Guys,
I am running the latest Raspbian on my Pi and have big troubles getting OpenVPN to work as a bridge. I can get a VPN tunnel working, but thats not what I want, I want a bridge. So I have tried half a dozen tutorials, including those on this side, with unsatisfactory success.
Right now my local IP net is 192.168.1.x and my Pi uses x=80 on the ethernet. I am using the scripts from this webside for server, client and bridge which look in my case:
Bridge start
#!/bin/bash
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.1.80"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.1.255"
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
Server.conf
port 1194
proto udp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key # This file should be kept secret
dh /etc/openvpn/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.80 255.255.255.0 192.168.1.100 192.168.1.199
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
And client
client
dev tap0
proto udp
remote <my puplic or my pi's private ip> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3
I have shutdown the linux firewall so that INPUT OUTPUT and FORWARD accept all packages. I have shutdown my clients firewall. I have opened all ports on my routers firewall. As part of my troubleshooting attemps I also added my routers LAN IP as a gateway, again to no success.
After I start my Pi I pgrep the openvpn process an kill it. Then I start the bridge and verify with brctl show that it is established between tap0 and eth0. After that I start the server with
sudo openvpn --config server.conf --daemon
When I configure my client to connect to 192.168.1.80 everything works smooth. When I configure my client to connect to the puplic IP of my internet router, I get a TLS handshake error.
I have installed wireshark on the Pi and on my client and it is obvious that any openvpn related messages are not getting through when I use puplic IP for the client. Whatever the client sents is not seen by the server and vice versa.
While this seems to be a potential router issue, I know, from the successfull openVPN tunnel, that the router does let udp communication on port 1194 pass. This is also confirmed by the routers firewall logfile which indicates that the package was passed. By forwarding all ports to the pi I am also sure that there is no communication going on on another port aside of 1194.
I am not exactly a linux geek so I have no idea in what ways raspbian can mess up my bridge. I need help here!
Thanks a lot guys!
