squiggle Hi, I expect the below is quite basic, but any help would be appreciated: I'm experimenting with setting up openVPN on a linux mint box. This box has two interfaces: one on the LAN to which I am trying to enable VPN access, eth1 one with a public IP, eth0 In the interfaces file I have created a bridge interface, br1, and transferred to it all the config previously allocated directly to eth1 This seems to have worked in so far as the bridge interface comes up without any errors, and ifconfig shows it with the IP etc previously allocated to eth1. eth1 meanwhile no longer shows as having an IP at all. Furthermore, my routing table shows that traffic destined for the LAN which originates on the server is now sent to my bridge interface rather than to eth1 However, if, from this server, I try to ping the LAN (as opposed to the internet), I get "Destination Host Unreachable" Should I expect to be able to see the local network directly from the server? It would be useful, since then the box can do other things as well as being a VPN endpoint...
maikcat please post: your openvpn server config output of brctl show output of ifconfig if you have enabled ip forwarding output of iptables -L -v and iptables -t nat -L -v Michael.
squiggle I think I have it sorted: I can after some tweaking ping across the VPN in either direction. However, as I understand it the VPN endpoint will appear as a hub - i.e the switch will see multiple MACs on one port. This is locking the port down at teh moment, so I need to get the config changed slightly.
squiggle Ah...ok so there is no port security - that was a red herring. Still investigating. For a single device, using bridging, is the following correct: The VPN server would create a virtual "br x" interface to bridge the internal network to the VPN The Client will create a virtual "tap x" interface when succesfully connected to the VPN Would the server also create a "tap x" interface to connect to the client? Would one thus expect tap1, tap2, tap3 etc on the server for every connected client...?
maikcat Would the server also create a "tap x" interface to connect to the client? Would one thus expect tap1, tap2, tap3 etc on the server for every connected client...? short answer...no Michael.
