Hi there. I followed the guide here: http://www.server-world.info/en/note?os=CentOS_6&p=openvpn&f=1 with slight changes to accommodate my wants. OS: CentOS 6.4 x64 OpenVPN 2.3.1 -> Bridged Full disclosure here, what I am trying to achieve is a replacement of my current PPTP configuration (not secure anymore sadly) using M$ Windows Server. With that said I am basically looking for similar functionality as I have right now, but strengthened with modern encryption, this is why I chose OpenVPN. I need clients to have an IP on my internal LAN so they can access services across existing IPSEC Tunnels. I need my clients to use my internal DNS servers as well. I also need to route all client traffic through the VPN when they connect. I would like to use multi-factor authentication (AD + Cert I am thinking) eventually, but for now I just want to get the basics working and then harden as much as possible. At the moment I have 2 test clients, one on Win8 and one on Win7. The behavior is the same from each. I can ping the OpenVPN server's eth0 and br0 interfaces, but I can't ping anything else on the remote LAN and can't access the internet. I also can't ping clients from even the OpenVPN server. I suspect something with my IPTables is missing or incorrect, but I don't know what. Here is what my sanitized config looks like right now. server.conf [code] port 443 proto tcp dev tap0 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/server.crt key /etc/openvpn/easy-rsa/keys/server.key dh /etc/openvpn/easy-rsa/keys/dh2048.pem server-bridge 10.0.0.5 255.255.255.0 10.0.0.101 10.0.0.121 push "route 10.0.0.0 255.255.255.0" #Do I really need these if I am using redirect-gateway? push "route 192.168.0.0 255.255.255.0" #Do I really need these if I am using redirect-gateway? push "route 172.16.0.0 255.255.255.0" #Do I really need these if I am using redirect-gateway? push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 10.0.0.7" push "dhcp-option DNS 192.168.0.7" duplicate-cn keepalive 10 120 cipher AES-256-CBC comp-lzo user nobody group nobody persist-key persist-tun status /var/log/openvpn-status.log log /var/log/openvpn.log log-append /var/log/openvpn.log verb 3 [/code] client.ovpn [code] client dev tap proto tcp remote vpn.domain.com 443 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client.crt key client.key ns-cert-type server cipher AES-256-CBC comp-lzo verb 3 [/code] ifconfig [code] br0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 inet addr:10.0.0.5 Bcast:10.0.0.255 Mask:255.255.255.0 inet6 addr: fe80:::::::::/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:28089 errors:0 dropped:0 overruns:0 frame:0 TX packets:17060 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2106296 (2.0 MiB) TX bytes:1610416 (1.5 MiB) eth0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 inet addr:10.0.0.4 Bcast:10.0.0.255 Mask:255.255.255.0 inet6 addr: fe80:::::::::/64 Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:24499 errors:0 dropped:0 overruns:0 frame:0 TX packets:18561 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2264695 (2.1 MiB) TX bytes:1675050 (1.5 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) tap0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 inet6 addr: fe80:::::::::/64 Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:3888 errors:0 dropped:0 overruns:0 frame:0 TX packets:3774 errors:0 dropped:4 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:270401 (264.0 KiB) TX bytes:224458 (219.1 KiB) [/code] iptables [code] # Generated by iptables-save v1.4.7 on Wed May 29 15:50:26 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [18:1664] -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A INPUT -i tap0 -j ACCEPT -A INPUT -i br0 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A FORWARD -i br0 -j ACCEPT COMMIT # Completed on Wed May 29 15:50:26 2013 [/code] I have disabled SELINUX out of desperation, but that didn't change anything. I tried to hop in IRC, but I couldn't join the channel, it said I was banned. I have searched and tested things out like crazy, but can't seem to resolve this one on my own for some reason. Once I do have this all figured out though, I will be happy post a how-to. Thanks for your time. I hope I included all the necessary info, but if I didn't I am happy to provide anything necessary.

Here is what it looks like when I stop and start openvpn and bridge: /etc/rc.d/init.d/openvpn stop [code] Shutting down openvpn: Fri May 31 11:13:27 2013 TUN/TAP device tap0 opened Fri May 31 11:13:27 2013 Persist state set to: OFF [ OK ] [/code] /etc/openvpn/openvpn-shutdown [code] br0: unknown interface: No such device bridge br0 doesn't exist; can't delete it Fri May 31 11:14:51 2013 TUN/TAP device tap0 opened Fri May 31 11:14:51 2013 Persist state set to: OFF [/code] /etc/openvpn/openvpn-startup [code] Fri May 31 11:17:20 2013 TUN/TAP device tap0 opened Fri May 31 11:17:20 2013 Persist state set to: ON [/code] /etc/rc.d/init.d/openvpn start [code] Starting openvpn: Fri May 31 11:18:13 2013 TUN/TAP device tap0 opened Fri May 31 11:18:13 Persist state set to: ON device br0 already exists; can't create bridge with the same name device eth0 is already a member of a bridge; can't enslave it to bridge br0. device tap0 is already a member of a bridge; can't enslave it to bridge br0. [ OK ] [/code]

Can't access anything but OpenVPN server

AES-10000

Hi there. I followed the guide here: http://www.server-world.info/en/note?os=CentOS_6&p=openvpn&f=1 with slight changes to accommodate my wants.

OS: CentOS 6.4 x64
OpenVPN 2.3.1 -> Bridged

Full disclosure here, what I am trying to achieve is a replacement of my current PPTP configuration (not secure anymore sadly) using M$ Windows Server. With that said I am basically looking for similar functionality as I have right now, but strengthened with modern encryption, this is why I chose OpenVPN.

I need clients to have an IP on my internal LAN so they can access services across existing IPSEC Tunnels. I need my clients to use my internal DNS servers as well. I also need to route all client traffic through the VPN when they connect. I would like to use multi-factor authentication (AD + Cert I am thinking) eventually, but for now I just want to get the basics working and then harden as much as possible. At the moment I have 2 test clients, one on Win8 and one on Win7. The behavior is the same from each. I can ping the OpenVPN server's eth0 and br0 interfaces, but I can't ping anything else on the remote LAN and can't access the internet. I also can't ping clients from even the OpenVPN server. I suspect something with my IPTables is missing or incorrect, but I don't know what. Here is what my sanitized config looks like right now.

server.conf

port 443
proto tcp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server-bridge 10.0.0.5 255.255.255.0 10.0.0.101 10.0.0.121
push "route 10.0.0.0 255.255.255.0" #Do I really need these if I am using redirect-gateway?
push "route 192.168.0.0 255.255.255.0" #Do I really need these if I am using redirect-gateway?
push "route 172.16.0.0 255.255.255.0" #Do I really need these if I am using redirect-gateway?
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.0.0.7"
push "dhcp-option DNS 192.168.0.7"
duplicate-cn
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log         /var/log/openvpn.log
log-append  /var/log/openvpn.log
verb 3

client.ovpn

client
dev tap
proto tcp
remote vpn.domain.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3

ifconfig

br0       Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          inet addr:10.0.0.5  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80:::::::::/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:28089 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17060 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2106296 (2.0 MiB)  TX bytes:1610416 (1.5 MiB)

eth0      Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          inet addr:10.0.0.4  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80:::::::::/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:24499 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18561 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2264695 (2.1 MiB)  TX bytes:1675050 (1.5 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

tap0      Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          inet6 addr: fe80:::::::::/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:3888 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3774 errors:0 dropped:4 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:270401 (264.0 KiB)  TX bytes:224458 (219.1 KiB)

iptables

# Generated by iptables-save v1.4.7 on Wed May 29 15:50:26 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [18:1664]
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -i tap0 -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i br0 -j ACCEPT
COMMIT
# Completed on Wed May 29 15:50:26 2013

I have disabled SELINUX out of desperation, but that didn't change anything. I tried to hop in IRC, but I couldn't join the channel, it said I was banned. I have searched and tested things out like crazy, but can't seem to resolve this one on my own for some reason. Once I do have this all figured out though, I will be happy post a how-to.

Thanks for your time. I hope I included all the necessary info, but if I didn't I am happy to provide anything necessary.

janjust

how is the bridge set up? what does

brctl show br0

give? if eth0 is part of the bridge it should not have a separate IP address from the bridge itself (normally).

AES-10000

Thanks for the reply janjust, here is the output of brctl show br0:

bridge name     bridge id               STP enabled     interfaces
br0             8000.0050568a5de9       no              eth0
                                                        tap0

The way I configured the bridge was by following the instructions in the link in my first post. That looks like this:

#cp /usr/share/doc/openvpn-2.3.1/sample/sample-scripts/bridge-start /etc/openvpn/openvpn-startup

#cp /usr/share/doc/openvpn-2.3.1/sample/sample-scripts/bridge-stop /etc/openvpn/openvpn-shutdown

#chmod 755 /etc/openvpn/openvpn-startup

#chmod 755 /etc/openvpn/openvpn-shutdown

#vi /etc/openvpn/openvpn-startup

eth="eth0"
eth_ip="10.0.0.5"
eth_netmask="255.255.255.0"
eth_broadcast="10.0.0.255"

#/etc/rc.d/init.d/openvpn start

Should I just remove all IP info then, from eth0?

I also noticed something that didn't seem to be right on the client side. The route that is being pushed out is:

route add 0.0.0.0 mask 128.0.0.0 10.0.0.4

Shouldn't the mask be 0.0.0.0?

AES-10000

Here is what it looks like when I stop and start openvpn and bridge:

/etc/rc.d/init.d/openvpn stop

Shutting down openvpn: Fri May 31 11:13:27 2013 TUN/TAP device tap0 opened
Fri May 31 11:13:27 2013 Persist state set to: OFF
                                                                               [ OK ]

/etc/openvpn/openvpn-shutdown

br0: unknown interface: No such device
bridge br0 doesn't exist; can't delete it
Fri May 31 11:14:51 2013 TUN/TAP device tap0 opened
Fri May 31 11:14:51 2013 Persist state set to: OFF

/etc/openvpn/openvpn-startup

Fri May 31 11:17:20 2013 TUN/TAP device tap0 opened
Fri May 31 11:17:20 2013 Persist state set to: ON

/etc/rc.d/init.d/openvpn start

Starting openvpn: Fri May 31 11:18:13 2013 TUN/TAP device tap0 opened
Fri May 31 11:18:13 Persist state set to: ON
device br0 already exists; can't create bridge with the same name
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
device tap0 is already a member of a bridge; can't enslave it to bridge br0.
                                                                               [ OK ]

AES-10000

I just started over from scratch and I get the same exact behavior... :cry:

One thing I did not mention was that I am running this on VMware ESXi 5.0. I read some things about making sure Promiscuous Mode was enabled, so I made sure that was enabled. It wasn't before, but it is now. Sadly that didn't fix my problem.

I am also wondering, do I need to have 2 NIC's? I only have 1 assigned to my VM right now, but a lot of examples and other people I see who seem to have bridging working have multiple NIC's. It doesn't make sense to me that I would need 2 for my setup.

One thing I have never seen on my server is this snippet from the website that I am following the instructions from.

device eth1 entered promiscuous mode
device tap0 entered promiscuous mode
br0: port 2(tap0) entering learning state
br0: port 1(eth1) entering learning state

I have never seen that displayed in my console.

janjust

again, what does

brctl show br0

show?

also , your iptables rules are backwards:

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -i tap0 -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i br0 -j ACCEPT

the last 2 INPUT rules and FORWARD rule are never reached due to the REJECT above it.

AES-10000

brctl show br0

bridge name     bridge id               STP enabled     interfaces
br0             8000.0050568a5de9       no              eth0
                                                        tap0

I changed my iptables config to:

# Generated by iptables-save v1.4.7 on Mon Jun  3 09:53:29 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [396187:58766223]
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -i tap0 -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j REJECT --reject-with icmp-host-prohibited

COMMIT
# Completed on Mon Jun  3 09:53:29 2013

Still no change in behavior.

AES-10000

I also stopped iptables all together and still no change.

I am going to attempt using a physical box to remove VMware from the equation now. I am starting to get desperate...