I have openvpn running on my root server in tap-mode. The goal is to connect some networks together as well as providing access to mobile clients. This is my network layout:
Server: 10.0.0.1/16
Road-warriors: 10.0.0.151-10.0.0.250
Net 1: 10.0.1.0/16 (Gateway 1: 10.0.1.254)
Net 2: 10.0.2.0/16 (Gateway 2: 10.0.2.254)
etc.
This is the server config (I removed the Encryption part):
mode server
port 1194
proto udp
dev tap0
ifconfig 10.0.0.1 255.255.0.0
ifconfig-pool 10.0.0.151 10.0.0.250 255.255.0.0
push "route 10.0.0.0 255.255.0.0"
push "dhcp-option DNS 10.0.0.1"
daemon
tls-server
comp-lzo
persist-key
persist-tun
And this the config of Gateway 1:
daemon
remote vpn.example.com 1194 udp
dev tap0
persist-tun
persist-key
comp-lzo
tls-client
tap0 is manually bridged with the lan interface. The configuration looks similar on the other gateways. Gateway 1 is an Ubuntu Server, the other gateways are FritzBox clients running OpenVPN via Freetz. Network works perfect, I can reach every client in all nets and the server (and vice versa).
The problem is that on every net there is an dedicated DHCP-Server. Of course the DHCP requests are transported over the bridge. I played around with ebtables and it works like a charm on the Ubuntu client. However, running ebtables on the FritzBox clients is not possible (not with the models I use). So the obvious idea is to filter DHCP requests on the server. As far as I understand it is necessary to disable client-to-client as otherwise the data is routed internally in the openvpn process. In this case all packets are exposed to the tap interface. At the moment that's where it ends, the packets don't get re-injected to travel to the other network. So I can reach the server, but not other networks. Is there a way to accomplish this?
Thanks in advance
Manu
Edit: I have not configured iptables on the server:
server:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
