients have to be done, is that right?
I also read there's a "topology subnet" setting that makes things easier - however I did not find a good tutorial on this topic.
Do you happen to know one?

Thank you!

maikcat

hi there,

unless you are using bridging tun is the way to go...

you can use tap with routing but i dont recommend it..

I read for tun based communication severaly changes in the routes of the clients have to be done, is that right?

yes you need to configure routing properly,its not that complicated if you know how 😉

I also read there's a "topology subnet" setting that makes things easier

dev tun uses p2p style...nothing more nothing less...
you can use topology subnet if you like.

Michael.

sbender

So the routings have to be configured in the same way, regardless if using "topology subnet" or not?

maikcat

the routings as a concept yes...

the syntax changes a little,
f.e if you want to push a static route for 192.168.100.0 network you use

push "route 192.168.100.0 255.255.255.0"

Michael.

jurev

SOLUTION to net30 problem:

I also had net30 problems, which I solved by adding the following two lines in SERVER.conf file:

topology subnet
push "topology subnet"

In OpenVPN manual it says that server automatically pushes topology options to client, but it does not in my case, so problem was solved by adding the push line to manually force it to the client.

maikcat

net30 problem?!?!?!?!

i dont mean to be rude,but where is the problem???

you simply need to use different syntax on directives....

keep in mind that topology directive works ONLY with versions 2.1.1 and above
also when used on Windows, requires version 8.2 or higher of the TAP-Win32 driver...

Michael.