can I improove this working config?

mjosh

Some games require a LAN connection for multiplayer. My goal is to use the Internet and allow me, and a few friends, to play such games.

I have a Linux box inside the house and right now I'll be using that as the VPN server. It helps that a couple of those games can run under the same Linux box, but I've set up my configuration so that all clients can connect with each other. So, in the future, any one of us can host a listen-server, while that box remains the VPN server.

I've managed to configure the server and the client, and I'm using issued certificates for authentication. I've set up my PKI with easy-rsa (it makes things so much easier) and things work.

This isn't a request to make it work. I'm posting so that someone can check my configs and tell me if I've done something stupid without realizing, or that I haven't forgoten an option that would make things better (more secure, faster, simpler). There are also two questions at the end.

Server config:

cd /etc/openvpn
proto udp
port 40096
log-append /var/log/openvpn.log
daemon
dev tun0
server 10.1.0.0 255.255.255.0
client-to-client
cipher AES-256-CBC
ca certs/ca.crt
dh dh.pem
cert certs/server.crt
key keys/server.key
user nobody
group nobody
management localhost 7505

Client config:

client
dev tun
proto udp
remote example.dyndns.com 40096
remote example.no-ip.com 40096
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
verb 3
remote-cert-tls server

The questions:

1. With this setup, if any of the client hosts a server, will the rest of the clients (and the server itself) be able to connect to it?

2. The HOWTO says that the deamon needs to restart if the IP address changes. Is that still true?

mjosh

I'm reading the bridge mode howto, and I can't start the server! I get this error on openvpn.log:

Options error: --server-bridge IP addresses 10.0.0.3 and 10.1.0.2 are not in the same 255.255.255.0 subnet

I have static IP addresses on my physical LAN, and I've placed them on the 10.0.0.X range. I want the VPN to run in the 10.1.0.X range. My router is instructed to give a DHCP address (beginning on 10.0.0.30) on machines that don't have a static IP.

This worked with tun0 but I can't get it to work on tap0.

Server config:

proto udp
port 40096
log-append /var/log/openvpn.log
daemon
dev tap0
server-bridge 10.0.0.3 255.255.255.0 10.1.0.2 10.1.0.20
client-to-client
cipher AES-256-CBC
ca certs/ca.crt
dh dh.pem
cert certs/server.crt
key keys/server.key
user nobody
group nobody
management localhost 7505

(There is no point giving a client config, I couldn't start the server.)

ifconfig before the brigde-start.sh script:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.0.3  netmask 255.255.255.0  broadcast 10.0.0.255
        inet6 fe80::280:48ff:fe32:3ba  prefixlen 64  scopeid 0x20<link>
        ether 00:80:48:32:03:ba  txqueuelen 1000  (Ethernet)
        RX packets 3419  bytes 425642 (415.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4460  bytes 4470400 (4.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 40  bytes 2144 (2.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 40  bytes 2144 (2.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ifconfig after the bridge-start.sh script:

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.0.3  netmask 255.255.255.0  broadcast 10.0.0.255
        inet6 fe80::280:48ff:fe32:3ba  prefixlen 64  scopeid 0x20<link>
        ether 00:80:48:32:03:ba  txqueuelen 0  (Ethernet)
        RX packets 15  bytes 1254 (1.2 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 17  bytes 1674 (1.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet6 fe80::280:48ff:fe32:3ba  prefixlen 64  scopeid 0x20<link>
        ether 00:80:48:32:03:ba  txqueuelen 1000  (Ethernet)
        RX packets 3601  bytes 441697 (431.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4678  bytes 4648908 (4.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 40  bytes 2144 (2.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 40  bytes 2144 (2.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tap0: flags=4355<UP,BROADCAST,PROMISC,MULTICAST>  mtu 1500
        ether 6a:57:b8:9a:75:2c  txqueuelen 100  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

What am I missing?

mjosh

Thanks! That made it work.

debbie10t wroteTime to consult the Howto's and the Manual.

It helps to know what I should look be looking for inside the howtos and manuals. Where is the mistake. I didn't know that this is how bridging works. Now I do. I made that small change and the server started.

Are you trying to tell me that you wish to disengage from this thread?

mjosh

debbie10t wroteYou were trying to use server-bridge so why not try Google: Openvpn server-bridge howto - You would have found all you needed to know in the #1 slot on google

Well, the answer was right in front of my eyes, on the official howto I was reading to make the bridging, and I still missed it!

debbie10t wroteWhich change did you make .. did you make your clients part of the 10.0 subnet or change to using server only ?

I made a change on the server config. I changed this:

server-bridge 10.0.0.3 255.255.255.0 10.1.0.2 10.1.0.20

Into this:

server-bridge 10.0.0.3 255.255.255.0 10.0.0.50 10.0.0.150

So, my whole server config is now this:

cd /etc/openvpn
proto udp
port 40096
log-append /var/log/openvpn.log
daemon
dev tap0
server-bridge 10.0.0.3 255.255.255.0 10.0.0.50 10.0.0.60
client-to-client
cipher AES-256-CBC
ca certs/ca.crt
dh dh.pem
cert certs/server.crt
key keys/server.key
user nobody
group nobody
management localhost 7505
keepalive 10 120

Now I have another issue.
After starting the server, I used this config on a WinXP client:

client
dev tap
proto udp
remote host1 40096
remote host2 40096
resolv-retry infinite
nobind
persist-key
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
verb 3
remote-cert-tls server
ifconfig 10.0.0.51 255.255.255.0
ifconfig-nowarn

But it couldn't connect. It gave this error (from the client log):

Wed Feb 05 17:49:17 2014 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Feb 05 17:49:17 2014 WARNING: using --pull/--client and --ifconfig together is probably not what you want
Wed Feb 05 17:49:17 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Feb 05 17:49:17 2014 UDPv4 link local: [undef]
Wed Feb 05 17:49:17 2014 UDPv4 link remote: [AF_INET]10.0.0.3:40096
Wed Feb 05 17:49:17 2014 TLS: Initial packet from [AF_INET]10.0.0.3:40096, sid=1afe0dcb 1b6ab1cb
Wed Feb 05 17:49:18 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Wed Feb 05 17:49:18 2014 Validating certificate key usage
Wed Feb 05 17:49:18 2014 ++ Certificate has key usage  00a0, expects 00a0
Wed Feb 05 17:49:18 2014 VERIFY KU OK
Wed Feb 05 17:49:18 2014 Validating certificate extended key usage
Wed Feb 05 17:49:18 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Feb 05 17:49:18 2014 VERIFY EKU OK
Wed Feb 05 17:49:18 2014 VERIFY OK: depth=0, CN=server
Wed Feb 05 17:49:18 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Feb 05 17:49:18 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 05 17:49:18 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Feb 05 17:49:18 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 05 17:49:18 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 05 17:49:18 2014 [server] Peer Connection Initiated with [AF_INET]10.0.0.3:40096
Wed Feb 05 17:49:21 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Feb 05 17:49:21 2014 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.3,ping 10,ping-restart 120,ifconfig 10.0.0.50 255.255.255.0'
Wed Feb 05 17:49:21 2014 OPTIONS IMPORT: timers and/or timeouts modified
Wed Feb 05 17:49:21 2014 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 05 17:49:21 2014 OPTIONS IMPORT: route-related options modified
Wed Feb 05 17:49:21 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 05 17:49:21 2014 open_tun, tt->ipv6=0
Wed Feb 05 17:49:21 2014 TAP-WIN32 device [Local Area Connection 9] opened: \\.\Global\{6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}.tap
Wed Feb 05 17:49:21 2014 TAP-Windows Driver Version 9.9 
Wed Feb 05 17:49:21 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.0.50/255.255.255.0 on interface {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B} [DHCP-serv: 10.0.0.0, lease-time: 31536000]
Wed Feb 05 17:49:21 2014 Successful ARP Flush on interface [327683] {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}
Wed Feb 05 17:49:26 2014 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Wed Feb 05 17:49:26 2014 Route: Waiting for TUN/TAP interface to come up...
Wed Feb 05 17:49:31 2014 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Wed Feb 05 17:49:31 2014 Route: Waiting for TUN/TAP interface to come up...

I got the hint, so I went over the Network Connections and bridge the physical Ethernet adapter to the virtual OpenVPN adapter. And it worked.

However, I'm reading this document, and the way I interpret it, it sais that OpenVPN can do the bridging for me, instead of me doing it manually.

Can OpenVPN do the bridging for me?

Here is two more questions.

1- Does my current configuration allow for broadcasts?

I'm asking this because I've tested this configuration with Counter-Strike Source, but I couldn't see any servers on LAN. I can connect with a direct IP though. So I need to know if my OpenVPN configuration is at fault or the game itself.

2- I've set up my physical LAN on the 10.0.0.X range. Now I'm trying to set up a bridged VPN on the same range. What happens if my friends have their LAN on the 192.168.0.X range? Will they be able to connect? Just point me to the right document or give me some keywords, and I'll take it from there (until I get stuck again 😛).