2 servers bridge tun and tap

z2011

Hello, I set up 2 OpenVPN servers on a TomatoVPN router at home. The first server connects with tap my workplace and the second is tun for android devices. Now everything works except that when I try to connect to tun I cannot ping my workplace from android which is connected with tap.

Is there a way to bridge/route tun and tap?

here a sketch:

workplace <-tap-> home <-tun-> android
|_______________________________|
from android no connection to workplace

maikcat

hi there,

Is there a way to bridge/route tun and tap?

routing is the key... 😉

try to push a route for tun based interface vpn to your tap based clients

Michael.

z2011

hmm,

my tap (home and work network) is 192.168.1.0 and my tun is 10.8.0.0.

Do you mean on my tun server I have to add something like
push "route 192.168.1.0 255.255.255.0" ?

Do I have to add a route to the subnet or every single client?

maikcat

please post the output of

ifconfig

from your openvpn server and i tell you what route to add..

Michael.

z2011

br0        Link encap:Ethernet
           inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:2457982 errors:0 dropped:0 overruns:0 frame:0
           TX packets:2008348 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:1995137643 (1.8 GiB)  TX bytes:631138563 (601.9 MiB)

eth0       Link encap:Ethernet
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:7489441 errors:6 dropped:0 overruns:3 frame:3
           TX packets:4623268 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:218283675 (208.1 MiB)  TX bytes:2161323257 (2.0 GiB)
           Interrupt:4 Base address:0x1000 

eth1       Link encap:Ethernet
           UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
           RX packets:1753418 errors:0 dropped:0 overruns:0 frame:11426585
           TX packets:4718939 errors:1153 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:108550328 (103.5 MiB)  TX bytes:2522051393 (2.3 GiB)
           Interrupt:13 Base address:0x5000 

lo         Link encap:Local Loopback  
           inet addr:127.0.0.1  Mask:255.0.0.0
           UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
           RX packets:3348 errors:0 dropped:0 overruns:0 frame:0
           TX packets:3348 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:271922 (265.5 KiB)  TX bytes:271922 (265.5 KiB)

tap21      Link encap:Ethernet 
           UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
           RX packets:1388335 errors:0 dropped:0 overruns:0 frame:0
           TX packets:997510 errors:0 dropped:2 overruns:0 carrier:0
           collisions:0 txqueuelen:100 
           RX bytes:1701145894 (1.5 GiB)  TX bytes:269849559 (257.3 MiB)

tun22      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
           inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
           UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST  MTU:1500  Metric:1
           RX packets:25816 errors:0 dropped:0 overruns:0 frame:0
           TX packets:45610 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:100 
           RX bytes:1567631 (1.4 MiB)  TX bytes:37604551 (35.8 MiB)

vlan0      Link encap:Ethernet   
           UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
           RX packets:7489441 errors:0 dropped:0 overruns:0 frame:0
           TX packets:4569693 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:83473737 (79.6 MiB)  TX bytes:2149886404 (2.0 GiB)

vlan1      Link encap:Ethernet   
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:53575 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:0 (0.0 B)  TX bytes:11436853 (10.9 MiB)

maikcat

first you need to add this to your tun based config:

push "route 192.168.1.0 255.255.255.0"

also you need to add this to your tap based config

push "route 10.8.0.0 255.255.255.0"

curious though..
which interfaces did you use to create br0?

Michael.

z2011

No, it does not work. It would have been too simple. :/

Here some log messages:

...
MULTI: no dynamic or static remote --ifconfig address is available for xxx.xxx.xxx.xxx
...
'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route-gateway dhcp,ping 15,ping-restart 60' (status=1)
..

maikcat

the log messages coming from which instance? server/client? tap/tun?

Michael.

z2011

tun server.

I tried to change from tcp to udp and add routes to the client but no difference.

z2011

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere            udp dpt:1196 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere            udp dpt:1195 
DROP       all  --  anywhere             anywhere            state INVALID 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
shlimit    tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere            state INVALID 
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
wanin      all  --  anywhere             anywhere            
wanout     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain shlimit (1 references)
target     prot opt source               destination         
           all  --  anywhere             anywhere            recent: SET name: shlimit side: source 
DROP       all  --  anywhere             anywhere            recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source 

Chain wanin (1 references)
target     prot opt source               destination         

Chain wanout (1 references)
target     prot opt source               destination

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun22
192.168.1.0    *               255.255.255.0   U     0      0        0 br0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun22
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         192.168.1.1   0.0.0.0         UG    0      0        0 br0

maikcat

No, it does not work. It would have been too simple. :/

yes it is simple...

MULTI: no dynamic or static remote --ifconfig address is available for xxx.xxx.xxx.xxx

please post your server tun config used,

can you disable iptables for testing?
can you ping from a tun based client your openvpn servers lan ip?
also which interfaces did you use to create br0?

Michael.

z2011

Yes, I disable iptables.
From the tun client I can ping all except the tap client.
br0 is created automatic by tomatovpn, I don't know which interfaces creates it.

TUN Server

# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0
proto udp
port 1196
dev tun22
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DOMAIN bang"
push "dhcp-option DNS 192.168.1.1"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

TAP Server

# Automatically generated configuration
daemon
server-bridge
proto udp
port 1195
dev tap21
comp-lzo adaptive
keepalive 15 60
verb 3
client-config-dir ccd
client-to-client
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

# Custom Configuration
push "route 10.8.0.0 255.255.255.0

maikcat

can you verify that tap clients recieve 10.8.0.0/24 route?

if you perform a tracert to 10.8.0.1 from your tap clients what do you see?

Michael.

z2011

no, from a tap client I cannot ping a tun client or the tun server 10.8.0.1.

traceroute 10.8.0.1
traceroute to 10.8.0.1 (10.8.0.1), 30 hops max, 60 byte packets
 1  192.168.1.1 (192.168.1.1)  1.230 ms  2.052 ms  2.679 ms
 2  192.168.200.1 (192.168.200.1)  59.385 ms  78.272 ms  78.641 ms
 3  * * *
 4  * * *
 5  * * *
...

maikcat

2 things

what 192.168.200.1 is?

post the output of

netstat -nr

on your tap client with vpn up...

Michael.

z2011

192.168.200.1 is something from my isp, after the adsl modem.

tap client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG        0 0          0 wlan0
192.168.2.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0
192.168.1.0    0.0.0.0         255.255.255.0   U         0 0          0 tap0

tun client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG        0 0          0 wlan0
10.8.0.1        10.8.0.9        255.255.255.255 UGH       0 0          0 tun21
10.8.0.9        0.0.0.0         255.255.255.255 UH        0 0          0 tun21
192.168.2.0     0.0.0.0         255.255.255.0   U         0 0          0 wlan0
192.168.1.0    10.8.0.9        255.255.255.0   UG        0 0          0 tun21

maikcat

your tap client misses the route to 10.8.0 network..

Michael.

z2011

Solved, thank you.

I have to add to all tap clients this route!

route add -net 10.8.0.0/24 gw 192.168.1.1

z2011

Is there a easy method to add this route automatic at connection?

maikcat

i noticed that on a previous post you typed:

# Custom Configuration
push "route 10.8.0.0 255.255.255.0

the push statement misses a " at the end... (typo maybe?)

it should be

push "route 10.8.0.0 255.255.255.0"

add this to your tap based config & restart the tap based config

Michael.