server-bridge entry

[deleted]

Hi All,

just a quick clarification request. server bridge is, as I understand it, basically dhcp for openvpn client connections. I have a single server and 3 remote machines that connect to it in bridged mode. These machines now have static IP addresses on br0 but tap0 keeps getting an address assigned from, I believe, the server-bridge setting.

As all of my remote bridge connections are now static, can I remove that but still have the push options working for DNS, WINS etc.. I'm loathe to try it as it's in pretty much 24/7 use and I don't want to screw up what's already working.

Cheers,

Jools

janjust

without configs it's impossible to tell what is happening; a correct Linux bridge setup will show that the bridged devices (e.g. eth0 + tap0) do NOT have IP addresses, only the bridge itself will have one.

the most common mistake to make is to not explicitly specify the tap device, you should use

dev tap0

(note the 0 !)

[deleted]

Apologies, got distracted and forgot to put the config in (doh!) Incidentally, the remote sites were getting the 0.70 and 0.71 but I've fixed them at the client end with a script that brings the interface up at a certain point after the servers boot.

local 192.168.10.4
port 1194
proto udp
dev tap0

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/headoff.crt
key /etc/openvpn/keys/headoff.key # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem

server-bridge 192.168.0.1 255.255.255.0 192.168.0.70 192.168.0.71

push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.0.1"
push "dhcp-option WINS 192.168.0.1"
push "dhcp-option DOMAIN globnet.ldm"

client-to-client
keepalive 10 120

tls-auth /etc/openvpn/keys/ta.key 0
reneg-sec 36000

cipher BF-CBC
comp-lzo

persist-key
persist-tun
status openvpn-status.log

verb 3

janjust

and what does

brctl show br0

and

ifconfig -a

give? which IPs are assigned? do you have 2 ethernet interfaces? your "local" address is different from the "server-bridge" address.

[deleted]

Yep, two nics. One is connected to the LAN and the other to the router.

brctl shows:

bridge name bridge id STP enabled interfaces
br0 8000.001b2121cd4c no tap0
eth1

[deleted]

Yep, two nics. One is connected to the LAN and the other to the router.

brctl shows:

bridge name bridge id STP enabled interfaces
br0 8000.001b2121cd4c no tap0
eth1

br0 has the ip 192.168.0.1 and eth0 which is connected to the router has 192.168.10.4. The clients have similar setups but every so often, the client's tap interface adopts the IP 192.168.0.71 . If I remove it with:

ip address flush dev tap0

It's removed but at some seemingly random point in the future tap0 will adopt that IP again, usually signalled by getting an ssh key changed warning as another client does the same thing.