Trying to accomplish the following, and I think it should be theoretically possible, but I've been beating on it for a couple of days and I'm not getting anywhere.
I have an OpenVPN server that sits on a NAT'ed LAN at my house. What I want to do is "extend" this LAN to my office over the internet. Both ends have a Comcast cable modem, the server end is on a static IP, office end is dynamic.
At the office end, I am setting this up as the client and have three NIC cards. Two are used for dedicated networks, the other I want to attach to a switch for my "extended" LAN. My goal is to be able to plug my laptop into the new switch and have it act just like if I were at home. I also plan to add a wireless access point to it if I can get this working.
Here's what I have come up with so far. The tunnel is established, but I am unable to get a DHCP lease for my laptop which is currently plugged into the NIC on the client computer. I am unable to ping anything either.
Server end:
Debian Linux in a virtual machine, 1 ethernet interface attached to br0. Here is the config I have come up with so far:
;mode server
;tls-server
port 1500
proto udp
dev tap0
script-security 3
up "/etc/openvpn/up.sh br0 eth0 tap0"
server-bridge 10.0.20.3 255.255.255.0 10.0.20.10 10.0.20.25
auth SHA256
cipher AES-256-CBC
ca ca.crt
cert ovpn-test.crt
key ovpn-test.key
dh dh2048.pem
status ovpn-server.log
verb 3
/etc/network/interfaces:
auto eth0
iface eth0 inet manual
up ip link set $IFACE up promisc on
auto br0
iface br0 inet static
address 10.0.20.3
netmask 255.255.255.0
gateway 10.0.20.1
bridge_ports eth0
Also set ip_forwarding on, wasn't sure I needed it, but set it anyhow:
net.ipv4.ip_forward = 1
Client end
Debian Linux on a bare metal machine, 3 ethernet cards. Two are used for dedicated networks, the third I am wanting to connect to a switch for my "extended" LAN.
Config so far:
client
dev tap0
proto udp
remote stephennet.net 1500
script-security 3
up "/etc/openvpn/up.sh br0 eth2 tap0"
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/tap/ca.crt
cert /etc/openvpn/tap/jcofficelan-tap.crt
key /etc/openvpn/tap/jcofficelan-tap.key
ns-cert-type server
auth sha256
cipher aes-256-cbc
comp-lzo
status /etc/openvpn/stephennet-tap.log
verb 3
/etc/network/interfaces:
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug eth0
#NetworkManager#iface eth0 inet dhcp
# OpenVPN tap config
# parent interface eth2
auto eth2
iface eth2 inet manual
up ip link set $IFACE up promisc on
auto br0
iface br0 inet static
address 10.0.20.4
netmask 255.255.255.0
gateway 10.0.20.1
bridge_ports eth2
IPV4 forwarding is also enabled on this box. Looking at the logs at either end, I don't see anything that glares out at me:
server log:
OpenVPN CLIENT LIST
Updated,Thu Mar 21 15:20:10 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
jcofficelan-tap,50.142.73.11:41213,10225,7950,Thu Mar 21 15:18:46 2013
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
00:00:fb:40:6c:8f,jcofficelan-tap,50.142.73.11:41213,Thu Mar 21 15:18:48 2013
GLOBAL STATS
Max bcast/mcast queue length,1
END
client log:
OpenVPN STATISTICS
Updated,Thu Mar 21 15:21:14 2013
TUN/TAP read bytes,6020
TUN/TAP write bytes,0
TCP/UDP read bytes,8400
TCP/UDP write bytes,11272
Auth read bytes,0
pre-compress bytes,5252
post-compress bytes,2864
pre-decompress bytes,0
post-decompress bytes,0
END
Any suggestions? I've been looking for a solid example of something like this that has been done, but haven't turned up anything yet 🙁
