Hello, I set up 2 OpenVPN servers on a TomatoVPN router at home. The first server connects with tap my workplace and the second is tun for android devices. Now everything works except that when I try to connect to tun I cannot ping my workplace from android which is connected with tap. Is there a way to bridge/route tun and tap? here a sketch: workplace home android |_______________________________| from android no connection to workplace

hi there, [quote]Is there a way to bridge/route tun and tap?[/quote] routing is the key... ;) try to push a route for tun based interface vpn to your tap based clients Michael.

hmm, my tap (home and work network) is 192.168.1.0 and my tun is 10.8.0.0. Do you mean on my tun server I have to add something like push "route 192.168.1.0 255.255.255.0" ? Do I have to add a route to the subnet or every single client?

please post the output of ifconfig from your openvpn server and i tell you what route to add.. Michael.

[code] br0 Link encap:Ethernet inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2457982 errors:0 dropped:0 overruns:0 frame:0 TX packets:2008348 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1995137643 (1.8 GiB) TX bytes:631138563 (601.9 MiB) eth0 Link encap:Ethernet UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:7489441 errors:6 dropped:0 overruns:3 frame:3 TX packets:4623268 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:218283675 (208.1 MiB) TX bytes:2161323257 (2.0 GiB) Interrupt:4 Base address:0x1000 eth1 Link encap:Ethernet UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:1753418 errors:0 dropped:0 overruns:0 frame:11426585 TX packets:4718939 errors:1153 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:108550328 (103.5 MiB) TX bytes:2522051393 (2.3 GiB) Interrupt:13 Base address:0x5000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1 RX packets:3348 errors:0 dropped:0 overruns:0 frame:0 TX packets:3348 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:271922 (265.5 KiB) TX bytes:271922 (265.5 KiB) tap21 Link encap:Ethernet UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:1388335 errors:0 dropped:0 overruns:0 frame:0 TX packets:997510 errors:0 dropped:2 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:1701145894 (1.5 GiB) TX bytes:269849559 (257.3 MiB) tun22 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST MTU:1500 Metric:1 RX packets:25816 errors:0 dropped:0 overruns:0 frame:0 TX packets:45610 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:1567631 (1.4 MiB) TX bytes:37604551 (35.8 MiB) vlan0 Link encap:Ethernet UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:7489441 errors:0 dropped:0 overruns:0 frame:0 TX packets:4569693 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:83473737 (79.6 MiB) TX bytes:2149886404 (2.0 GiB) vlan1 Link encap:Ethernet UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:53575 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:11436853 (10.9 MiB) [/code]

first you need to add this to your tun based config: [code]push "route 192.168.1.0 255.255.255.0"[/code] also you need to add this to your tap based config [code]push "route 10.8.0.0 255.255.255.0"[/code] curious though.. which interfaces did you use to create br0? Michael.

No, it does not work. It would have been too simple. :/ Here some log messages: [code] ... MULTI: no dynamic or static remote --ifconfig address is available for xxx.xxx.xxx.xxx ... 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route-gateway dhcp,ping 15,ping-restart 60' (status=1) .. [/code]

the log messages coming from which instance? server/client? tap/tun? Michael.

tun server. I tried to change from tcp to udp and add routes to the client but no difference.

[code] Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT udp -- anywhere anywhere udp dpt:1196 ACCEPT all -- anywhere anywhere ACCEPT udp -- anywhere anywhere udp dpt:1195 DROP all -- anywhere anywhere state INVALID ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED shlimit tcp -- anywhere anywhere tcp dpt:ssh state NEW ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere DROP all -- anywhere anywhere state INVALID TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED wanin all -- anywhere anywhere wanout all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain shlimit (1 references) target prot opt source destination all -- anywhere anywhere recent: SET name: shlimit side: source DROP all -- anywhere anywhere recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source Chain wanin (1 references) target prot opt source destination Chain wanout (1 references) target prot opt source destination [/code] [code] Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.8.0.2 * 255.255.255.255 UH 0 0 0 tun22 192.168.1.0 * 255.255.255.0 U 0 0 0 br0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun22 127.0.0.0 * 255.0.0.0 U 0 0 0 lo default 192.168.1.1 0.0.0.0 UG 0 0 0 br0 [/code]

[quote]No, it does not work. It would have been too simple. :/[/quote] yes it is simple... [quote]MULTI: no dynamic or static remote --ifconfig address is available for xxx.xxx.xxx.xxx[/quote] please post your server tun config used, can you disable iptables for testing? can you ping from a tun based client your openvpn servers lan ip? also which interfaces did you use to create br0? Michael.

2 servers bridge tun and tap

z2011

just forum typo,

I add to the every client:

route 10.8.0.0 255.255.255.0
route-gateway 192.168.1.1

and I'm fine.
Thank you again.

« Previous Page