I lose connectivity after I start the bridged connection

mjosh

I've succesfully run a tunnel VPN but when I learned that my intented use required broadcasts, I tired to set up a bridged one. I thought I got the bridged one working and I couldn't understand why I wouldn't see the broadcasts. It was because I haven't succeded at setting up a bridged VPN. Lets see what's happening.

The server is a Linux box. The client is a WinXP SP3 box.

The client has a static IP 10.0.0.2. The server has a static IP 10.0.0.3. The gateway has a static IP 10.0.0.1. The gateway is a Technicolor TG582n modem/router given by my ISP.

The gateway is instructed to run DHCP for any computer in my LAN that doesn't have a static IP. The DHCP range is 10.0.0.30 to 10.0.0.60.

On WinXP, once I bridged the OpenVPN TAP adapter with the Ethernet adapter, the IP 10.0.0.2 address changed into 10.0.0.30. That's the first address in the DHCP range.

Once I run the OpenVPN client, I lost all connectivity on the client machine. I can't even ping the gateway, and I can't understand why.

I'm including:
- the bash scripts to start and stop the bridge
- the client config
- the server config
- the client log
- the server log

bridge start script

#!/bin/bash

br="br0"
tap="tap0"
eth="eth0"
eth_ip="10.0.0.3"
eth_netmask="255.255.255.0"
eth_broadcast="10.0.0.255"
gateway="10.0.0.1"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

route add default gw $gateway

bridge end script

#!/bin/bash

br="br0"
tap="tap0"
gateway="10.0.0.1"
eth_netmask="255.255.255.0"

ifconfig $br down
brctl delbr $br

for t in $tap; do
    openvpn --rmtun --dev $t
done

ifconfig eth0 $gateway netmask $eth_netmask

route add default gw $gateway

client config

client
dev tap
proto udp
remote hostname1.dyndns.org 40096
remote hostname2.no-ip.net 40096
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
verb 3
remote-cert-tls server

server config

cd /etc/openvpn
proto udp
port 40096
log-append /var/log/openvpn.log
daemon
dev tap0
server-bridge 10.0.0.3 255.255.255.0 10.0.0.61 10.0.0.90
client-to-client
cipher AES-256-CBC
ca certs/ca.crt
dh dh.pem
cert certs/server.crt
key keys/server.key
user nobody
group nobody

server log

Sat Feb 15 16:12:03 2014 94.70.7.80:57241 [ClientDesktop] Peer Connection Initiated with [AF_INET]94.70.7.80:57241
Sat Feb 15 16:12:03 2014 MULTI_sva: pool returned IPv4=10.0.0.61, IPv6=(Not enabled)
Sat Feb 15 16:12:05 2014 ClientDesktop/94.70.7.80:57241 send_push_reply(): safe_cap=940
Sat Feb 15 16:14:25 2014 94.70.7.80:64377 [ClientDesktop] Peer Connection Initiated with [AF_INET]94.70.7.80:64377
Sat Feb 15 16:14:25 2014 MULTI_sva: pool returned IPv4=10.0.0.61, IPv6=(Not enabled)
Sat Feb 15 16:14:27 2014 ClientDesktop/94.70.7.80:64377 send_push_reply(): safe_cap=940
Sat Feb 15 16:15:35 2014 94.70.7.80:61070 [ClientDesktop] Peer Connection Initiated with [AF_INET]94.70.7.80:61070
Sat Feb 15 16:15:35 2014 MULTI_sva: pool returned IPv4=10.0.0.61, IPv6=(Not enabled)
Sat Feb 15 16:15:37 2014 ClientDesktop/94.70.7.80:61070 send_push_reply(): safe_cap=940
Sat Feb 15 16:15:53 2014 ClientDesktop/94.70.7.80:61070 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #149358 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Sat Feb 15 16:16:54 2014 94.70.7.80:61994 [ClientDesktop] Peer Connection Initiated with [AF_INET]94.70.7.80:61994
Sat Feb 15 16:16:54 2014 MULTI_sva: pool returned IPv4=10.0.0.61, IPv6=(Not enabled)
Sat Feb 15 16:16:56 2014 ClientDesktop/94.70.7.80:61994 send_push_reply(): safe_cap=940
Sat Feb 15 16:18:16 2014 94.70.7.80:62104 [ClientDesktop] Peer Connection Initiated with [AF_INET]94.70.7.80:62104
Sat Feb 15 16:18:16 2014 MULTI_sva: pool returned IPv4=10.0.0.61, IPv6=(Not enabled)
Sat Feb 15 16:18:18 2014 ClientDesktop/94.70.7.80:62104 send_push_reply(): safe_cap=940
Sat Feb 15 16:20:24 2014 event_wait : Interrupted system call (code=4)
Sat Feb 15 16:20:24 2014 SIGTERM[hard,] received, process exiting

client log

Sat Feb 15 16:12:01 2014 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Sat Feb 15 16:12:01 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 15 16:12:01 2014 UDPv4 link local: [undef]
Sat Feb 15 16:12:01 2014 UDPv4 link remote: [AF_INET]94.70.7.80:40096
Sat Feb 15 16:12:01 2014 TLS: Initial packet from [AF_INET]94.70.7.80:40096, sid=a7bcdd4b 3306d25e
Sat Feb 15 16:12:02 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 16:12:02 2014 Validating certificate key usage
Sat Feb 15 16:12:02 2014 ++ Certificate has key usage  00a0, expects 00a0
Sat Feb 15 16:12:02 2014 VERIFY KU OK
Sat Feb 15 16:12:02 2014 Validating certificate extended key usage
Sat Feb 15 16:12:02 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 15 16:12:02 2014 VERIFY EKU OK
Sat Feb 15 16:12:02 2014 VERIFY OK: depth=0, CN=server
Sat Feb 15 16:12:02 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:12:02 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:12:02 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:12:02 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:12:02 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 16:12:02 2014 [server] Peer Connection Initiated with [AF_INET]94.70.7.80:40096
Sat Feb 15 16:12:04 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:12:04 2014 PUSH: Received control message: 'PUSH_REPLY,route 10.0.0.1 net_gateway,route-gateway 10.0.0.3,ifconfig 10.0.0.61 255.255.255.0'
Sat Feb 15 16:12:04 2014 Options error: route parameter netmask 'net_gateway' must be an IP address
Sat Feb 15 16:12:04 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 15 16:12:04 2014 OPTIONS IMPORT: route options modified
Sat Feb 15 16:12:04 2014 OPTIONS IMPORT: route-related options modified
Sat Feb 15 16:12:04 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Feb 15 16:12:04 2014 open_tun, tt->ipv6=0
Sat Feb 15 16:12:04 2014 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}.tap
Sat Feb 15 16:12:04 2014 NOTE: could not get adapter index for {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}
Sat Feb 15 16:12:04 2014 TAP-Windows Driver Version 9.9 
Sat Feb 15 16:12:04 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.0.61/255.255.255.0 on interface {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B} [DHCP-serv: 10.0.0.0, lease-time: 31536000]
Sat Feb 15 16:12:09 2014 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Sat Feb 15 16:12:09 2014 Initialization Sequence Completed
Sat Feb 15 16:14:06 2014 [server] Inactivity timeout (--ping-restart), restarting
Sat Feb 15 16:14:06 2014 SIGUSR1[soft,ping-restart] received, process restarting
Sat Feb 15 16:14:06 2014 Restart pause, 2 second(s)
Sat Feb 15 16:14:08 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 15 16:14:23 2014 RESOLVE: Cannot resolve host address: hostname2.no-ip.net: No such host is known. 
Sat Feb 15 16:14:23 2014 UDPv4 link local: [undef]
Sat Feb 15 16:14:23 2014 UDPv4 link remote: [AF_INET]94.70.7.80:40096
Sat Feb 15 16:14:23 2014 TLS: Initial packet from [AF_INET]94.70.7.80:40096, sid=a6ca5210 fa0bdb4d
Sat Feb 15 16:14:23 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 16:14:23 2014 Validating certificate key usage
Sat Feb 15 16:14:23 2014 ++ Certificate has key usage  00a0, expects 00a0
Sat Feb 15 16:14:23 2014 VERIFY KU OK
Sat Feb 15 16:14:23 2014 Validating certificate extended key usage
Sat Feb 15 16:14:23 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 15 16:14:23 2014 VERIFY EKU OK
Sat Feb 15 16:14:23 2014 VERIFY OK: depth=0, CN=server
Sat Feb 15 16:14:24 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:14:24 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:14:24 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:14:24 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:14:24 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 16:14:24 2014 [server] Peer Connection Initiated with [AF_INET]94.70.7.80:40096
Sat Feb 15 16:14:26 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:14:31 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:14:36 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:14:41 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:14:46 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:14:51 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:14:56 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:01 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:06 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:11 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:16 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:18 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:18 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:20 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:21 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:21 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:22 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:23 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:24 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:25 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:26 2014 No reply from server after sending 12 push requests
Sat Feb 15 16:15:26 2014 SIGUSR1[soft,no-push-reply] received, process restarting
Sat Feb 15 16:15:26 2014 Restart pause, 2 second(s)
Sat Feb 15 16:15:28 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 15 16:15:30 2014 RESOLVE: Cannot resolve host address: hostname1.dyndns.org: No such host is known. 
Sat Feb 15 16:15:31 2014 UDPv4 link local: [undef]
Sat Feb 15 16:15:31 2014 UDPv4 link remote: [AF_INET]94.70.7.80:40096
Sat Feb 15 16:15:33 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 16:15:33 2014 TLS: Initial packet from [AF_INET]94.70.7.80:40096, sid=72958f11 917fc2fe
Sat Feb 15 16:15:33 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 16:15:33 2014 Validating certificate key usage
Sat Feb 15 16:15:33 2014 ++ Certificate has key usage  00a0, expects 00a0
Sat Feb 15 16:15:33 2014 VERIFY KU OK
Sat Feb 15 16:15:33 2014 Validating certificate extended key usage
Sat Feb 15 16:15:33 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 15 16:15:33 2014 VERIFY EKU OK
Sat Feb 15 16:15:33 2014 VERIFY OK: depth=0, CN=server
Sat Feb 15 16:15:34 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:15:34 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:15:34 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:15:34 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:15:34 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 16:15:34 2014 [server] Peer Connection Initiated with [AF_INET]94.70.7.80:40096
Sat Feb 15 16:15:36 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:41 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:46 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:51 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:15:56 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:01 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:06 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:11 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:16 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:21 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:26 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:31 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:16:36 2014 No reply from server after sending 12 push requests
Sat Feb 15 16:16:36 2014 SIGUSR1[soft,no-push-reply] received, process restarting
Sat Feb 15 16:16:36 2014 Restart pause, 2 second(s)
Sat Feb 15 16:16:38 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 15 16:16:53 2014 RESOLVE: Cannot resolve host address: hostname2.no-ip.net: No such host is known. 
Sat Feb 15 16:16:53 2014 UDPv4 link local: [undef]
Sat Feb 15 16:16:53 2014 UDPv4 link remote: [AF_INET]94.70.7.80:40096
Sat Feb 15 16:16:53 2014 TLS: Initial packet from [AF_INET]94.70.7.80:40096, sid=6f9775f0 161185a2
Sat Feb 15 16:16:53 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 16:16:53 2014 Validating certificate key usage
Sat Feb 15 16:16:53 2014 ++ Certificate has key usage  00a0, expects 00a0
Sat Feb 15 16:16:53 2014 VERIFY KU OK
Sat Feb 15 16:16:53 2014 Validating certificate extended key usage
Sat Feb 15 16:16:53 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 15 16:16:53 2014 VERIFY EKU OK
Sat Feb 15 16:16:53 2014 VERIFY OK: depth=0, CN=server
Sat Feb 15 16:16:53 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:16:53 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:16:53 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:16:53 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:16:53 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 16:16:53 2014 [server] Peer Connection Initiated with [AF_INET]94.70.7.80:40096
Sat Feb 15 16:16:55 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:00 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:05 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:10 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:15 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:20 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:25 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:30 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:35 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:40 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:45 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:50 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:17:55 2014 No reply from server after sending 12 push requests
Sat Feb 15 16:17:55 2014 SIGUSR1[soft,no-push-reply] received, process restarting
Sat Feb 15 16:17:55 2014 Restart pause, 2 second(s)
Sat Feb 15 16:17:57 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 15 16:18:14 2014 RESOLVE: Cannot resolve host address: hostname1.dyndns.org: No such host is known. 
Sat Feb 15 16:18:14 2014 UDPv4 link local: [undef]
Sat Feb 15 16:18:14 2014 UDPv4 link remote: [AF_INET]94.70.7.80:40096
Sat Feb 15 16:18:14 2014 TLS: Initial packet from [AF_INET]94.70.7.80:40096, sid=9b1737a9 7ec0e4a3
Sat Feb 15 16:18:14 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 16:18:14 2014 Validating certificate key usage
Sat Feb 15 16:18:14 2014 ++ Certificate has key usage  00a0, expects 00a0
Sat Feb 15 16:18:14 2014 VERIFY KU OK
Sat Feb 15 16:18:14 2014 Validating certificate extended key usage
Sat Feb 15 16:18:14 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 15 16:18:14 2014 VERIFY EKU OK
Sat Feb 15 16:18:14 2014 VERIFY OK: depth=0, CN=server
Sat Feb 15 16:18:14 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:18:14 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:18:14 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 16:18:14 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 16:18:14 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 16:18:14 2014 [server] Peer Connection Initiated with [AF_INET]94.70.7.80:40096
Sat Feb 15 16:18:17 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:22 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:27 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:32 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:37 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:42 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:47 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:52 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 16:18:57 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)

mjosh

debbie10t wroteThe first parameter is the default gateway not the bridge IP.

Wow! I missed that!

I did the change in the server config and nothing changed. I'm including the client and server logs.

server log

Sat Feb 15 18:16:35 2014 94.70.7.80:49933 TLS: Initial packet from [AF_INET]94.70.7.80:49933, sid=7eaf20a2 84af5f52
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 VERIFY OK: depth=0, CN=ClientDesktop
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 18:16:35 2014 94.70.7.80:49933 [ClientDesktop] Peer Connection Initiated with [AF_INET]94.70.7.80:49933
Sat Feb 15 18:16:35 2014 MULTI: new connection by client 'ClientDesktop' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sat Feb 15 18:16:35 2014 MULTI_sva: pool returned IPv4=10.0.0.61, IPv6=(Not enabled)
Sat Feb 15 18:16:37 2014 ClientDesktop/94.70.7.80:49933 PUSH: Received control message: 'PUSH_REQUEST'
Sat Feb 15 18:16:37 2014 ClientDesktop/94.70.7.80:49933 send_push_reply(): safe_cap=940
Sat Feb 15 18:16:37 2014 ClientDesktop/94.70.7.80:49933 SENT CONTROL [ClientDesktop]: 'PUSH_REPLY,route-gateway 10.0.0.1,ifconfig 10.0.0.61 255.255.255.0' (status=1)
Sat Feb 15 18:16:37 2014 ClientDesktop/94.70.7.80:49933 MULTI: Learn: 00:ff:6b:cf:8a:e8 -> ClientDesktop/94.70.7.80:49933

client log

Sat Feb 15 18:16:33 2014 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Sat Feb 15 18:16:34 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 15 18:16:34 2014 UDPv4 link local: [undef]
Sat Feb 15 18:16:34 2014 UDPv4 link remote: [AF_INET]94.70.7.80:40096
Sat Feb 15 18:16:34 2014 TLS: Initial packet from [AF_INET]94.70.7.80:40096, sid=a1db05cb c4e62e63
Sat Feb 15 18:16:34 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 18:16:34 2014 Validating certificate key usage
Sat Feb 15 18:16:34 2014 ++ Certificate has key usage  00a0, expects 00a0
Sat Feb 15 18:16:34 2014 VERIFY KU OK
Sat Feb 15 18:16:34 2014 Validating certificate extended key usage
Sat Feb 15 18:16:34 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 15 18:16:34 2014 VERIFY EKU OK
Sat Feb 15 18:16:34 2014 VERIFY OK: depth=0, CN=server
Sat Feb 15 18:16:34 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 18:16:34 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 18:16:34 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 18:16:34 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 18:16:34 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 18:16:34 2014 [server] Peer Connection Initiated with [AF_INET]94.70.7.80:40096
Sat Feb 15 18:16:36 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 18:16:36 2014 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.1,ifconfig 10.0.0.61 255.255.255.0'
Sat Feb 15 18:16:36 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 15 18:16:36 2014 OPTIONS IMPORT: route-related options modified
Sat Feb 15 18:16:36 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Feb 15 18:16:36 2014 open_tun, tt->ipv6=0
Sat Feb 15 18:16:36 2014 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}.tap
Sat Feb 15 18:16:36 2014 NOTE: could not get adapter index for {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}
Sat Feb 15 18:16:36 2014 TAP-Windows Driver Version 9.9 
Sat Feb 15 18:16:36 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.0.61/255.255.255.0 on interface {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B} [DHCP-serv: 10.0.0.0, lease-time: 31536000]
Sat Feb 15 18:16:41 2014 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Sat Feb 15 18:16:41 2014 Initialization Sequence Completed
Sat Feb 15 18:16:46 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:48 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:48 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:50 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:52 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:52 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:54 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:55 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:56 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)
Sat Feb 15 18:16:57 2014 write UDPv4: No Route to Host (WSAEHOSTUNREACH) (code=10065)

mjosh

Now I get a complain that the TUN/TAP interface doesn't come up.

server log

Sat Feb 15 19:07:49 2014 94.70.7.80:65102 TLS: Initial packet from [AF_INET]94.70.7.80:65102, sid=adf78cd0 01fa4285
Sat Feb 15 19:07:49 2014 94.70.7.80:65102 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 19:07:49 2014 94.70.7.80:65102 VERIFY OK: depth=0, CN=ClientDesktop
Sat Feb 15 19:07:50 2014 94.70.7.80:65102 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 19:07:50 2014 94.70.7.80:65102 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 19:07:50 2014 94.70.7.80:65102 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 19:07:50 2014 94.70.7.80:65102 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 19:07:50 2014 94.70.7.80:65102 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 19:07:50 2014 94.70.7.80:65102 [ClientDesktop] Peer Connection Initiated with [AF_INET]94.70.7.80:65102
Sat Feb 15 19:07:50 2014 ClientDesktop/94.70.7.80:65102 MULTI_sva: pool returned IPv4=10.0.0.61, IPv6=(Not enabled)
Sat Feb 15 19:07:52 2014 ClientDesktop/94.70.7.80:65102 PUSH: Received control message: 'PUSH_REQUEST'
Sat Feb 15 19:07:52 2014 ClientDesktop/94.70.7.80:65102 send_push_reply(): safe_cap=940
Sat Feb 15 19:07:52 2014 ClientDesktop/94.70.7.80:65102 SENT CONTROL [ClientDesktop]: 'PUSH_REPLY,route-gateway 10.0.0.1,ifconfig 10.0.0.61 255.255.255.0' (status=1)

client log

Sat Feb 15 19:07:48 2014 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Sat Feb 15 19:07:48 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 15 19:07:48 2014 UDPv4 link local: [undef]
Sat Feb 15 19:07:48 2014 UDPv4 link remote: [AF_INET]94.70.7.80:40096
Sat Feb 15 19:07:48 2014 TLS: Initial packet from [AF_INET]94.70.7.80:40096, sid=ef1c942d 6ef24d7b
Sat Feb 15 19:07:48 2014 VERIFY OK: depth=1, CN=Easy-RSA CA
Sat Feb 15 19:07:48 2014 Validating certificate key usage
Sat Feb 15 19:07:48 2014 ++ Certificate has key usage  00a0, expects 00a0
Sat Feb 15 19:07:48 2014 VERIFY KU OK
Sat Feb 15 19:07:48 2014 Validating certificate extended key usage
Sat Feb 15 19:07:48 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 15 19:07:48 2014 VERIFY EKU OK
Sat Feb 15 19:07:48 2014 VERIFY OK: depth=0, CN=server
Sat Feb 15 19:07:49 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 19:07:49 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 19:07:49 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat Feb 15 19:07:49 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 15 19:07:49 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Feb 15 19:07:49 2014 [server] Peer Connection Initiated with [AF_INET]94.70.7.80:40096
Sat Feb 15 19:07:51 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 15 19:07:51 2014 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.1,ifconfig 10.0.0.61 255.255.255.0'
Sat Feb 15 19:07:51 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 15 19:07:51 2014 OPTIONS IMPORT: route-related options modified
Sat Feb 15 19:07:51 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Feb 15 19:07:51 2014 open_tun, tt->ipv6=0
Sat Feb 15 19:07:51 2014 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}.tap
Sat Feb 15 19:07:51 2014 TAP-Windows Driver Version 9.9 
Sat Feb 15 19:07:51 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.0.61/255.255.255.0 on interface {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B} [DHCP-serv: 10.0.0.0, lease-time: 31536000]
Sat Feb 15 19:07:51 2014 Successful ARP Flush on interface [131074] {6BCF8AE8-72BA-4284-BFC5-C85C559BC24B}
Sat Feb 15 19:07:56 2014 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Sat Feb 15 19:07:56 2014 Route: Waiting for TUN/TAP interface to come up...
Sat Feb 15 19:08:01 2014 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Sat Feb 15 19:08:01 2014 Route: Waiting for TUN/TAP interface to come up...
Sat Feb 15 19:08:03 2014 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Sat Feb 15 19:08:03 2014 Route: Waiting for TUN/TAP interface to come up...
Sat Feb 15 19:08:04 2014 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Sat Feb 15 19:08:04 2014 Route: Waiting for TUN/TAP interface to come up...

mjosh

debbie10t wroteDo not bridge on the client !

Yes. You instructed me to un-bridge the client and I did so. These latest logs where the result of an attempt to connect while I have the client un-bridged. I get the "Waiting for TUN/TAP interface to come up" message.

debbie10t wroteOn the server, do not use a script to create your bridge. Instead, create your bridge network as a permanent setting

Will it mater if I create a permanent connectivity instead of "temporary"? I can simply set bridge-start.sh to run on system boot.

Right now I don't know how I can create permanent connectivity. I'm running Slackware, which is old school. Everything takes place with shell scripts. I dig a bit and see that there is an rc.inet1 script which actually calls ifconfig a number of times.

Anyway, I can find out what's the distro's official way of creating permanent connectivity, it just might take me days to do that. I need to know if this is going to make a difference.

debbie10t wrotenormal network connectivity

What is normal network connectivity? What connectivity should I be able to do that I can't do right now? I can ping google.com from the server, if that's what you mean. Here is what ifconfig outputs:

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.0.3  netmask 255.255.255.0  broadcast 10.0.0.255
        inet6 fe80::280:48ff:fe32:3ba  prefixlen 64  scopeid 0x20<link>
        ether 00:80:48:32:03:ba  txqueuelen 0  (Ethernet)
        RX packets 229851  bytes 92314166 (88.0 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 262638  bytes 227899170 (217.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet6 fe80::280:48ff:fe32:3ba  prefixlen 64  scopeid 0x20<link>
        ether 00:80:48:32:03:ba  txqueuelen 1000  (Ethernet)
        RX packets 8449306  bytes 10125827769 (9.4 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5254168  bytes 881841368 (840.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 2168  bytes 244414 (238.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2168  bytes 244414 (238.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tap0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST>  mtu 1500
        inet6 fe80::e04c:17ff:fe27:e234  prefixlen 64  scopeid 0x20<link>
        ether e2:4c:17:27:e2:34  txqueuelen 100  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 519  bytes 27184 (26.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0