Bridged network - Public IP on client using CentOS VM Server

nawab.asghar

Hi Everyone,

I have a Virtual Machine (a XEN VM I think) with CentOS installed. The VM provider has given me two public IPs, primary one configured on eth0 and secondary I can use but both of them are for VM's WAN side (not routed). I've configured the Server successfully and can dial from the client (windows based); authentication is handled by freeradius on the server. I get the secondary IP on my client machine with proper default route but the traffic doesn't go out, even the gateway address doesn't respond. The problem I suspect is that the secondary IP provided is to be used on the WAN side, not on the LAN side (virtually LAN side actually - on tap interface). Following are the server / client configs; along with some routes etc. Need help on how can I bridge the tap0 and eth0 interfaces once the VPN is established; so that I can ping the default gateway of secondary IP over the VPN. Which is most certainly lying on the next hop of my VM (maybe the host Server of the provider). Given below is some helping data on my setup:

*******************
Server.conf
*******************
port 1194 #- port
proto udp #- protocol
dev tap0
mode server
tls-server
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
client-cert-not-required
username-as-common-name
server-bridge GHI.JKL.22.1 255.255.255.128 GHI.JKL.22.109 GHI.JKL.22.109
push "redirect-gateway"
keepalive 10 60
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3
*******************

Client.conf
*******************
client
tls-client
dev tap
proto udp
remote ABC.DEF.213.117 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
reneg-sec 0
verb 3
pull
route-method exe
route-delay 2
*******************

Client Log
*******************
Fri Sep 06 15:20:11 2013 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006
Fri Sep 06 15:20:21 2013 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Fri Sep 06 15:20:21 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Sep 06 15:20:21 2013 LZO compression initialized
Fri Sep 06 15:20:21 2013 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Sep 06 15:20:21 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Sep 06 15:20:21 2013 Local Options hash (VER=V4): 'd79ca330'
Fri Sep 06 15:20:21 2013 Expected Remote Options hash (VER=V4): 'f7df56b8'
Fri Sep 06 15:20:21 2013 UDPv4 link local: [undef]
Fri Sep 06 15:20:21 2013 UDPv4 link remote: ABC.DEF.213.117:1194
Fri Sep 06 15:20:21 2013 TLS: Initial packet from ABC.DEF.213.117:1194, sid=6b6efd97 4a64ae76
Fri Sep 06 15:20:23 2013 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=vps008/name=changeme/emailAddress=xyz@gmail.com
Fri Sep 06 15:20:23 2013 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=vps008/name=changeme/emailAddress=xyz@gmail.com
Fri Sep 06 15:20:24 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Sep 06 15:20:24 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 06 15:20:24 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Sep 06 15:20:24 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 06 15:20:24 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Sep 06 15:20:24 2013 [vps008] Peer Connection Initiated with ABC.DEF.213.117:1194
Fri Sep 06 15:20:26 2013 SENT CONTROL [vps008]: 'PUSH_REQUEST' (status=1)
Fri Sep 06 15:20:26 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway GHI.JKL.22.1,ping 5,ping-restart 30,ifconfig GHI.JKL.22.109 255.255.255.128'
Fri Sep 06 15:20:26 2013 OPTIONS IMPORT: timers and/or timeouts modified
Fri Sep 06 15:20:26 2013 OPTIONS IMPORT: --ifconfig/up options modified
Fri Sep 06 15:20:26 2013 OPTIONS IMPORT: route options modified
Fri Sep 06 15:20:26 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Sep 06 15:20:26 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{CB8C7835-7624-4CAA-850B-4404BD2D6C10}.tap
Fri Sep 06 15:20:26 2013 TAP-Win32 Driver Version 8.4
Fri Sep 06 15:20:26 2013 TAP-Win32 MTU=1500
Fri Sep 06 15:20:26 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of GHI.JKL.22.109/255.255.255.128 on interface {CB8C7835-7624-4CAA-850B-4404BD2D6C10} [DHCP-serv: GHI.JKL.22.0, lease-time: 31536000]
Fri Sep 06 15:20:26 2013 Successful ARP Flush on interface [16] {CB8C7835-7624-4CAA-850B-4404BD2D6C10}
Fri Sep 06 15:20:27 2013 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Fri Sep 06 15:20:27 2013 route ADD ABC.DEF.213.117 MASK 255.255.255.255 192.168.1.1
OK!
Fri Sep 06 15:20:27 2013 route DELETE 0.0.0.0 MASK 0.0.0.0 192.168.1.1
OK!
Fri Sep 06 15:20:27 2013 route ADD 0.0.0.0 MASK 0.0.0.0 GHI.JKL.22.1
OK!
Fri Sep 06 15:20:27 2013 Initialization Sequence Completed
*******************

Precisely again, I want to use the secondary IP given by the VM provider (server side) JHI.JKL.236.109/25 with default gateway of JHI.JKL.236.1; on the VPN client. All traffic after VPN connected should be routed using this as a source.

Kind help shall be highly appreciated !

Regards,
Nawab

maikcat

please post:

output on server of:

ifconfig
brctl show
iptables -L
iptabes -L -t nat

also did you enabled ip forwarding on server?

for testing remove this directives from server conf:

mode server
push "redirect-gateway"

also use openvpn 2.1.1 and above on your client (2.0.9 is quite old)

Michael.

nawab.asghar

I forgot to tell you that in my last testing I tried adding the current WAN(eth0) and tap0 in bridge using a script initially with help of this source:
http://g18c.wordpress.com/2009/12/24/openvpn-bridge-on-centos-with-br0-in-etcsysconfignetwork-scripts/
but failed to achieve the result as the "up /etc/openvpn/bridge-start" command doesn't work after being added in the server.conf.

Then I tried adding the eth0 in br0; given below is /etc/sysconfig/network-scripts/ifcfg-br0
**************
DEVICE=br0
TYPE=Bridge
IPADDR=ABC.DEF.213.117
NETMASK=255.255.255.128
GATEWAY=ABC.DEF.213.1
ONBOOT=yes
**************

Following is your required outputs

ifconfig
**************
br0 Link encap:Ethernet HWaddr 52:54:00:F9:5C:AB
inet addr:ABC.DEF.213.117 Bcast:ABC.DEF.213.127 Mask:255.255.255.128
inet6 addr: fe80::5054:ff:fef9:5cab/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:547276 errors:0 dropped:0 overruns:0 frame:0
TX packets:1584 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:27662934 (26.3 MiB) TX bytes:153524 (149.9 KiB)

eth0 Link encap:Ethernet HWaddr 52:54:00:F9:5C:AB
inet6 addr: fe80::5054:ff:fef9:5cab/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:622366 errors:0 dropped:0 overruns:0 frame:0
TX packets:14662 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:40900016 (39.0 MiB) TX bytes:2050514 (1.9 MiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:52 errors:0 dropped:0 overruns:0 frame:0
TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:5584 (5.4 KiB) TX bytes:5584 (5.4 KiB)
**************

brctl show
**************
bridge name bridge id STP enabled interfaces
br0 8000.525400f95cab no eth0
**************

iptables -L
**************
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
**************

iptabes -L -t nat (Please be informed that NAT is not required in our case, as we need the client's VPN Public to be the source)
**************
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
**************

Yes ip forwarding is enabled; even in the windows client which is probably not necessary
Server side ... "net.ipv4.ip_forward = 1" in "/etc/sysctl.conf"

Regards,
Nawab

nawab.asghar

Hi Michael,

In addition to all the info provided. I've removed the redirect-gateway and mode server; connected the VPN, tried pingng the IP GHI.JKL.22.1 from my client machine and got this response. First packet was sent over the VPN (for tap interface had same subnet IP i.e. GHI.JKL.22.109) and then on it started getting response outside the VPN and got a proper response since the IP GHI.JKL.22.1 is assigned on the HOST-Server of my VM provider !

*************
C:\Users\Administrator>ping GHI.JKL.22.1

Pinging GHI.JKL.22.1 with 32 bytes of data:
Reply from GHI.JKL.22.109: Destination host unreachable.
Reply from GHI.JKL.22.1: bytes=32 time=366ms TTL=243
Reply from GHI.JKL.22.1: bytes=32 time=347ms TTL=243
Reply from GHI.JKL.22.1: bytes=32 time=347ms TTL=243

Ping statistics for GHI.JKL.22.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 347ms, Maximum = 366ms, Average = 353ms

C:\Users\Administrator>
*************
Given below is the routing table of client machine for your kind reference, it might help:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.20 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
GHI.JKL.22.0 255.255.255.128 On-link GHI.JKL.22.109 286
GHI.JKL.22.109 255.255.255.255 On-link GHI.JKL.22.109 286
GHI.JKL.22.127 255.255.255.255 On-link GHI.JKL.22.109 286
192.168.1.0 255.255.255.0 On-link 192.168.1.20 281
192.168.1.20 255.255.255.255 On-link 192.168.1.20 281
192.168.1.255 255.255.255.255 On-link 192.168.1.20 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link GHI.JKL.22.109 286
224.0.0.0 240.0.0.0 On-link 192.168.1.20 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link GHI.JKL.22.109 286
255.255.255.255 255.255.255.255 On-link 192.168.1.20 281
===========================================================================

Regards,
Nawab

nawab.asghar

Hi,

I've even tried adding the tap0 to the br0 manually using this command "brctl addif br0 tap0". But still failed to ping the remote IP (GHI.JKL.22.1) over the tunnel :?

***********
[root@vpn008 ~]# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.525400f95cab no eth0
tap0
***********
[root@vpn008 ~]# ip route
ABC.DEF.213.0/25 dev br0 proto kernel scope link src ABC.DEF.213.117
169.254.0.0/16 dev br0 scope link metric 1020
default via ABC.DEF.213.1 dev br0
***********

Someone please extend cooperation and help :!:

Regards,
Nawab

maikcat

hi there,

for bridging setup to work you MUST have eth0 & tap0 interfaces in PROMISC mode.

you can run manually the following AFTER you have created br0 interface,

openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up  
ifconfig eth0 0.0.0.0 promisc up 
service openvpn start

also on your server config remove the mode server directive (leave ONLY server-bridge)

Michael.

nawab.asghar

Hi Michael,

Thanks for your kind response. Tried that too but no luck 🙁

Following is some excerpt for you:

*************************
[root@vpn008 ~]# ifconfig
br0 Link encap:Ethernet HWaddr 52:54:00:F9:5C:AB
inet addr:ABC.DEF.213.117 Bcast:ABC.DEF.213.127 Mask:255.255.255.128
inet6 addr: fe80::5054:ff:fef9:5cab/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2743 errors:0 dropped:0 overruns:0 frame:0
TX packets:715 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:281805 (275.2 KiB) TX bytes:87003 (84.9 KiB)

eth0 Link encap:Ethernet HWaddr 52:54:00:F9:5C:AB
inet6 addr: fe80::5054:ff:fef9:5cab/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:2353 errors:0 dropped:0 overruns:0 frame:0
TX packets:1893 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:286995 (280.2 KiB) TX bytes:187517 (183.1 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:4 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:418 (418.0 b) TX bytes:418 (418.0 b)

tap0 Link encap:Ethernet HWaddr EE:CD:E6:D1:BC:72
inet6 addr: fe80::eccd:e6ff:fed1:bc72/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:1220 errors:0 dropped:0 overruns:0 frame:0
TX packets:342 errors:0 dropped:60 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:104586 (102.1 KiB) TX bytes:22208 (21.6 KiB)

[root@vpn008 ~]#
[root@vpn008 ~]#
[root@vpn008 ~]# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.525400f95cab no eth0
tap0
[root@vpn008 ~]#

C:\Users\Administrator>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : NawabHP
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-A8-70-C7-C3
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::5dc0:7fff:354:6268%20(Preferred)
IPv4 Address. . . . . . . . . . . : GHI.JKL.22.109(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.128
Lease Obtained. . . . . . . . . . : Monday, September 09, 2013 12:56:14 PM
Lease Expires . . . . . . . . . . : Tuesday, September 09, 2014 12:56:15 PM
Default Gateway . . . . . . . . . : fe80::218:74ff:fe92:3900%20
GHI.JKL.22.1
DHCP Server . . . . . . . . . . . : GHI.JKL.22.0
DNS Servers . . . . . . . . . . . : 8.8.8.8
8.8.4.4
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
Physical Address. . . . . . . . . : 2E-B7-0D-60-EA-EC
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Qualcomm Atheros AR9285 802.11b/g/n WiFi
Adapter
Physical Address. . . . . . . . . : 9C-B7-0D-60-EA-EC
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::d930:4027:ce41:6f90%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.22(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, September 09, 2013 11:02:19 AM
Lease Expires . . . . . . . . . . : Tuesday, September 10, 2013 11:02:19 AM
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 245151501
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-A7-66-8A-9C-B7-0D-60-EA-EC

DNS Servers . . . . . . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{68DADAB3-52AB-4485-99E0-FF9D5E3AA31B}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:c30:364f:6813:e992(Prefe
rred)
Link-local IPv6 Address . . . . . : fe80::c30:364f:6813:e992%12(Preferred)
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter 6TO4 Adapter:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2002:97ec:166d::97ec:166d(Preferred)
Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
DNS Servers . . . . . . . . . . . : 8.8.8.8
8.8.4.4
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{A870C7C3-F7B0-41D7-B857-90FCDE95AC1D}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

C:\Users\Administrator>route print

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 GHI.JKL.22.1 GHI.JKL.22.109 31
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
GHI.JKL.22.0 255.255.255.128 On-link GHI.JKL.22.109 286
GHI.JKL.22.109 255.255.255.255 On-link GHI.JKL.22.109 286
GHI.JKL.22.127 255.255.255.255 On-link GHI.JKL.22.109 286
ABC.DEF.213.117 255.255.255.255 192.168.1.1 192.168.1.22 26
192.168.1.0 255.255.255.0 On-link 192.168.1.22 281
192.168.1.22 255.255.255.255 On-link 192.168.1.22 281
192.168.1.255 255.255.255.255 On-link 192.168.1.22 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link GHI.JKL.22.109 286
224.0.0.0 240.0.0.0 On-link 192.168.1.22 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link GHI.JKL.22.109 286
255.255.255.255 255.255.255.255 On-link 192.168.1.22 281
===========================================================================
Persistent Routes:
None

C:\Users\Administrator>ping ABC.DEF.213.117

Pinging ABC.DEF.213.117 with 32 bytes of data:
Reply from ABC.DEF.213.117: bytes=32 time=337ms TTL=51
Reply from ABC.DEF.213.117: bytes=32 time=338ms TTL=51
Reply from ABC.DEF.213.117: bytes=32 time=367ms TTL=51
Reply from ABC.DEF.213.117: bytes=32 time=379ms TTL=51

Ping statistics for ABC.DEF.213.117:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 337ms, Maximum = 379ms, Average = 355ms

C:\Users\Administrator>ping GHI.JKL.22.1

Pinging GHI.JKL.22.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for GHI.JKL.22.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\Administrator>

*************************

Also want you to validate this statement by someone, if it affects my setup:
"Problem is the Centos 6.4 TUNCTL is not there by default for XEN or KVM"

Regards,
Nawab Asghar

maikcat

Also want you to validate this statement by someone, if it affects my setup:
"Problem is the Centos 6.4 TUNCTL is not there by default for XEN or KVM"

tunctl can be found and installed via yum,
also this:

openvpn –mktun –dev tap0

has the same effect AFAIK....

can you please write again which 2 public ips you have?
because in your client config you use

remote ABC.DEF.213.117 1194

but you are assigning addresses from

server-bridge GHI.JKL.22.1 255.255.255.128 GHI.JKL.22.109 GHI.JKL.22.109

???

Michael.

nawab.asghar

Hi Michael,

Yes these are two IPs provided by the VM Provider from two different /25 subnets. That's why I used ABC.DEF.xxx.xxx for the IP configured for VM's WAN connectivity on which the client dials VPN to. The second address I've specified with GHI.JKL.xxx.xxx for it's a different subnet. I'm sending you the actual IP subnets in PM since I don't want attacks revealing them here :mrgreen:

Regards,
Nawab

maikcat

when you are using bridging mode you "bridge" 2 interfaces (tapð) and then
you assign ips from br0 range...

i dont think if its possible what you are trying to achieve here,
i thought you have 2 consecutive ips and you want to "share" one of the two...

Michael.

nawab.asghar

Hi Michael,

Trust you're well. Now I've got another IP GHI.JKL.22.110 from the same class. Now my setup is this

vi /etc/sysconfig/network-scripts/ifcfg-br0

DEVICE="br0"
TYPE="Bridge"

IPADDR="GHI.JKL.22.110"
NETMASK="255.255.255.128"
GATEWAY="GHI.JKL.22.1"

IPADDR2="ABC.DEF.213.117"
NETMASK2="255.255.255.128"
GATEWAY2="ABC.DEF.213.1"

ONBOOT="yes"

[root@vpn008 ~]# vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE="eth0"
BOOTPROTO="static"
BRIDGE="br0"
DNS1="8.8.8.8"
HOSTNAME="vpn008"
HWADDR="52:54:00:F9:5C:AB"

IPV6INIT="yes"
MTU="1500"
NM_CONTROLLED="yes"
ONBOOT="yes"
TYPE="Ethernet"
UUID="3c41bd2d-7d5b-484f-b972-e2eb85c23fd6"

IPV6INIT=yes
IPV6ADDR=xxxxx/48
IPV6_DEFAULTGW=xxxxx::1
IPV6_DEFAULTDEV=eth0
DNS2=xxxx:xxxx:xxxx::xxxx
DNS3=xxxx:xxxx:xxxx::xxxx

[root@vpn008 ~]# ifconfig

br0       Link encap:Ethernet  HWaddr 52:54:00:F9:5C:AB
          inet addr:GHI.JKL.22.110  Bcast:GHI.JKL.22.127  Mask:255.255.255.128
          inet6 addr: fe80::5054:ff:fef9:5cab/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5838 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1575 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:331850 (324.0 KiB)  TX bytes:167222 (163.3 KiB)

eth0      Link encap:Ethernet  HWaddr 52:54:00:F9:5C:AB
          inet6 addr: fe80::5054:ff:fef9:5cab/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:13617 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3531 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1009195 (985.5 KiB)  TX bytes:352598 (344.3 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:657 (657.0 b)  TX bytes:657 (657.0 b)

tap0      Link encap:Ethernet  HWaddr 8A:9C:10:E4:EF:2D
          inet6 addr: fe80::889c:10ff:fee4:ef2d/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:702 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2518 errors:0 dropped:1162 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:50724 (49.5 KiB)  TX bytes:161624 (157.8 KiB)

[root@vpn008 ~]# brctl show

bridge name     bridge id               STP enabled     interfaces
br0             8000.525400f95cab       no              eth0
                                                          tap0

[root@vpn008 ~]# vi /etc/openvpn/server.conf

port 1194 #- port
proto udp #- protocol
dev tap0
tls-server
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

###plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS

client-cert-not-required

username-as-common-name

server-bridge GHI.JKL.22.1 255.255.255.128 GHI.JKL.22.109 GHI.JKL.22.109

push "redirect-gateway"

keepalive 10 60

;user nobody
;group nobody

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

##--up /etc/openvpn/bridge-start
log-append /var/log/openvpn.log

Client Conf

client
tls-client
dev tap
proto udp
remote ABC.DEF.213.117 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
pull
comp-lzo
reneg-sec 0
verb 3

##fast-io
pull
route-method exe
route-delay 2

Still after the VPN gets connected, I'm unable to ping GHI.JKL.22.1 (again, this IP is on my VM's Host Server, reachable from the internet). Kindly help !

Regards,
Nawab Asghar

nawab.asghar

Also, most of the time I do this, the response from the server is lost :?:

ifconfig tap0 0.0.0.0 promisc up  
ifconfig eth0 0.0.0.0 promisc up

nawab.asghar

Any VM provider offering VMs with routed public IPs ?

Recently made a successful test, created a PPTP tunnel from my VM to my router (having a lot of IPs) used a /30 public subnet (for P2P connectivity). Routed another /29 over the PPTP-Client side IP of the /30 for OpenVPN clients. Now OpenVPN client is able to get the IP and it works like a charm 😉