Hi,
I have a strange issue, I have an OpenVPN server running in bridged mode on a virtual machine. The clients can connect to it fine, they can ping each other fine, whoever they cannot ping the server unless I restart the network twice...yep, once doesn't cut it. If once it is working I restart OpenVPN, it is broken again.
I ran tcpdump on both the server and a client, both on tap0, and noticed that the ARP requests are sent by the client and the server receives them but never sends a reply:
11:30:36.398324 ARP, Request who-has 10.1.0.1 tell 10.1.100.3, length 28
11:30:37.396225 ARP, Request who-has 10.1.0.1 tell 10.1.100.3, length 28
11:30:38.416565 ARP, Request who-has 10.1.0.1 tell 10.1.100.3, length 28
...
I checked my routes on the client and server and no difference when it works (after network is restarted twice) and when it doesn't.
Server (after 2x "service network restart"):
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 80.241.217.1 0.0.0.0 UG 0 0 0 br0
10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tap0
10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
80.241.217.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
Client (after 2x "service network restart" on the server then I connect to it):
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.100.2.1 0.0.0.0 UG 0 0 0 wlan0
10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tap0
10.100.2.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0
80.241.217.XXX 10.100.2.1 255.255.255.255 UGH 0 0 0 wlan0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tap0
Server (after "service openvpn restart"):
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 80.241.217.1 0.0.0.0 UG 0 0 0 br0
10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tap0
80.241.217.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
Client (after "service openvpn restart" on the server then I connect to it):
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.100.2.1 0.0.0.0 UG 0 0 0 wlan0
10.1.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tap0
10.100.2.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0
80.241.217.XXX 10.100.2.1 255.255.255.255 UGH 0 0 0 wlan0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tap0
Here is my server.conf:
port 1194
proto tcp
dev tap
ca /etc/openvpn/ca.crt
cert /etc/openvpn/MySrv.crt
key /etc/openvpn/MySrv.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.1.0.1 255.255.0.0 10.1.100.1 10.1.100.254
client-config-dir ccd
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
cipher BF-CBC # Blowfish (default)
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
mute 20
Here is my server's /etc/network/interfaces:
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto br0
iface br0 inet static
address 80.241.217.XXX
netmask 255.255.255.0
gateway 80.241.217.1
dns-nameservers 79.143.183.251 79.143.183.252
dns-search contabo.net
bridge_ports eth0
# VM specific options
bridge_fd 9 ## from the libvirt docs (forward delay time)
bridge_hello 2 ## from the libvirt docs (hello time)
bridge_maxage 12 ## from the libvirt docs (maximum message age)
bridge_stp off ## from the libvirt docs (spanning tree protocol)
auto eth0
iface eth0 inet manual
up ip link set $IFACE up promisc on
down ip link set $IFACE down promisc off
auto tap0
iface tap0 inet manual
up ip link set $IFACE up promisc on
up ip addr add 10.1.0.1/16 broadcast 10.1.255.255 dev $IFACE
down ip link set $IFACE down promisc off
I tried with up/down scripts instead of the manual tap0 config above but it didn't change anything, I get the same effect.
Thanks,
Gabriel
