[Closed] Trouble with Mulitcast and Server Bridge

qcrist

Multicast packets from my LAN are not forwarded over my VPN. Is there any way to fix this?

server.conf

mode server
tls-server

port 53
proto udp
script-security 2

dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"

persist-key
persist-tun

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0

cipher BF-CBC
comp-lzo

server-bridge
push "redirect-gateway def1"

client-to-client
user nobody
group nogroup

keepalive 10 120
log server.log

verb 2

client.conf

client
dev tap
proto udp
remote domainname.tk 53
nobind
resolv-retry infinite
persist-key
persist-tun
<ca>Inline Key</ca>
<cert>Inline Key</cert>
<key>Inline Key</key>
<tls-auth>Inline Key</tls-auth>
key-direction 1
comp-lzo
verb 1
mute-replay-warnings
pull

up.sh

#!/bin/sh
BR=$1
DEV=$2
MTU=$3
ifconfig $DEV mtu $MTU promisc allmulti up
ifconfig eth0 promisc allmulti
brctl addif $BR $DEV

down.sh

#!/bin/sh
BR=$1
DEV=$2

brctl delif $BR $DEV
ifconfig $DEV down
iptables -F
iptables -t nat -F

/etc/network/interfaces

auto lo
iface lo inet loopback

#bridge
auto br0
iface br0 inet dhcp
        bridge_ports eth0
	up ifconfig $IFACE allmulti promisc

qcrist

My goal is to get multicast working over the vpn so I can use my vpn to play LAN games with my friends.

qcrist

Everything connects properly, but I'll post the log files when I get home.

qcrist

Client.log

Wed Sep 25 14:49:45 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Mar  7 2013
Wed Sep 25 14:49:45 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Sep 25 14:49:45 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Sep 25 14:49:46 2013 Control Channel Authentication: tls-auth using INLINE static key file
Wed Sep 25 14:49:46 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:49:46 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:49:46 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Sep 25 14:49:46 2013 UDPv4 link local: [undef]
Wed Sep 25 14:49:46 2013 UDPv4 link remote: [AF_INET]1.1.1.1:53
Wed Sep 25 14:49:46 2013 TLS: Initial packet from [AF_INET]1.1.1.1:53, sid=f40a2bf3 93ba8ce1
Wed Sep 25 14:49:46 2013 VERIFY OK: depth=1, C=US, ST=GA, L=Cumming, O=VPN, OU=VPN, CN=name, name=Certificate, emailAddress=me@gmail.com
Wed Sep 25 14:49:46 2013 VERIFY OK: depth=0, C=US, ST=GA, L=Cumming, O=VPN, OU=VPN, CN=serv, name=Certificate, emailAddress=server@gmail.com
Wed Sep 25 14:50:02 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 25 14:50:02 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:50:02 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 25 14:50:02 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:50:02 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Sep 25 14:50:02 2013 [Server] Peer Connection Initiated with [AF_INET]1.1.1.1:53
Wed Sep 25 14:50:04 2013 SENT CONTROL [Server]: 'PUSH_REQUEST' (status=1)
Wed Sep 25 14:50:04 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120'
Wed Sep 25 14:50:04 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Sep 25 14:50:04 2013 OPTIONS IMPORT: route options modified
Wed Sep 25 14:50:04 2013 OPTIONS IMPORT: route-related options modified
Wed Sep 25 14:50:04 2013 open_tun, tt->ipv6=0
Wed Sep 25 14:50:04 2013 TAP-WIN32 device [VPN] opened: \\.\Global\{BDABE420-B7D8-4569-B478-6A385BA87645}.tap
Wed Sep 25 14:50:04 2013 TAP-Windows Driver Version 9.9 
Wed Sep 25 14:50:04 2013 Successful ARP Flush on interface [24] {BDABE420-B7D8-4569-B478-6A385BA87645}
Wed Sep 25 14:50:04 2013 Extracted DHCP router address: 172.27.0.1
Wed Sep 25 14:50:04 2013 Extracted DHCP router address: 172.27.0.1
Wed Sep 25 14:50:08 2013 Extracted DHCP router address: 172.27.0.1
Wed Sep 25 14:50:08 2013 Extracted DHCP router address: 172.27.0.1
Wed Sep 25 14:50:09 2013 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Wed Sep 25 14:50:09 2013 C:\Windows\system32\route.exe ADD 1.1.1.1 MASK 255.255.255.255 10.5.208.1
Wed Sep 25 14:50:09 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=75]
Wed Sep 25 14:50:09 2013 Route addition via IPAPI failed [adaptive]
Wed Sep 25 14:50:09 2013 Route addition fallback to route.exe
Wed Sep 25 14:50:09 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
The route addition failed: The object already exists.

Wed Sep 25 14:50:09 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 172.27.0.1
Wed Sep 25 14:50:09 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=24]
Wed Sep 25 14:50:09 2013 Route addition via IPAPI failed [adaptive]
Wed Sep 25 14:50:09 2013 Route addition fallback to route.exe
Wed Sep 25 14:50:09 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
The route addition failed: The object already exists.

Wed Sep 25 14:50:09 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 172.27.0.1
Wed Sep 25 14:50:09 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=24]
Wed Sep 25 14:50:09 2013 Route addition via IPAPI failed [adaptive]
Wed Sep 25 14:50:09 2013 Route addition fallback to route.exe
Wed Sep 25 14:50:09 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
The route addition failed: The object already exists.

Wed Sep 25 14:50:09 2013 Initialization Sequence Completed

Server.log

Wed Sep 25 14:48:59 2013 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Wed Sep 25 14:48:59 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Wed Sep 25 14:48:59 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Sep 25 14:48:59 2013 Diffie-Hellman initialized with 1024 bit key
Wed Sep 25 14:48:59 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Sep 25 14:48:59 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:48:59 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:48:59 2013 TLS-Auth MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Sep 25 14:48:59 2013 Socket Buffers: R=[163840->131072] S=[163840->131072]
Wed Sep 25 14:48:59 2013 TUN/TAP device tap0 opened
Wed Sep 25 14:48:59 2013 TUN/TAP TX queue length set to 100
Wed Sep 25 14:48:59 2013 /etc/openvpn/up.sh br0 tap0 1500 1574   init
Wed Sep 25 14:48:59 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Sep 25 14:48:59 2013 GID set to nogroup
Wed Sep 25 14:48:59 2013 UID set to nobody
Wed Sep 25 14:48:59 2013 UDPv4 link local (bound): [undef]
Wed Sep 25 14:48:59 2013 UDPv4 link remote: [undef]
Wed Sep 25 14:48:59 2013 MULTI: multi_init called, r=256 v=256
Wed Sep 25 14:48:59 2013 Initialization Sequence Completed
Wed Sep 25 14:49:06 2013 MULTI: multi_create_instance called
Wed Sep 25 14:49:06 2013 216.199.70.37:24602 Re-using SSL/TLS context
Wed Sep 25 14:49:06 2013 216.199.70.37:24602 LZO compression initialized
Wed Sep 25 14:49:06 2013 216.199.70.37:24602 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Sep 25 14:49:06 2013 216.199.70.37:24602 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Sep 25 14:49:06 2013 216.199.70.37:24602 Local Options hash (VER=V4): '360696c5'
Wed Sep 25 14:49:06 2013 216.199.70.37:24602 Expected Remote Options hash (VER=V4): '13a273ba'
Wed Sep 25 14:49:06 2013 216.199.70.37:24602 TLS: Initial packet from [AF_INET]216.199.70.37:24602, sid=c101e75d 68b09616
Wed Sep 25 14:49:11 2013 216.199.70.37:24602 Replay-window backtrack occurred [1]
Wed Sep 25 14:49:16 2013 216.199.70.37:24602 VERIFY OK: depth=1, /C=US/ST=GA/L=Cumming/O=VPN/OU=VPN/CN=Server/name=Certificate/emailAddress=t@gmail.com
Wed Sep 25 14:49:16 2013 216.199.70.37:24602 VERIFY OK: depth=0, /C=US/ST=GA/L=Cumming/O=VPN/OU=VPN/CN=name/name=Certificate/emailAddress=@gmail.com
Wed Sep 25 14:49:23 2013 216.199.70.37:24602 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 25 14:49:23 2013 216.199.70.37:24602 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:49:23 2013 216.199.70.37:24602 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 25 14:49:23 2013 216.199.70.37:24602 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 25 14:49:23 2013 216.199.70.37:24602 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Sep 25 14:49:23 2013 216.199.70.37:24602 [Roger] Peer Connection Initiated with [AF_INET]216.199.70.37:24602
Wed Sep 25 14:49:23 2013 Roger/216.199.70.37:24602 MULTI: no dynamic or static remote --ifconfig address is available for Roger/216.199.70.37:24602
Wed Sep 25 14:49:24 2013 Roger/216.199.70.37:24602 PUSH: Received control message: 'PUSH_REQUEST'
Wed Sep 25 14:49:24 2013 Roger/216.199.70.37:24602 send_push_reply(): safe_cap=960
Wed Sep 25 14:49:24 2013 Roger/216.199.70.37:24602 SENT CONTROL [Roger]: 'PUSH_REPLY,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120' (status=1)
Wed Sep 25 14:49:25 2013 Roger/216.199.70.37:24602 MULTI: Learn: 00:ff:bd:ab:e4:20 -> Roger/216.199.70.37:24602
Wed Sep 25 14:53:38 2013 Roger/216.199.70.37:24602 [Roger] Inactivity timeout (--ping-restart), restarting
Wed Sep 25 14:53:38 2013 Roger/216.199.70.37:24602 SIGUSR1[soft,ping-restart] received, client-instance restarting

qcrist

I was under the impression that if I did not use any arguments for server bridge, the server would detect the settings and use the dhcp settings for the eth0 adapter. Is this incorrect?

EDIT:

If --server-bridge is used without any parameters, it will enable a DHCP-proxy mode, where connecting OpenVPN clients will receive an IP address for their TAP adapter from the DHCP server running on the OpenVPN server-side LAN. Note that only clients that support the binding of a DHCP client with the TAP adapter (such as Windows) can support this mode. The optional nogw flag (advanced) indicates that gateway information should not be pushed to the client.