Hi guys. I'm trying to set up a bridged vpnServer on my ROUTER
The problem is that I am not able to ping any hosts in my localnetwork from the vpnClient
However, it is possible to ping Server from VPNClient, ping VPNClient from Server and Client on localnet
eth0 = WAN interface
eth1 = local ethernet
wlan0 = local wireless
br0 = eth1 + wlan0 +tap0 (192.168.1.1/24)
When I try to ping host in my local subnet (ping -c3 192.168.1.8) from the VPNClient (192.168.1.240) it returns:
3 packets transmitted, 0 received, 100% packet loss, time 2015 ms
A TCP dump on the bridge (tcpdump -nnel -i br0 icmp) shows:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:00:51.584933 7e:54:62:60:07:0b > d6:9c:8d:f1:71:f1, ethertype IPv4 (0x0800), length 98: 192.168.1.240 > 192.168.1.8: ICMP echo request, id 2837, seq 1, length 64
14:00:52.614119 7e:54:62:60:07:0b > d6:9c:8d:f1:71:f1, ethertype IPv4 (0x0800), length 98: 192.168.1.240 > 192.168.1.8: ICMP echo request, id 2837, seq 2, length 64
14:00:53.697989 7e:54:62:60:07:0b > d6:9c:8d:f1:71:f1, ethertype IPv4 (0x0800), length 98: 192.168.1.240 > 192.168.1.8: ICMP echo request, id 2837, seq 3, length 64
^C
3 packets captured
3 packets received by filter
0 packets dropped by kernel
4294967150 packets dropped by interface
brctl showstp br0
br0
bridge id 8000.d69c8df171f1
designated root 8000.d69c8df171f1
root port 0 path cost 0
max age 20.00 bridge max age 20.00
hello time 2.00 bridge hello time 2.00
forward delay 15.00 bridge forward delay 15.00
ageing time 300.00
hello timer 0.92 tcn timer 0.00
topology change timer 0.00 gc timer 34.39
flags
eth1 (1)
port id 8001 state forwarding
designated root 8000.d69c8df171f1 path cost 19
designated bridge 8000.d69c8df171f1 message age timer 0.00
designated port 8001 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags
tap0 (3)
port id 8003 state forwarding
designated root 8000.d69c8df171f1 path cost 100
designated bridge 8000.d69c8df171f1 message age timer 0.00
designated port 8003 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags
wlan0 (2)
port id 8002 state forwarding
designated root 8000.d69c8df171f1 path cost 100
designated bridge 8000.d69c8df171f1 message age timer 0.00
designated port 8002 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags
iptables -L -v
Chain INPUT (policy ACCEPT 1216 packets, 997K bytes)
pkts bytes target prot opt in out source destination
574 48178 ACCEPT all -- lo any anywhere anywhere
6399 813K ACCEPT all -- br0 any anywhere anywhere
0 0 REJECT udp -- !br0 any anywhere anywhere udp dpt:bootps reject-with icmp-port-unreachable
0 0 REJECT udp -- !br0 any anywhere anywhere udp dpt:domain reject-with icmp-port-unreachable
14 664 DROP tcp -- !br0 any anywhere anywhere tcp dpts:0:1023
3044 1002K DROP udp -- !br0 any anywhere anywhere udp dpts:0:1023
158 24072 DROP icmp -- !br0 any anywhere anywhere
0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:3784
0 0 ACCEPT udp -- eth0 any anywhere anywhere udp dpt:3784
0 0 DROP tcp -- !br0 any anywhere anywhere tcp dpt:nfs
0 0 DROP tcp -- !br0 any anywhere anywhere tcp dpt:sane-port
0 0 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT all -- tap+ any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
64 5114 DROP all -- br0 any anywhere 192.168.1.0/24
14480 2682K ACCEPT all -- br0 any 192.168.1.0/24 anywhere
12844 7507K ACCEPT all -- eth0 any anywhere 192.168.1.0/24
0 0 ACCEPT all -- tap0 eth1 anywhere 192.168.1.0/24
0 0 ACCEPT all -- tap0 br0 anywhere 192.168.1.0/24
iptables -L -v -t nat
Chain PREROUTING (policy ACCEPT 14970 packets, 3837K bytes)
pkts bytes target prot opt in out source destination
563 29604 DNAT tcp -- eth0 any anywhere anywhere tcp dpts:6881:6889 to:192.168.1.5
119 6194 DNAT udp -- eth0 any anywhere anywhere udp dpt:3659 to:192.168.1.5
1 95 DNAT udp -- eth0 any anywhere anywhere udp dpts:25200:25300 to:192.168.1.5
817 36040 DNAT tcp -- eth0 any anywhere anywhere tcp dpts:20000:20200 to:192.168.1.5
4 176 DNAT tcp -- eth0 any anywhere anywhere tcp dpt:17502 to:192.168.1.5
4 176 DNAT tcp -- eth0 any anywhere anywhere tcp dpt:42127 to:192.168.1.5
Chain INPUT (policy ACCEPT 2414 packets, 175K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 6114 packets, 979K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 2511 packets, 743K bytes)
pkts bytes target prot opt in out source destination
24M 1550M MASQUERADE all -- any eth0 anywhere anywhere
0 0 MASQUERADE all -- any tap0 anywhere anywhere
server.conf:
dev tap0
proto udp
port 9000
mode server
tls-server
float
dh /usr/share/easy-rsa/keys/dh1024.pem
ca /usr/share/easy-rsa/keys/ca.crt
cert /usr/share/easy-rsa/keys/server.crt
key /usr/share/easy-rsa/keys/server.key
tls-auth ta.key 0
user nobody
group nogroup
status openvpn-status.log
log /var/log/openvpn.log
comp-lzo
verb 3
client-to-client
keepalive 10 120
fragment 1300
mssfix
hand-window 300
tcp-nodelay
server-bridge 192.168.1.1 255.255.255.0 192.168.1.240 192.168.1.250
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway"
push "route-gateway 192.168.1.1"
push "ip-win32 dynamic"
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DOMAIN localnet"
push "dhcp-option WINS 192.168.1.1"
push "dhcp-option NTP 192.168.1.1"
ifconfig-pool-persist ipp.txt
I have tried many things... however, no luck
I assume problem lies with iptables but I dont have a solution
If someone can help please!
Thanks in advance!!!
