[Resolved] openvpn, vmware and arp

SlowFox

I have the following setup: network 192.168.1.0/24 with one vmware machine containing three hosts (gateway/firewall, vpn-server and one generic linux host) and about one dozen workstations plus some printers. The vpn-server should allow two (Windows) notebooks to bridge into the network from the outside.

Vpn-setup was pretty much straight-forward and is working int erms of:

remote notebook can connect through the gateway/firewall to the VPN server and establish a connection
remote notebook can access (with its LAN ip-address) the gateway, the vpn-server (well, of course) and the third vmware host
remote notebook can access the internet via the LAN (redirect-gateway) pretending to the outside world to be physically there

Thus I assume the openvpn-setup cannot be completely wrong.

However the remote PC can not reach anything inside the local LAN which is outside the vmware host. I googled for this problem and found "enable promiscuous mode an the vmware-server" which is definitely a good idea. However, even with that nothing on the lan can be reached. If I do a tcpdump on the vpn-server I can see the following things (vpn01 is the remote PC, vhost1 is the other virtual host on the vmware server and lanhost01 is an arbitrary host on the physical LAN):

Traffic on TAP:

root@vpn:~# tcpdump -i tap0 arp and host vpn01
tcpdump: WARNING: tap0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
11:40:10.535748 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 28
11:40:10.536247 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 46
[ARP reply is missing here]
[several unanswered ARP requests snipped]
11:40:21.219887 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 28
11:40:21.220042 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 46
11:40:28.279701 ARP, Request who-has vhost1.intern tell vpn01.intern, length 28
11:40:28.280091 ARP, Reply vhost1.intern is-at 00:0c:29:dd:67:20 (oui Unknown), length 46
11:40:28.280098 ARP, Request who-has vhost1.intern tell vpn01.intern, length 46
11:40:33.309777 ARP, Request who-has vpn01.intern tell vhost1.intern, length 46
11:40:34.313523 ARP, Request who-has vpn01.intern tell vhost1.intern, length 46
11:40:34.373456 ARP, Reply vpn01.intern is-at 00:ff:91:07:e5:af (oui Unknown), length 28
11:40:34.377934 ARP, Reply vpn01.intern is-at 00:ff:91:07:e5:af (oui Unknown), length 28

Traffic on the bridge:

root@vpn:~# tcpdump -i br0 arp and host vpn01
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 65535 bytes
11:40:10.535758 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 28
11:40:10.536252 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 46
11:40:10.536653 ARP, Reply lanhost1.intern is-at 00:24:81:e6:da:0f (oui Unknown), length 46
[several answered ARP requests snipped]
11:40:21.219897 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 28
11:40:21.220046 ARP, Request who-has lanhost1.intern tell vpn01.intern, length 46
11:40:21.220416 ARP, Reply lanhost1.intern is-at 00:24:81:e6:da:0f (oui Unknown), length 46
11:40:28.279713 ARP, Request who-has vhost1.intern tell vpn01.intern, length 28
11:40:28.280095 ARP, Reply vhost1.intern is-at 00:0c:29:dd:67:20 (oui Unknown), length 46
11:40:28.280099 ARP, Request who-has vhost1.intern tell vpn01.intern, length 46
11:40:33.309783 ARP, Request who-has vpn01.intern tell vhost1.intern, length 46
11:40:34.313531 ARP, Request who-has vpn01.intern tell vhost1.intern, length 46
11:40:34.373465 ARP, Reply vpn01.intern is-at 00:ff:91:07:e5:af (oui Unknown), length 28
11:40:34.377942 ARP, Reply vpn01.intern is-at 00:ff:91:07:e5:af (oui Unknown), length 28

Definition of the interfaces is:

root@vpn:~# ifconfig br0
br0       Link encap:Ethernet  HWaddr 00:0c:29:51:aa:cd  
          inet addr:192.168.1.246  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe51:aacd/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1189694 errors:0 dropped:57 overruns:0 frame:0
          TX packets:439154 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:128296307 (122.3 MiB)  TX bytes:27968843 (26.6 MiB)

root@vpn:~# ifconfig tap0
tap0      Link encap:Ethernet  HWaddr 32:87:80:6e:78:4a  
          inet6 addr: fe80::3087:80ff:fe6e:784a/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:4846 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2719905 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:620135 (605.6 KiB)  TX bytes:239787741 (228.6 MiB)

AFAICS (but unfortunately I am not a network expert) most things work fine: the ping is sent from the remote PC to the vpn-server, is relayed to the LAN, reaches its target and is answered. The answer even reaches the vpn-server, but it is not forwarded to the remote PC from there (however I can ping the remote PC if I sit directly on the vpn-server). If I ping a host on the LAN (which has been done at 11:40:28) things work fine.

I have no idea why ARP replies coming from the physical world to the vmware network are treated different than ARP replies coming from inside the vmware LAN. As stated before promiscuous mode is enabled for that vmware interface.

Actually this is most likely not a openvpn problem, however I suspect that more people here have experience with this kind of setup than they have in the vmware world. If any of the configuration files could be helpful to nail this down, please ask and I will post them (it is just that I have no idean which part of the configuration should be relevant for this case and I don't want to post them all at once).

SlowFox

Well, let's give it a try (if I miss something relevant, please tell me - there is nothing more I can think of right now).

VPN Server

server.conf:

local 192.168.1.246
port 1194
proto udp
dev tap0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/vpnserver.crt
key /etc/openvpn/keys/vpnserver.key
dh /etc/openvpn/keys/dh1024.pem
server-bridge 192.168.1.246 255.255.255.0 192.168.1.101 192.168.1.110
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.1.245"
push "redirect-gateway def1 bypass-dhcp"
push "route 192.168.1.0 255.255.255.0"
push "route-gateway 192.168.1.1"
client-to-client
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3

Interfaces:

root@vpn:~# ifconfig
br0       Link encap:Ethernet  HWaddr 00:0c:29:51:aa:cd  
          inet addr:192.168.1.246  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe51:aacd/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1255161 errors:0 dropped:57 overruns:0 frame:0
          TX packets:456519 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:136605039 (130.2 MiB)  TX bytes:29148123 (27.7 MiB)

eth0      Link encap:Ethernet  HWaddr 00:0c:29:51:aa:cd  
          inet6 addr: fe80::20c:29ff:fe51:aacd/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:1797733428 errors:0 dropped:32273 overruns:0 frame:0
          TX packets:460160 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1716319327886 (1.5 TiB)  TX bytes:29640113 (28.2 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0      Link encap:Ethernet  HWaddr 32:87:80:6e:78:4a  
          inet6 addr: fe80::3087:80ff:fe6e:784a/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:4846 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2826052 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:620135 (605.6 KiB)  TX bytes:251454455 (239.8 MiB)

Routing:

root@vpn:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 br0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0

Iptables:

root@vpn:~# iptables -L -v -x
Chain INPUT (policy ACCEPT 507243 packets, 49291909 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 118548 packets, 36267251 bytes)
    pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 414196 packets, 20480814 bytes)
    pkts      bytes target     prot opt in     out     source               destination

netstat:

root@vpn:~# netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:52995           0.0.0.0:*               LISTEN     
tcp        0    368 192.168.1.246:22        192.168.1.1:39005       ESTABLISHED
tcp6       0      0 :::111                  :::*                    LISTEN     
tcp6       0      0 :::39381                :::*                    LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
tcp6       0      0 ::1:25                  :::*                    LISTEN     
udp        0      0 0.0.0.0:47567           0.0.0.0:*                          
udp        0      0 0.0.0.0:1016            0.0.0.0:*                          
udp        0      0 0.0.0.0:111             0.0.0.0:*                          
udp        0      0 127.0.0.1:624           0.0.0.0:*                          
udp        0      0 192.168.1.246:1194      0.0.0.0:*                          
udp6       0      0 :::1016                 :::*                               
udp6       0      0 :::111                  :::*                               
udp6       0      0 :::51380                :::*                               
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     SEQPACKET  LISTENING     2559     /run/udev/control
unix  2      [ ACC ]     STREAM     LISTENING     4733     /var/run/rpcbind.sock
unix  6      [ ]         DGRAM                    5065     /dev/log
unix  2      [ ACC ]     STREAM     LISTENING     5094     /var/run/acpid.socket
unix  2      [ ]         DGRAM                    21467    
unix  2      [ ]         DGRAM                    21454    
unix  2      [ ]         DGRAM                    21451    
unix  3      [ ]         STREAM     CONNECTED     21373    
unix  3      [ ]         STREAM     CONNECTED     21372    
unix  2      [ ]         DGRAM                    21371    
unix  2      [ ]         DGRAM                    5091     
unix  3      [ ]         STREAM     CONNECTED     4849     
unix  3      [ ]         STREAM     CONNECTED     4848     
unix  3      [ ]         DGRAM                    2566     
unix  3      [ ]         DGRAM                    2565

/var/log/openvpn.log

Sun Apr 13 10:14:41 2014 MULTI: multi_create_instance called
Sun Apr 13 10:14:41 2014 188.23.45.162:51366 Re-using SSL/TLS context
Sun Apr 13 10:14:41 2014 188.23.45.162:51366 LZO compression initialized
Sun Apr 13 10:14:41 2014 188.23.45.162:51366 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Apr 13 10:14:41 2014 188.23.45.162:51366 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Apr 13 10:14:41 2014 188.23.45.162:51366 Local Options hash (VER=V4): 'f7df56b8'
Sun Apr 13 10:14:41 2014 188.23.45.162:51366 Expected Remote Options hash (VER=V4): 'd79ca330'
Sun Apr 13 10:14:41 2014 188.23.45.162:51366 TLS: Initial packet from [AF_INET]188.23.45.162:51366, sid=618a4452 5fa6d9f8
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 VERIFY OK: depth=1, [snipped]
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 VERIFY OK: depth=0, [snipped]
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Apr 13 10:14:42 2014 188.23.45.162:51366 [notebook] Peer Connection Initiated with [AF_INET]188.23.45.162:51366
Sun Apr 13 10:14:42 2014 notebook/188.23.45.162:51366 MULTI_sva: pool returned IPv4=192.168.1.101, IPv6=1::2000:0:757f:0
Sun Apr 13 10:14:44 2014 notebook/188.23.45.162:51366 PUSH: Received control message: 'PUSH_REQUEST'
Sun Apr 13 10:14:44 2014 notebook/188.23.45.162:51366 send_push_reply(): safe_cap=960
Sun Apr 13 10:14:44 2014 notebook/188.23.45.162:51366 SENT CONTROL [notebook]: 'PUSH_REPLY,dhcp-option DNS 192.168.1.245,redirect-gateway def1 bypass-dhcp,route 192.168.1.0 255.255.255.0,route-gateway 192.168.1.1,route-gateway 192.168.1.246,ping 10,ping-restart 120,ifconfig 192.168.1.101 255.255.255.0' (status=1)
Sun Apr 13 10:14:44 2014 notebook/188.23.45.162:51366 MULTI: Learn: 00:ff:91:07:e5:af -> notebook/188.23.45.162:51366
Sun Apr 13 10:21:57 2014 notebook/188.23.45.162:51366 [notebook] Inactivity timeout (--ping-restart), restarting
Sun Apr 13 10:21:57 2014 notebook/188.23.45.162:51366 SIGUSR1[soft,ping-restart] received, client-instance restarting

ping to client:

sfroehli@vpn:~$ ping 192.168.1.101
PING 192.168.1.101 (192.168.1.101) 56(84) bytes of data.
64 bytes from 192.168.1.101: icmp_req=1 ttl=128 time=31.3 ms
64 bytes from 192.168.1.101: icmp_req=2 ttl=128 time=31.2 ms
64 bytes from 192.168.1.101: icmp_req=3 ttl=128 time=35.2 ms
64 bytes from 192.168.1.101: icmp_req=4 ttl=128 time=34.8 ms
64 bytes from 192.168.1.101: icmp_req=5 ttl=128 time=35.1 ms
64 bytes from 192.168.1.101: icmp_req=6 ttl=128 time=29.5 ms
64 bytes from 192.168.1.101: icmp_req=7 ttl=128 time=37.8 ms
^C
--- 192.168.1.101 ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6009ms
rtt min/avg/max/mdev = 29.534/33.611/37.849/2.726 ms

ping to virtual server on the same vmware server:

sfroehli@vpn:~$ ping 192.168.1.245
PING 192.168.1.245 (192.168.1.245) 56(84) bytes of data.
64 bytes from 192.168.1.245: icmp_req=1 ttl=64 time=0.185 ms
64 bytes from 192.168.1.245: icmp_req=2 ttl=64 time=0.114 ms
64 bytes from 192.168.1.245: icmp_req=3 ttl=64 time=0.204 ms
64 bytes from 192.168.1.245: icmp_req=4 ttl=64 time=0.128 ms
^C
--- 192.168.1.245 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2997ms
rtt min/avg/max/mdev = 0.114/0.157/0.204/0.040 ms

ping to physical server on the same lan:

sfroehli@vpn:~$ ping 192.168.1.220
PING 192.168.1.220 (192.168.1.220) 56(84) bytes of data.
64 bytes from 192.168.1.220: icmp_req=1 ttl=60 time=0.624 ms
64 bytes from 192.168.1.220: icmp_req=2 ttl=60 time=0.602 ms
64 bytes from 192.168.1.220: icmp_req=3 ttl=60 time=0.583 ms
64 bytes from 192.168.1.220: icmp_req=4 ttl=60 time=0.629 ms
64 bytes from 192.168.1.220: icmp_req=5 ttl=60 time=0.592 ms
^C
--- 192.168.1.220 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3996ms
rtt min/avg/max/mdev = 0.583/0.606/0.629/0.017 ms

Client

client
dev tap
proto udp
remote [hidden]
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.cer
cert notebook.cer
key notebook.key
comp-lzo
verb 3

ipconfig

Windows-IP-Konfiguration

   Hostname  . . . . . . . . . . . . : ikarus
   Prim<84>res DNS-Suffix . . . . . . . : 
   Knotentyp . . . . . . . . . . . . : Hybrid
   IP-Routing aktiviert  . . . . . . : Nein
   WINS-Proxy aktiviert  . . . . . . : Nein
   DNS-Suffixsuchliste . . . . . . . : evn.evnnet.at

Ethernet-Adapter LAN-Verbindung* 14:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Check Point Virtual Network Adapter For SSL Network Extender #2
   Physikalische Adresse . . . . . . : 54-E3-3C-70-E0-18
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter LAN-Verbindung 4:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : TAP-Win32 Adapter OAS
   Physikalische Adresse . . . . . . : 00-FF-6C-F8-9C-7F
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter LAN-Verbindung* 9:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Check Point Virtual Network Adapter For Endpoint VPN Client
   Physikalische Adresse . . . . . . : 54-97-59-F5-B5-15
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter LAN-Verbindung 3:

   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : TAP-Windows Adapter V9
   Physikalische Adresse . . . . . . : 00-FF-91-07-E5-AF
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja
   Verbindungslokale IPv6-Adresse  . : fe80::9903:8ef6:b5cd:70d5%25(Bevorzugt) 
   IPv4-Adresse  . . . . . . . . . . : 192.168.1.101(Bevorzugt) 
   Subnetzmaske  . . . . . . . . . . : 255.255.255.0
   Lease erhalten. . . . . . . . . . : Donnerstag, 13. Februar 2014 15:10:24
   Lease l<84>uft ab. . . . . . . . . . : Freitag, 13. Februar 2015 15:10:24
   Standardgateway . . . . . . . . . : 
   DHCP-Server . . . . . . . . . . . : 192.168.1.0
   DHCPv6-IAID . . . . . . . . . . . : 318832529
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-19-7F-34-D3-00-1F-16-36-4C-F5
   DNS-Server  . . . . . . . . . . . : 192.168.1.245
   NetBIOS <81>ber TCP/IP . . . . . . . : Aktiviert

Ethernet-Adapter LAN-Verbindung* 13:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Check Point Virtual Network Adapter For SSL Network Extender
   Physikalische Adresse . . . . . . : 54-3C-3E-38-A2-0D
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Drahtlos-LAN-Adapter Drahtlosnetzwerkverbindung 2:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
   Physikalische Adresse . . . . . . : 00-21-6A-95-82-09
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Drahtlos-LAN-Adapter Drahtlosnetzwerkverbindung:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Intel(R) WiFi Link 5300 AGN
   Physikalische Adresse . . . . . . : 00-21-6A-95-82-08
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter LAN-Verbindung:

   Verbindungsspezifisches DNS-Suffix: lan
   Beschreibung. . . . . . . . . . . : Intel(R) 82567LM Gigabit Network Connection
   Physikalische Adresse . . . . . . : 00-1F-16-36-4C-F5
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja
   Verbindungslokale IPv6-Adresse  . : fe80::40c9:6ee6:6580:6bf1%12(Bevorzugt) 
   IPv4-Adresse  . . . . . . . . . . : 10.0.0.106(Bevorzugt) 
   Subnetzmaske  . . . . . . . . . . : 255.0.0.0
   Lease erhalten. . . . . . . . . . : Samstag, 08. Februar 2014 09:34:57
   Lease l<84>uft ab. . . . . . . . . . : Sonntag, 22. M<84>rz 2150 21:39:25
   Standardgateway . . . . . . . . . : 10.0.0.138
   DHCP-Server . . . . . . . . . . . : 10.0.0.138
   DHCPv6-IAID . . . . . . . . . . . : 251666198
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-19-7F-34-D3-00-1F-16-36-4C-F5
   DNS-Server  . . . . . . . . . . . : 10.0.0.138
                                       10.0.0.138
   NetBIOS <81>ber TCP/IP . . . . . . . : Aktiviert

Tunneladapter isatap.{BA06C604-C03C-4B99-9BDC-87A2C1D5215B}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.{6915880F-8F83-490F-92F3-008AA30B8BEB}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #2
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.{6CF89C7F-576E-4F2E-AF95-1C0BDBD74CA6}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #3
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter LAN-Verbindung* 11:

   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja
   IPv6-Adresse. . . . . . . . . . . : 2001:0:5ef5:79fd:a7:cdd:3f57:fe9a(Bevorzugt) 
   Verbindungslokale IPv6-Adresse  . : fe80::a7:cdd:3f57:fe9a%11(Bevorzugt) 
   Standardgateway . . . . . . . . . : ::
   NetBIOS <81>ber TCP/IP . . . . . . . : Deaktiviert

Tunneladapter isatap.{9C573758-90BD-46F6-8D16-449702DA5C28}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #4
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.{9107E5AF-FC89-4655-A5D1-7AB0ABFEAA8E}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #5
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.{DF3F78C6-7484-42B4-BA32-8D03FBA99463}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #6
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.lan:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #8
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.{99FB4364-B8D2-47A0-B8FE-A87DF5362DC3}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #9
   Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

netstat:

Aktive Verbindungen

  Proto  Lokale Adresse         Remoteadresse          Status
  TCP    0.0.0.0:135            0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:445            0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:664            0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:16993          0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:20050          0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:49152          0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:49153          0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:49154          0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:49158          0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:49161          0.0.0.0:0              ABH�REN
  TCP    0.0.0.0:49184          0.0.0.0:0              ABH�REN
  TCP    10.0.0.106:139         0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:944          0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:5550         0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:7776         0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:7778         0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:7778         127.0.0.1:49166        HERGESTELLT
  TCP    127.0.0.1:16709        0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:25340        0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:25340        127.0.0.1:50786        HERGESTELLT
  TCP    127.0.0.1:49156        127.0.0.1:49157        HERGESTELLT
  TCP    127.0.0.1:49157        127.0.0.1:49156        HERGESTELLT
  TCP    127.0.0.1:49159        127.0.0.1:49160        HERGESTELLT
  TCP    127.0.0.1:49160        127.0.0.1:49159        HERGESTELLT
  TCP    127.0.0.1:49164        127.0.0.1:49165        HERGESTELLT
  TCP    127.0.0.1:49165        127.0.0.1:49164        HERGESTELLT
  TCP    127.0.0.1:49166        127.0.0.1:7778         HERGESTELLT
  TCP    127.0.0.1:49167        127.0.0.1:49168        HERGESTELLT
  TCP    127.0.0.1:49168        127.0.0.1:49167        HERGESTELLT
  TCP    127.0.0.1:49186        0.0.0.0:0              ABH�REN
  TCP    127.0.0.1:50645        127.0.0.1:50646        HERGESTELLT
  TCP    127.0.0.1:50646        127.0.0.1:50645        HERGESTELLT
  TCP    127.0.0.1:50680        127.0.0.1:7776         WARTEND
  TCP    127.0.0.1:50720        127.0.0.1:50721        HERGESTELLT
  TCP    127.0.0.1:50721        127.0.0.1:50720        HERGESTELLT
  TCP    127.0.0.1:50786        127.0.0.1:25340        HERGESTELLT
  TCP    192.168.1.101:139      0.0.0.0:0              ABH�REN
  TCP    192.168.140.11:50683   30.72.4.170:3389       WARTEND
  TCP    [::]:135               [::]:0                 ABH�REN
  TCP    [::]:445               [::]:0                 ABH�REN
  TCP    [::]:49152             [::]:0                 ABH�REN
  TCP    [::]:49153             [::]:0                 ABH�REN
  TCP    [::]:49154             [::]:0                 ABH�REN
  TCP    [::]:49158             [::]:0                 ABH�REN
  TCP    [::]:49161             [::]:0                 ABH�REN
  UDP    0.0.0.0:500            *:*                    
  UDP    0.0.0.0:4500           *:*                    
  UDP    0.0.0.0:5355           *:*                    
  UDP    0.0.0.0:64131          *:*                    
  UDP    10.0.0.106:137         *:*                    
  UDP    10.0.0.106:138         *:*                    
  UDP    10.0.0.106:1900        *:*                    
  UDP    10.0.0.106:53452       *:*                    
  UDP    127.0.0.1:1900         *:*                    
  UDP    127.0.0.1:53453        *:*                    
  UDP    192.168.1.101:137      *:*                    
  UDP    192.168.1.101:138      *:*                    
  UDP    192.168.1.101:1900     *:*                    
  UDP    192.168.1.101:53451    *:*                    
  UDP    [::]:500               *:*                    
  UDP    [::]:4500              *:*                    
  UDP    [::]:5355              *:*                    
  UDP    [::1]:1900             *:*                    
  UDP    [::1]:53450            *:*                    
  UDP    [fe80::40c9:6ee6:6580:6bf1%12]:546  *:*                    
  UDP    [fe80::40c9:6ee6:6580:6bf1%12]:1900  *:*                    
  UDP    [fe80::40c9:6ee6:6580:6bf1%12]:53449  *:*                    
  UDP    [fe80::9903:8ef6:b5cd:70d5%25]:546  *:*                    
  UDP    [fe80::9903:8ef6:b5cd:70d5%25]:1900  *:*                    
  UDP    [fe80::9903:8ef6:b5cd:70d5%25]:53448  *:*

route:

===========================================================================
Schnittstellenliste
 22...54 e3 3c 70 e0 18 ......Check Point Virtual Network Adapter For SSL Network Extender #2
 30...00 ff 6c f8 9c 7f ......TAP-Win32 Adapter OAS
 26...54 97 59 f5 b5 15 ......Check Point Virtual Network Adapter For Endpoint VPN Client
 25...00 ff 91 07 e5 af ......TAP-Windows Adapter V9
 19...54 3c 3e 38 a2 0d ......Check Point Virtual Network Adapter For SSL Network Extender
 15...00 21 6a 95 82 09 ......Microsoft Virtual WiFi Miniport Adapter
 13...00 21 6a 95 82 08 ......Intel(R) WiFi Link 5300 AGN
 12...00 1f 16 36 4c f5 ......Intel(R) 82567LM Gigabit Network Connection
  1...........................Software Loopback Interface 1
 23...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter
 21...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #2
 20...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #3
 11...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
 27...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #4
 18...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #5
 24...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #6
 28...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #8
 29...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #9
===========================================================================

IPv4-Routentabelle
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
          0.0.0.0          0.0.0.0       10.0.0.138       10.0.0.106     20
          0.0.0.0        128.0.0.0    192.168.1.246    192.168.1.101     30
         10.0.0.0        255.0.0.0   Auf Verbindung        10.0.0.106    276
       10.0.0.106  255.255.255.255   Auf Verbindung        10.0.0.106    276
       10.0.0.138  255.255.255.255       10.0.0.138       10.0.0.106     20
   10.255.255.255  255.255.255.255   Auf Verbindung        10.0.0.106    276
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
        128.0.0.0        128.0.0.0    192.168.1.246    192.168.1.101     30
      192.168.1.0    255.255.255.0   Auf Verbindung     192.168.1.101    286
      192.168.1.0    255.255.255.0    192.168.1.246    192.168.1.101     30
    192.168.1.101  255.255.255.255   Auf Verbindung     192.168.1.101    286
    192.168.1.255  255.255.255.255   Auf Verbindung     192.168.1.101    286
 [vpn external address]  255.255.255.255       10.0.0.138       10.0.0.106     20
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306
        224.0.0.0        240.0.0.0   Auf Verbindung        10.0.0.106    276
        224.0.0.0        240.0.0.0   Auf Verbindung     192.168.1.101    286
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
  255.255.255.255  255.255.255.255   Auf Verbindung        10.0.0.106    276
  255.255.255.255  255.255.255.255   Auf Verbindung     192.168.1.101    286
===========================================================================
St�ndige Routen:
  Keine

IPv6-Routentabelle
===========================================================================
Aktive Routen:
 If Metrik Netzwerkziel             Gateway
 11     58 ::/0                     Auf Verbindung
  1    306 ::1/128                  Auf Verbindung
 11     58 2001::/32                Auf Verbindung
 11    306 2001:0:5ef5:79fd:a7:cdd:3f57:fe9a/128
                                    Auf Verbindung
 12    276 fe80::/64                Auf Verbindung
 25    286 fe80::/64                Auf Verbindung
 11    306 fe80::/64                Auf Verbindung
 11    306 fe80::a7:cdd:3f57:fe9a/128
                                    Auf Verbindung
 12    276 fe80::40c9:6ee6:6580:6bf1/128
                                    Auf Verbindung
 25    286 fe80::9903:8ef6:b5cd:70d5/128
                                    Auf Verbindung
  1    306 ff00::/8                 Auf Verbindung
 11    306 ff00::/8                 Auf Verbindung
 12    276 ff00::/8                 Auf Verbindung
 25    286 ff00::/8                 Auf Verbindung
===========================================================================
St�ndige Routen:
  Keine

ping to vpn server

Ping wird ausgef�hrt f�r 192.168.1.1 mit 32 Bytes Daten:
Antwort von 192.168.1.1: Bytes=32 Zeit=66ms TTL=64
Antwort von 192.168.1.1: Bytes=32 Zeit=34ms TTL=64
Antwort von 192.168.1.1: Bytes=32 Zeit=37ms TTL=64
Antwort von 192.168.1.1: Bytes=32 Zeit=34ms TTL=64

Ping-Statistik f�r 192.168.1.1:
    Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
    (0% Verlust),
Ca. Zeitangaben in Millisek.:
    Minimum = 34ms, Maximum = 66ms, Mittelwert = 42ms

Ping to virtual server on the same vmware server as the vpn server

Ping wird ausgef�hrt f�r 192.168.1.245 mit 32 Bytes Daten:
Antwort von 192.168.1.245: Bytes=32 Zeit=70ms TTL=64
Antwort von 192.168.1.245: Bytes=32 Zeit=29ms TTL=64
Antwort von 192.168.1.245: Bytes=32 Zeit=28ms TTL=64
Antwort von 192.168.1.245: Bytes=32 Zeit=29ms TTL=64

Ping-Statistik f�r 192.168.1.245:
    Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
    (0% Verlust),
Ca. Zeitangaben in Millisek.:
    Minimum = 28ms, Maximum = 70ms, Mittelwert = 39ms

Ping to physical server in target lan:

Ping wird ausgef�hrt f�r 192.168.1.220 mit 32 Bytes Daten:
Antwort von 192.168.1.101: Zielhost nicht erreichbar.
Antwort von 192.168.1.101: Zielhost nicht erreichbar.
Antwort von 192.168.1.101: Zielhost nicht erreichbar.
Antwort von 192.168.1.101: Zielhost nicht erreichbar.

Ping-Statistik f�r 192.168.1.220:
    Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
    (0% Verlust),

As for the ARP requests, see my previous posting.

SlowFox

debbie10t wrote

SlowFox wrote

server-bridge 192.168.1.246 255.255.255.0 192.168.1.101 192.168.1.110

SlowFox wrote

br0       Link encap:Ethernet  HWaddr 00:0c:29:51:aa:cd 
          inet addr:192.168.1.246  Bcast:192.168.1.255  Mask:255.255.255.0

SlowFox wrote

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 br0

The server-bridge address is not set to the address of the bridge interface it is set to the address of the LAN default gateway

Ah, merde. Originally I planned to install the VPN server on the gateway and must hafve forgotten to change that one. Ok, this has been corrected, the openvpn server restartet the connection dis- and reconnected however:

This not only effects arp but also broadcast traffic from windows XP though not Windows 7 ...

Unfortunately the problem remains exactly the same :-(

(Did you fancy a having a go at the quiz ?)

Not yet, but it sounds interesting 😉

SlowFox

The problem still remains the same.

But I've made an addtional, very disturbing observation: if I ping the remote pc from 192.168.1.245 (the virtual host next to the vmware server), not all of the packets are forwarded as well, but there are (random) gaps of several seconds up to about a minute.

Further investigation once again led me to arp requests (so I think it is related closely to my original and much more important problem) and then with some searching to "brctl showmacs". It seems that the mac address of the remote pc is bouncing between port 1 (eth0) and port 2 (tap0) of the bridge. The correct port is reestablished as soon as an arp request for the remote pc comes in - I could not find any pattern when the wrong port is established (at least there was nothing suspicious on the line at these points of time).

Some kind of an attempt to document that:

The bridge MAC-table (I don't know any other way than to poll that, which is awkward):

root@vpn:~# while true; do date && brctl showmacs br0 | grep 00:ff && sleep 1 ; done
Thu Feb 13 20:53:10 CET 2014
  1     00:ff:91:07:e5:af       no                 0.17
Thu Feb 13 20:53:11 CET 2014
  1     00:ff:91:07:e5:af       no                 1.18
Thu Feb 13 20:53:12 CET 2014
  1     00:ff:91:07:e5:af       no                 2.18
Thu Feb 13 20:53:13 CET 2014
  1     00:ff:91:07:e5:af       no                 0.18
Thu Feb 13 20:53:14 CET 2014
  2     00:ff:91:07:e5:af       no                 0.52
Thu Feb 13 20:53:15 CET 2014
  2     00:ff:91:07:e5:af       no                 0.57
Thu Feb 13 20:53:16 CET 2014
  1     00:ff:91:07:e5:af       no                 0.18
Thu Feb 13 20:53:17 CET 2014
  1     00:ff:91:07:e5:af       no                 1.19
Thu Feb 13 20:53:18 CET 2014
  1     00:ff:91:07:e5:af       no                 2.20
Thu Feb 13 20:53:19 CET 2014
  1     00:ff:91:07:e5:af       no                 0.94

The ARP traffic (limited to the mac of the remote pc) at the bridged interface:

root@vpn:~# tcpdump -eni br0 "ether[6:2] == 0x00ff" and arp
20:52:25.728252 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Reply 192.168.1.101 is-at 00:ff:91:07:e5:af, length 28
20:52:31.125699 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Request who-has 192.168.1.245 (00:0c:29:dd:67:20) tell 192.168.1.101, length 28
20:53:13.806717 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Reply 192.168.1.101 is-at 00:ff:91:07:e5:af, length 28
20:53:18.447169 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Request who-has 192.168.1.245 (00:0c:29:dd:67:20) tell 192.168.1.101, length 28
^C
279 packets captured
279 packets received by filter
0 packets dropped by kernel

The ARP traffic (again: limited to the mac of the remote pc) at the tap-interface:

root@vpn:/etc/openvpn# tcpdump -eni tap0 "ether[6:2] == 0x00ff" and arp
20:52:25.728252 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Reply 192.168.1.101 is-at 00:ff:91:07:e5:af, length 28
20:52:31.125699 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Request who-has 192.168.1.245 (00:0c:29:dd:67:20) tell 192.168.1.101, length 28
20:53:13.806717 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Reply 192.168.1.101 is-at 00:ff:91:07:e5:af, length 28
20:53:18.447169 00:ff:91:07:e5:af > 00:0c:29:dd:67:20, ethertype ARP (0x0806), length 42: Request who-has 192.168.1.245 (00:0c:29:dd:67:20) tell 192.168.1.101, length 28

So the "192.168.1.101 is-at" message fixes the problem (reproducible), but only temporarily. I have absolutely no clue why the mac is assigned to port 1 again only 2 seconds later (in other cases I have observed longer periods of time, but I can't recall anything longer than a minute).

I found one quite similar question on the linux-bridge mailing list. Unfortunately there has not been any valuable outcome...

SlowFox

debbie10t wrotePlease post FULL details of ifconfig

root@vpn:~# ifconfig -a -v
br0       Link encap:Ethernet  HWaddr 00:0c:29:51:aa:cd  
          inet addr:192.168.1.246  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe51:aacd/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1538032 errors:0 dropped:57 overruns:0 frame:0
          TX packets:572562 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:190246919 (181.4 MiB)  TX bytes:50373282 (48.0 MiB)

eth0      Link encap:Ethernet  HWaddr 00:0c:29:51:aa:cd  
          inet6 addr: fe80::20c:29ff:fe51:aacd/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:1812556768 errors:0 dropped:33942 overruns:0 frame:0
          TX packets:591069 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1726585621247 (1.5 TiB)  TX bytes:52232742 (49.8 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1680 (1.6 KiB)  TX bytes:1680 (1.6 KiB)

tap0      Link encap:Ethernet  HWaddr 32:87:80:6e:78:4a  
          inet6 addr: fe80::3087:80ff:fe6e:784a/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:18050 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2975511 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1946836 (1.8 MiB)  TX bytes:265467457 (253.1 MiB)

And how/when do you create your bridge ?

root@vpn:~# cat /etc/network/interfaces 
[...]
auto br0
iface br0 inet static
        pre-up /usr/sbin/openvpn --mktun --dev tap0
        pre-up /sbin/ifconfig eth0 0.0.0.0 promisc up
        pre-up /sbin/ifconfig tap0 0.0.0.0 promisc up
        pre-up /sbin/brctl addbr br0
        pre-up /sbin/brctl stp br0 off
        pre-up /sbin/brctl setfd br0 0
        pre-up /sbin/brctl addif br0 eth0
        pre-up /sbin/brctl addif br0 tap0
        address 192.168.1.246
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1

SlowFox

SlowFox wroteI found one quite similar question on the linux-bridge mailing list. Unfortunately there has not been any valuable outcome...

DAMN IT.

I found another posting on the very same list which covers the same problem. Together with the posting before this makes clear that cause of all trouble is vmware in conjunction with ethernet-bonding. And yes, disabling one of the two interfaces makes all my problems dissapear: pings work from any host to any other host in either direction and they work stable.

Thanks for your ideas, I think the remaining problem (which is the loss of redundancy) is now far beyond the scope of openvpn.