Need help configuring my setup, can't ping other network.

goldenpantsman

Hi all,
I am having some issues with my OpenVPN setup.
I need to connect from a 192.168.0.0/24 subnet to a 192.168.1.0/24 subnet.
On this connection I need to be able to access machines on the server network (via IP address is fine).

Using the current configuration I can connect to the server from my client but I cannot ping anything on the server network. I have been scouring the documentation pages for a clue as to what is wrong but I cannot figure it out.
I am trying to use bridging, but that appears to be incorrect since I have 2 different subnets (changing them is not an option). So I need to know how to set up a routing setup that allows access to the server network from the client.

Below are the 2 config files from server and client. Any help would be greatly appreciated.

server.conf

port 1194
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.21 255.255.255.0 192.168.1.100 192.168.1.110
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

client config

client
dev tap
proto udp
remote 98.110.231.53 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3

goldenpantsman

I have fixed the server-bridge line in the config, so now it is:

server-bridge 192.168.1.1 255.255.255.0 192.168.1.100 192.168.1.110

I am using a Windows machine to connect to a linux server. I have created a Network Bridge on the windows client, bridging my local connection (client subnet) with the TAP-Windows Adapter V9 (this shows connected when the VPN is connected).

On the server I have created the tap0 adapter and allowed it through the firewall.

This is the output of tracert 192.168.1.1 from the windows client with the vpn connected and the connections bridged.
To me it seems like the packets are incorrectly being sent to the internet instead of over the vpn.

>tracert 192.168.1.1

Tracing route to 192.168.1.1 over a maximum of 30 hops

  1     1 ms     1 ms     1 ms  196.211.173.121
  2   364 ms   410 ms   385 ms  196.214.217.1
  3    14 ms    14 ms    19 ms  196.26.78.33
  4     *        *        *     Request timed out.
  5     *        *     ^C

Below are the server and client logs with verb set to 6 as per the forum rules (i've uploaded them to google drive and provided links as they cause this post to exceed the character limit):
Client https://docs.google.com/file/d/0BwDS3W67GGeVUUo0LXU0SFVxSXM/edit
Server https://drive.google.com/file/d/0BwDS3W67GGeVTDJ6R1UtdG1mS00/edit?usp=sharing

goldenpantsman

debbie10t, are you suggesting I don't use bridging at all? Or use it on the server side rather than the client side?

I interpreted your post to mean I should bridge the server instead of the client.
I have done this, but when I run bridge-start, my connection to the server dies and I am unable to connect until I force-restart the server!

I've looked into using brctl manually, I created a bridge, added the tap0 adapter (had to have OpenVPN running for it to appear) then when I add the eth0 adapted I get locked out.

What I am misunderstanding here?

bridge-start file:

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.1.21"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.1.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

goldenpantsman

debbie10t wroteadd the eth0 and tun adapters to the bridge.

I have made a TAP adapter on the server, is that incorrect?