What I am trying to accomplish? Set up a bridged VPN so that VPN users will appear to be on the network and can use services (e.g. ssh into machines) that we provide. I do not want to do a redirect-gateway, just VPN traffic to the VPN, everything else directly out of the client machine. What is happening? I can connect, and receive an address just fine. I can then ping and SSH into the openvpn server machine itself. I can not get anywhere else in the network. Server is ubuntu 12.04 running on a VM. I also have ufw enabled. Server.conf: [code]mode server tls-server local 10.0.0.173 ## ip/hostname of server port 1194 ## default openvpn port proto tcp dev tap0 ## If you need multiple tap devices, add them here up "/etc/openvpn/up.sh br0 eth0" down "/etc/openvpn/down.sh br0 tap0" persist-key persist-tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem tls-auth ta.key 0 # This file is secret cipher BF-CBC # Blowfish (default) comp-lzo ifconfig-pool-persist ipp.txt server-bridge 10.0.0.173 255.255.255.0 10.0.0.200 10.0.0.220 push "dhcp-option DOMAIN neutroninteractive.com" push "route 10.0.0.0 255.255.255.0" push "route 10.0.1.0 255.255.255.0" push "route 10.0.2.0 255.255.255.0" push "route 10.0.3.0 255.255.255.0" push "route 10.0.10.0 255.255.255.0" push "route 10.0.20.0 255.255.255.0" push "route 10.0.100.0 255.255.255.0" max-clients 5 ## set this to the max number of clients that should be connected at a time script-security 3 system user nobody group nogroup keepalive 10 120 status openvpn-status.log log openvpn.log verb 5[/code] Client.conf [code]port 1194 dev tap proto tcp-client remote xxx.xxx.xxx.18 1194 resolv-retry infinite nobind ping 30 persist-tun persist-key cipher bf-cbc comp-lzo ca ca.crt cert will.crt key will.key ns-cert-type server pull verb 5 tls-client tls-auth ta.key 1[/code] UFW config changes: In /etc/ufw/sysctl.conf: [code]net/ipv4/ip_forward=1[/code] In /etc/default/ufw: [code]DEFAULT_FORWARD_POLICY="ACCEPT"[/code] In /etc/ufw/before.rules: [code]-A INPUT -i tap0 -j ACCEPT -A INPUT -i br0 -j ACCEPT -A FORWARD -i br0 -j ACCEPT -A FORWARD -i tap0 -j ACCEPT[/code] Just for information about my interfaces (output of ifconfig): [code]br0 Link encap:Ethernet HWaddr 00:0c:29:a0:d2:f8 inet addr:10.0.0.173 Bcast:10.0.0.255 Mask:255.255.255.0 inet6 addr: fe80::20c:29ff:fea0:d2f8/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:270234 errors:0 dropped:96 overruns:0 frame:0 TX packets:14585 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:26057870 (26.0 MB) TX bytes:3146825 (3.1 MB) eth0 Link encap:Ethernet HWaddr 00:0c:29:a0:d2:f8 inet6 addr: fe80::20c:29ff:fea0:d2f8/64 Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:292428 errors:0 dropped:0 overruns:0 frame:0 TX packets:16171 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:34365128 (34.3 MB) TX bytes:3153802 (3.1 MB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:25831 errors:0 dropped:0 overruns:0 frame:0 TX packets:25831 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1963334 (1.9 MB) TX bytes:1963334 (1.9 MB) tap0 Link encap:Ethernet HWaddr 6e:a8:0b:00:f1:25 inet6 addr: fe80::6ca8:bff:fe00:f125/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2351 errors:0 dropped:0 overruns:0 frame:0 TX packets:251257 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:203836 (203.8 KB) TX bytes:28003773 (28.0 MB)[/code] Lastly, in the syslog UFW does show what it blocks, but it never blocks anything from my assigned IP (10.0.0.200). I am running into a real stump here. If anyone can see something wrong, I would really appreciate it.

2 things, 1) disable firewall for testing 2) [quote]Server is ubuntu 12.04 running on a VM. I also have ufw enabled.[/quote] in which mode operates the vm network card? (bridged,NAT,hostonly) which hypervisor are you using? Michael.

[quote="maikcat"]2 things, 1) disable firewall for testing 2) [quote]Server is ubuntu 12.04 running on a VM. I also have ufw enabled.[/quote] in which mode operates the vm network card? (bridged,NAT,hostonly) which hypervisor are you using? Michael.[/quote] Michael, thanks for the reply. To answer your questions, the behavior is the same with firewall off or on. The virtual machine is on a VMWare NI-ESXi-3 controller. These do networking differently in that you don't select bridge or not, but set up different networks. It is bridged.

[quote="maikcat"]2 things, 1) disable firewall for testing 2) [quote]Server is ubuntu 12.04 running on a VM. I also have ufw enabled.[/quote] in which mode operates the vm network card? (bridged,NAT,hostonly) which hypervisor are you using? Michael.[/quote] Michael, thanks for your response. To answer your questions: 1) Behavior is the same with firewall on or off, but I have it off. 2) Virtual Host is VMWare NI-ESXi-3, which sets up a virtual switch which is bridged with the outside.

Can connect to VPN server, but nothing else

undertakingyou

What I am trying to accomplish? Set up a bridged VPN so that VPN users will appear to be on the network and can use services (e.g. ssh into machines) that we provide. I do not want to do a redirect-gateway, just VPN traffic to the VPN, everything else directly out of the client machine.

What is happening? I can connect, and receive an address just fine. I can then ping and SSH into the openvpn server machine itself. I can not get anywhere else in the network.

Server is ubuntu 12.04 running on a VM. I also have ufw enabled.

Server.conf:

mode server
tls-server
local 10.0.0.173 ## ip/hostname of server
port 1194 ## default openvpn port
proto tcp
dev tap0 ## If you need multiple tap devices, add them here
up "/etc/openvpn/up.sh br0 eth0"
down "/etc/openvpn/down.sh br0 tap0"
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
tls-auth ta.key 0 # This file is secret
cipher BF-CBC        # Blowfish (default)
comp-lzo
ifconfig-pool-persist ipp.txt
server-bridge 10.0.0.173 255.255.255.0 10.0.0.200 10.0.0.220
push "dhcp-option DOMAIN neutroninteractive.com"
push "route 10.0.0.0 255.255.255.0"
push "route 10.0.1.0 255.255.255.0"
push "route 10.0.2.0 255.255.255.0"
push "route 10.0.3.0 255.255.255.0"
push "route 10.0.10.0 255.255.255.0"
push "route 10.0.20.0 255.255.255.0"
push "route 10.0.100.0 255.255.255.0"
max-clients 5 ## set this to the max number of clients that should be connected at a time
script-security 3 system
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
log openvpn.log
verb 5

Client.conf

port 1194
dev tap
proto tcp-client
remote xxx.xxx.xxx.18 1194
resolv-retry infinite
nobind
ping 30
persist-tun
persist-key
cipher bf-cbc
comp-lzo
ca ca.crt
cert will.crt
key will.key
ns-cert-type server
pull
verb 5
tls-client
tls-auth ta.key 1

UFW config changes:
In /etc/ufw/sysctl.conf:

net/ipv4/ip_forward=1

In /etc/default/ufw:

DEFAULT_FORWARD_POLICY="ACCEPT"

In /etc/ufw/before.rules:

-A INPUT -i tap0 -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -i tap0 -j ACCEPT

Just for information about my interfaces (output of ifconfig):

br0       Link encap:Ethernet  HWaddr 00:0c:29:a0:d2:f8
          inet addr:10.0.0.173  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fea0:d2f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:270234 errors:0 dropped:96 overruns:0 frame:0
          TX packets:14585 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:26057870 (26.0 MB)  TX bytes:3146825 (3.1 MB)

eth0      Link encap:Ethernet  HWaddr 00:0c:29:a0:d2:f8
          inet6 addr: fe80::20c:29ff:fea0:d2f8/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:292428 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16171 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:34365128 (34.3 MB)  TX bytes:3153802 (3.1 MB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:25831 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25831 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:1963334 (1.9 MB)  TX bytes:1963334 (1.9 MB)

tap0      Link encap:Ethernet  HWaddr 6e:a8:0b:00:f1:25
          inet6 addr: fe80::6ca8:bff:fe00:f125/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2351 errors:0 dropped:0 overruns:0 frame:0
          TX packets:251257 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:203836 (203.8 KB)  TX bytes:28003773 (28.0 MB)

Lastly, in the syslog UFW does show what it blocks, but it never blocks anything from my assigned IP (10.0.0.200).

I am running into a real stump here. If anyone can see something wrong, I would really appreciate it.

maikcat

2 things,

1) disable firewall for testing

2)

Server is ubuntu 12.04 running on a VM. I also have ufw enabled.

in which mode operates the vm network card? (bridged,NAT,hostonly) which hypervisor are you using?

Michael.

undertakingyou

maikcat wrote2 things,

1) disable firewall for testing

2)

Server is ubuntu 12.04 running on a VM. I also have ufw enabled.
in which mode operates the vm network card? (bridged,NAT,hostonly) which hypervisor are you using?

Michael.

Michael, thanks for the reply. To answer your questions, the behavior is the same with firewall off or on. The virtual machine is on a VMWare NI-ESXi-3 controller. These do networking differently in that you don't select bridge or not, but set up different networks. It is bridged.

undertakingyou

maikcat wrote2 things,

1) disable firewall for testing

2)

Server is ubuntu 12.04 running on a VM. I also have ufw enabled.
in which mode operates the vm network card? (bridged,NAT,hostonly) which hypervisor are you using?

Michael.

Michael, thanks for your response. To answer your questions: 1) Behavior is the same with firewall on or off, but I have it off. 2) Virtual Host is VMWare NI-ESXi-3, which sets up a virtual switch which is bridged with the outside.

undertakingyou

With Michaels suggestions I did some more research. It seems that when setting up a network with this you can specify whether you reject promiscuous mode at the switch. I set up a new network, and set this to accept. Routing works with firewall on or off.

New problem, I can only access one VLAN. I can access the 10.0.0.0 network, but not the others. I am going to check routing in the VMware switch itself to see if I can find something like this. If anyone has any other thoughts, I would love to hear them.