Configuration does not work?

[deleted]

Hey all!

I have a private network I'd like to connect to from outside with my laptop. As I need the networking funtionality inside of that network, I decided to build up an OpenVPN Bridged Network.Therefore I folllowed this manual: http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
Oh, the server has Ubuntu 12.04.

Unfortunately something is still missing. And I don't really have any idea what it could be. So hereby I'll post the configurations I think worth being mentioned, but please don't hesitate to ask for more detail if necessary.

Any idea what is failing?

server.conf:

port 1194
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server-bridge 10.10.10.2 255.255.255.0 10.10.10.200 10.10.10.254
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
up bridge-start.sh
down bridge-stop.sh

bridge-start.sh:

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
#eth_ip=$(ifconfig eth0 | grep "inet Adresse" | cut -d":" -f2 | cut -d" " -f1)
#eth_netmask=$(ifconfig eth0 | grep Mask | cut -d":" -f4)
#eth_broadcast=$(ifconfig eth0 | grep Bcast | cut -d":" -f3 | cut -d" " -f1)
eth_ip="10.10.10.2"
eth_netmask="255.255.255.0"
eth_broadcast="10.10.10.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

bridge-stop.sh:

#!/bin/bash

####################################
# Tear Down Ethernet bridge on Linux
####################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged together
tap="tap0"

ifconfig $br down
brctl delbr $br

for t in $tap; do
    openvpn --rmtun --dev $t
done

And now my test that fails:

myuser@server:~/openvpn$ sudo openvpn --config server.conf
[sudo] password for myuser: 
Mon Oct 28 20:59:53 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Mon Oct 28 20:59:53 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mon Oct 28 20:59:53 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Oct 28 20:59:53 2013 Diffie-Hellman initialized with 1024 bit key
Mon Oct 28 20:59:53 2013 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Oct 28 20:59:53 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Oct 28 20:59:53 2013 TUN/TAP device tap0 opened
Mon Oct 28 20:59:53 2013 TUN/TAP TX queue length set to 100
Mon Oct 28 20:59:53 2013 bridge-start.sh tap0 1500 1574   init
Mon Oct 28 20:59:53 2013 WARNING: External program may not be called unless '--script-security 2' or higher is enabled.  Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier.  See --help text or man page for detailed info.
Mon Oct 28 20:59:53 2013 WARNING: Failed running command (--up/--down): external program fork failed
Mon Oct 28 20:59:53 2013 Exiting

Now the second test that fails as well and throws me out of the shell because of connection loss:

myuser@server:~/openvpn$ sudo openvpn --config server.conf --script-security 2
Mon Oct 28 21:02:35 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Mon Oct 28 21:02:35 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mon Oct 28 21:02:35 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Oct 28 21:02:35 2013 Diffie-Hellman initialized with 1024 bit key
Mon Oct 28 21:02:35 2013 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Oct 28 21:02:35 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Oct 28 21:02:35 2013 TUN/TAP device tap0 opened
Mon Oct 28 21:02:35 2013 TUN/TAP TX queue length set to 100
Mon Oct 28 21:02:35 2013 bridge-start.sh tap0 1500 1574   init
Mon Oct 28 21:02:35 2013 Note: Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
Mon Oct 28 21:02:35 2013 Cannot ioctl TUNSETPERSIST(1) tap0: File descriptor in bad state (errno=77)
Mon Oct 28 21:02:35 2013 Exiting

[deleted]

Hey Debbie!

Thanks for you fast reply! I have tried your suggestion, but still I get errors. Seems there still is something that needs to be fixed. Here is what I did. Right after that command my SSH connection broke off and I had to restart the machine.

What's wrong?

myuser@server:~/openvpn$ sudo openvpn --config /home/myuser/openvpn/server.conf --script-security 2
Tue Oct 29 13:25:35 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Tue Oct 29 13:25:35 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Tue Oct 29 13:25:35 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Oct 29 13:25:35 2013 Diffie-Hellman initialized with 1024 bit key
Tue Oct 29 13:25:35 2013 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Oct 29 13:25:35 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Oct 29 13:25:35 2013 TUN/TAP device tap0 opened
Tue Oct 29 13:25:35 2013 TUN/TAP TX queue length set to 100
Tue Oct 29 13:25:35 2013 bridge-start.sh tap0 1500 1574   init
Tue Oct 29 13:25:36 2013 Note: Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
Tue Oct 29 13:25:36 2013 Cannot ioctl TUNSETPERSIST(1) tap0: File descriptor in bad state (errno=77)
Tue Oct 29 13:25:36 2013 Exiting

[deleted]

Well, I'm not sure exactly what you mean, but I set this in the bridge-start.sh:

eth_ip="10.10.10.2"
eth_netmask="255.255.255.0"
eth_broadcast="10.10.10.255"

Other than that the servers network has the following:
Server-IP: 10.10.10.2 (given by the DHCP-Router using the MAC-address)
Netmask: 255.255.255.0
Gateway: 10.10.10.1

I adapted the bridge settings to that.

Is there anything wrong in these settings?

[deleted]

>Tue Oct 29 13:25:36 2013 Note: Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
>Tue Oct 29 13:25:36 2013 Cannot ioctl TUNSETPERSIST(1) tap0: File descriptor in bad state (errno=77)
>Tue Oct 29 13:25:36 2013 Exiting
>I think this means you already have openvpn process running when you try to start another process. In bridge mode "dev tap" you can only have one instance using the br0 and tap0 devices.

So what shall I do or check? What information do you need to get the system running?

[deleted]

>Try rebooting . . .
Did that already.

>FYI: We support OpenVPN not your system.
I use a Virtual Machine with a fresh installation of Ubuntu 12.04 Server doing none-other than VPN with OpenVPN. A normal TUN works, though doesn't fit my needs. I need my Clients to be fully integrated into the network for printing, Samba with several different servers, gaming, etc.

I am sure that there must be a problem with my configuration, but I just don't know what to test. That's why I posted here.

[deleted]

>Your config is a bridged setup which will "integrate" your clients into your network, when you get it working.
Which is exactly what I am trying to have.

>If tap0 and udp port 1194 are already in use when you try to run openvpn you most likely have another vpn product running which is using the device and port. Have you installed any other vpn products before openvpn ?
Nope, fresh operating system installation having installed the following:

sudo apt-get -y install openvpn bridge-utils

In other words only OpenVPN and the Bridge-Utils are installed. The rest is only OpenVPN-configuration corresponding to this tutorial http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html.

I as well enabled the firewall:

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

Are you sure that the configuration I posted here is right? Are you sure that this is an operating system matter?

[deleted]

>>Are you sure that the configuration I posted here is right? Are you sure that this is an operating system matter?
>Yes i am sure.
Ok, that's good. So I'll concentrate on the scripts and bridge-creation.

I'll post it when I have news.

Thank you

[deleted]

>you cannot run your script from openvpn under any circumstances.
Ok, I took that to my heart.

Alright, I checked many things and my vpn-connection now works. The client can connect to the server. There were two problems before: 1st no running of scripts from .conf-files and 2nd no manual setting of the server ip instead of taking it from the DHCP as the Router might not forward packets anymore. This actually happened in my case and quite depends in the router used. AVM it is in my case.

Anyway, I still have a problem here! VPN-connection works, but my client can not reach any server inside of the destination network. Why is that? I'll post all my files. Where is the missconfiguration?

bridge-start.sh:

#!/bin/bash

br="br0"
tap="tap0"
eth="eth0"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

dhclient $br

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

server.conf:

port 1194
proto udp
dev tap
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/server.crt
key /home/myuser/openvpn/server.key
dh /home/myuser/openvpn/dh1024.pem
mode server
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
tls-server
tls-auth /home/myuser/openvpn/ta.key 0
verb 3

client.conf:

client
dev tap
proto udp
remote pentok.no-ip.biz 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/client1.crt
key /home/myuser/openvpn/client1.key
comp-lzo
tls-auth /home/myuser/openvpn/ta.key 1
verb 3

Output on the server side:

myuser@server:~$ sudo openvpn --config /home/myuser/openvpn/server.conf
Wed Oct 30 05:49:54 2013 TUN/TAP device tap0 opened
Wed Oct 30 05:49:54 2013 Persist state set to: ON
device br0 already exists; can't create bridge with the same name
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
device tap0 is already a member of a bridge; can't enslave it to bridge br0.
RTNETLINK answers: File exists
Wed Oct 30 05:49:55 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Wed Oct 30 05:49:55 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Oct 30 05:49:55 2013 Diffie-Hellman initialized with 1024 bit key
Wed Oct 30 05:49:55 2013 Control Channel Authentication: using '/home/myuser/openvpn/ta.key' as a OpenVPN static key file
Wed Oct 30 05:49:55 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 05:49:55 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 05:49:55 2013 TLS-Auth MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Oct 30 05:49:55 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Oct 30 05:49:55 2013 TUN/TAP device tap1 opened
Wed Oct 30 05:49:55 2013 TUN/TAP TX queue length set to 100
Wed Oct 30 05:49:55 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Oct 30 05:49:55 2013 UDPv4 link local (bound): [undef]
Wed Oct 30 05:49:55 2013 UDPv4 link remote: [undef]
Wed Oct 30 05:49:55 2013 MULTI: multi_init called, r=256 v=256
Wed Oct 30 05:49:55 2013 Initialization Sequence Completed

Output on the client side:

myuser@server:~$ sudo openvpn --config /home/myuser/openvpn/client.conf 
[sudo] password for myuser: 
Wed Oct 30 05:52:18 2013 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jul 12 2013
Wed Oct 30 05:52:18 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Oct 30 05:52:18 2013 Control Channel Authentication: using '/home/myuser/openvpn/ta.key' as a OpenVPN static key file
Wed Oct 30 05:52:18 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 05:52:18 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 05:52:18 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Oct 30 05:52:18 2013 UDPv4 link local: [undef]
Wed Oct 30 05:52:18 2013 UDPv4 link remote: [AF_INET]109.192.158.244:1194
Wed Oct 30 05:52:18 2013 TLS: Initial packet from [AF_INET]109.192.158.244:1194, sid=604d169d 0a38930e
Wed Oct 30 05:52:18 2013 VERIFY OK: depth=1, C=DE, ST=NC, L=Winston-Salem, O=Example Company, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Wed Oct 30 05:52:18 2013 VERIFY OK: depth=0, C=DE, ST=NC, L=Winston-Salem, O=Example Company, OU=changeme, CN=server, name=changeme, emailAddress=mail@host.domain
Wed Oct 30 05:52:18 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 30 05:52:18 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 05:52:18 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 30 05:52:18 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 05:52:18 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 30 05:52:18 2013 [server] Peer Connection Initiated with [AF_INET]109.192.158.244:1194
Wed Oct 30 05:52:21 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Oct 30 05:52:21 2013 PUSH: Received control message: 'PUSH_REPLY,ping 10,ping-restart 120'
Wed Oct 30 05:52:21 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Oct 30 05:52:21 2013 TUN/TAP device tap0 opened
Wed Oct 30 05:52:21 2013 TUN/TAP TX queue length set to 100
Wed Oct 30 05:52:21 2013 Initialization Sequence Completed

[deleted]

>I presume you understand why you cannot run your bridge-start.sh from within openvpn process ?
Actually not really. Why shouldn't that happen if the script is usefull like building a bridge in my case and releasing it when shutting down again? I believe security issues?

>You would do well to read the entire document not just that section.
I did read big parts, spent hours on it. It's just not the easiest most thematics.

>Connecting to LANs behind server/client: http://openvpn.net/index.php/open-source/documentation/howto.html#scope

Including multiple machines on the server side when using a bridged VPN (dev tap)
One of the benefits of using ethernet bridging is that you get this for free without needing any additional configuration.

This clearly states to me that it is not necessary to do anything about routes as clients in the destination network an be reached

without needing any additional configuration

.
Now I'm still not any further, clients still cannot be reached. I still tried to push routes, but this really seems to be quite senseless. Then I testwise changed from mode server to server-bridge 10.10.10.1 255.255.255.0 10.10.10.200 10.10.10.254. This gives my client the right route which it didn't have in mode server:

Destination            Router          Genmask         Flags Metric Ref    Use Iface
10.10.10.0      *               255.255.255.0   U     0      0        0 tap0

But this still does not change the fact, that I can not reach any client in the destination network. What's wrong? Where shall I look? Is it still the server.conf I have to check? I'm not expecting the servers firewall to be the reason as I set it already using iptables. Furthermore I believe the buildup-script bridge-start.sh to be correct. Where is the missing part?

[deleted]

>>Reading the manual we find
>Once the bridge interface has been created, and appropriate ethernet interfaces have been added to it, OpenVPN may be started.
That's good. I'm starting the bridge before openvpn starts the config.

>>But this still does not change the fact, that I can not reach any client in the destination network. What's wrong?
>I notice you have switched back to mode "server" in your server config . . . . Please decide what type of network you require and stick to that decision.
Yeah, this was because I didn't see no sence in setting the IP and Netmask as the DHCP server does that already with the bridge. So why set the same thing at several different places if this can be done automatically? Either way mode server or server-bridge ... both do not let my client communicate with the other computers in my destination network. Anyway, I set it back for this case here, so my current server configuration is this:

port 1194
proto udp
dev tap
dev-node tap-bridge
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/server.crt
key /home/myuser/openvpn/server.key
dh /home/myuser/openvpn/dh1024.pem
server-bridge 10.10.10.1 255.255.255.0 10.10.10.200 10.10.10.254
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
tls-server
tls-auth /home/server/openvpn/ta.key 0
verb 3

What's missing here? Why can't my client communicate with the other computers in the destination network?

[deleted]

>Posting client config would have helped.
Here you go.
client.conf:

client
dev tap
proto udp
remote pentok.no-ip.biz 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/client1.crt
key /home/myuser/openvpn/client1.key
comp-lzo
tls-auth /home/myuser/openvpn/ta.key 1
verb 3

server.conf:

port 1194
proto udp
dev tap
dev-node tap-bridge
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/server.crt
key /home/myuser/openvpn/server.key
dh /home/myuser/openvpn/dh1024.pem
server-bridge 10.10.10.1 255.255.255.0 10.10.10.200 10.10.10.254
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
tls-server
tls-auth /home/myuser/openvpn/ta.key 0
verb 3

>destination network ?
Yeah, well the network I want to reach. The target network. The network my server and other computers are in. Those I wish to reach with my client.

>please describe, ip address . . .
Here you go.
Client network:

IP: 172.20.169.134
Bcast: 172.20.169.255
Mask: 255.255.255.128
Gateway: 172.20.169.129

Server network:

IP: 10.10.10.2
Bcast: 10.10.10.255
Mask: 255.255.255.0
Gateway: 10.10.10.1

>I presume your client connects to the server successfully ?
Yes. Here are the logs.
Start-script for the server:

myuser@server:~$ cat start-openvpn.sh 
#!/bin/bash

/home/myuser/openvpn/bridge-start.sh
openvpn --config /home/myuser/openvpn/server.conf

Server log:

myuser@server:~$ sudo ./start-openvpn.sh 
[sudo] password for myuser: 
Wed Oct 30 22:26:24 2013 TUN/TAP device tap0 opened
Wed Oct 30 22:26:24 2013 Persist state set to: ON
Wed Oct 30 22:26:26 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Wed Oct 30 22:26:26 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Wed Oct 30 22:26:26 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Oct 30 22:26:26 2013 Diffie-Hellman initialized with 1024 bit key
Wed Oct 30 22:26:26 2013 Control Channel Authentication: using '/home/myuser/openvpn/ta.key' as a OpenVPN static key file
Wed Oct 30 22:26:26 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:26:26 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:26:26 2013 TLS-Auth MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Oct 30 22:26:26 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Oct 30 22:26:26 2013 Note: Cannot open TUN/TAP dev tap-bridge: No such file or directory (errno=2)
Wed Oct 30 22:26:26 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Oct 30 22:26:26 2013 UDPv4 link local (bound): [undef]
Wed Oct 30 22:26:26 2013 UDPv4 link remote: [undef]
Wed Oct 30 22:26:26 2013 MULTI: multi_init called, r=256 v=256
Wed Oct 30 22:26:26 2013 IFCONFIG POOL: base=10.10.10.200 size=55, ipv6=0
Wed Oct 30 22:26:26 2013 Initialization Sequence Completed
Wed Oct 30 22:29:31 2013 MULTI: multi_create_instance called
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 Re-using SSL/TLS context
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 LZO compression initialized
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 Local Options hash (VER=V4): '360696c5'
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 Expected Remote Options hash (VER=V4): '13a273ba'
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 TLS: Initial packet from [AF_INET]141.70.81.152:21580, sid=baad334e 24ba5b74
Wed Oct 30 22:29:31 2013 141.70.81.152:21580 Replay-window backtrack occurred [2]
Wed Oct 30 22:30:03 2013 141.70.81.152:21580 VERIFY OK: depth=1, /C=DE/ST=NC/L=Winston-Salem/O=Example_Company/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Wed Oct 30 22:30:03 2013 141.70.81.152:21580 VERIFY OK: depth=0, /C=DE/ST=NC/L=Winston-Salem/O=Example_Company/OU=changeme/CN=client1/name=changeme/emailAddress=mail@host.domain
Wed Oct 30 22:30:05 2013 141.70.81.152:21580 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 30 22:30:05 2013 141.70.81.152:21580 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:30:05 2013 141.70.81.152:21580 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 30 22:30:05 2013 141.70.81.152:21580 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:30:05 2013 141.70.81.152:21580 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 30 22:30:05 2013 141.70.81.152:21580 [client1] Peer Connection Initiated with [AF_INET]141.70.81.152:21580
Wed Oct 30 22:30:05 2013 client1/141.70.81.152:21580 MULTI_sva: pool returned IPv4=10.10.10.200, IPv6=1::1b00:0:ec7f:0
Wed Oct 30 22:30:10 2013 client1/141.70.81.152:21580 PUSH: Received control message: 'PUSH_REQUEST'
Wed Oct 30 22:30:10 2013 client1/141.70.81.152:21580 send_push_reply(): safe_cap=960
Wed Oct 30 22:30:10 2013 client1/141.70.81.152:21580 SENT CONTROL [client1]: 'PUSH_REPLY,route-gateway 10.10.10.1,ping 10,ping-restart 120,ifconfig 10.10.10.200 255.255.255.0' (status=1)

Start-script for the client:

myuser@client:~$ cat start-openvpn.sh 
#!/bin/bash

openvpn --config /home/myuser/openvpn/client.conf

Client log:

myuser@client:~$ sudo ./start-openvpn.sh 
[sudo] password for myuser: 
Wed Oct 30 22:29:31 2013 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jul 12 2013
Wed Oct 30 22:29:31 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Oct 30 22:29:31 2013 Control Channel Authentication: using '/home/myuser/openvpn/ta.key' as a OpenVPN static key file
Wed Oct 30 22:29:31 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:29:31 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:29:31 2013 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Oct 30 22:29:31 2013 UDPv4 link local: [undef]
Wed Oct 30 22:29:31 2013 UDPv4 link remote: [AF_INET]109.192.158.244:1194
Wed Oct 30 22:29:31 2013 TLS: Initial packet from [AF_INET]109.192.158.244:1194, sid=bf3309b7 25cdaf3f
Wed Oct 30 22:29:39 2013 VERIFY OK: depth=1, C=DE, ST=NC, L=Winston-Salem, O=Example Company, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Wed Oct 30 22:29:39 2013 VERIFY OK: depth=0, C=DE, ST=NC, L=Winston-Salem, O=Example Company, OU=changeme, CN=server, name=changeme, emailAddress=mail@host.domain
Wed Oct 30 22:30:05 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 30 22:30:05 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:30:05 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 30 22:30:05 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 30 22:30:08 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 30 22:30:08 2013 [server] Peer Connection Initiated with [AF_INET]109.192.158.244:1194
Wed Oct 30 22:30:10 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Oct 30 22:30:10 2013 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.10.10.1,ping 10,ping-restart 120,ifconfig 10.10.10.200 255.255.255.0'
Wed Oct 30 22:30:10 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Oct 30 22:30:10 2013 OPTIONS IMPORT: --ifconfig/up options modified
Wed Oct 30 22:30:10 2013 OPTIONS IMPORT: route-related options modified
Wed Oct 30 22:30:10 2013 TUN/TAP device tap0 opened
Wed Oct 30 22:30:10 2013 TUN/TAP TX queue length set to 100
Wed Oct 30 22:30:10 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Oct 30 22:30:10 2013 /sbin/ip link set dev tap0 up mtu 1500
Wed Oct 30 22:30:10 2013 /sbin/ip addr add dev tap0 10.10.10.200/24 broadcast 10.10.10.255
Wed Oct 30 22:30:10 2013 Initialization Sequence Completed

Now the test from the client:

myuser@client:~$ ping 10.10.10.1
PING 10.10.10.1 (10.10.10.1) 56(84) bytes of data.
From 10.10.10.200 icmp_seq=1 Destination Host Unreachable
From 10.10.10.200 icmp_seq=2 Destination Host Unreachable
From 10.10.10.200 icmp_seq=3 Destination Host Unreachable
From 10.10.10.200 icmp_seq=4 Destination Host Unreachable
From 10.10.10.200 icmp_seq=5 Destination Host Unreachable
From 10.10.10.200 icmp_seq=6 Destination Host Unreachable
^C
--- 10.10.10.1 ping statistics ---
7 packets transmitted, 0 received, +6 errors, 100% packet loss, time 6030ms
pipe 3

[deleted]

>Can you ping the server on 10.10.10.2 . . from the client ?
No, I can't:

myuser@client:~$ ping 10.10.10.2
PING 10.10.10.2 (10.10.10.2) 56(84) bytes of data.
From 10.10.10.200 icmp_seq=1 Destination Host Unreachable
From 10.10.10.200 icmp_seq=2 Destination Host Unreachable
From 10.10.10.200 icmp_seq=3 Destination Host Unreachable
^C
--- 10.10.10.2 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 3999ms
pipe 4

Any suggestion?

[deleted]

>Your bridge is STILL not setup correctly.
Oh bugger. I thought that worked. Ok, maybe I could set the bridge permantly in the /etc/network/interfaces instead of using the bridge-start.sh script.

So what exactly do I the the bridge to do?

I suppose:
- Create a tap0 interface
- Create a br0 interface (the bridge)
- Connect all three with the eth0 interface (the main ethernet interface)
- Done?

Is that it? Or do I need more?

[deleted]

Hey Debbie!

Ok, followed the the link, but something is still going wrong.
The problem is in the bridge-start-script. As it gives the bridge its own IP (10.10.10.2 in my case) the DHCP-Server (the router of the network) does not let the entire machine leave the LAN anymore. As well the DHCP-Server does not forward any packets anymore to the machine at all. Meaning that I nead to change the script so that it does not set its own IP. Instead it must ask its IP from the DHCP-Server.
Do you know how to do that?
My current bridge-start-script is this (pretty much a copy from here->http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html):

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="10.10.10.2"
eth_netmask="255.255.255.0"
eth_broadcast="10.10.10.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT