Bridged VPN problem - Can connect but nothing else works

diggy

Hi all.
I've been using openVPN for the last 6 months or so in routed mode.
Due to a server upgrade (and because config files got messed up during the upgrade) I decided to switch to bridged mode because I needed to access the server LAN's clients.

The problem is that even though I can establish the VPN connection and no errors show up in the log, I can't get any data through.

Could anyone provide any insight? I've been fighting with this for over 5 days and still can't get it to work!

Below are the details of my networks' setup:

Server LAN gateway: 192.168.1.1/24
Server IP: 192.168.1.50/24
Server Distro: OpenSUSE 13.1 x64
Port forwarding (NAT) on router publicIP:51194 -> 192.168.1.50:1194
/proc/sys/net/ipv4/ip_forward = 1

Client LAN gateway: 192.168.1.1/24 (aka dsldevice.lan)
Client IP: 192.168.10.1/24
Client VPN IP: 192.168.1.52/24
Client Distro: OpenSUSE 13.1 x64

Server.conf

local 192.168.1.50
port 1194
proto udp
dev tap
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/server.crt
key /etc/openvpn/ssl/server.key  # This file should be kept secret
dh /etc/openvpn/ssl/dh1024.pem
ifconfig-pool-persist /var/run/openvpn/ipp.txt
server-bridge 192.168.1.1 255.255.255.0 192.168.1.52 192.168.1.55
keepalive 10 120
comp-lzo
max-clients 1
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 4

Client.conf

client
dev tap
proto udp
remote xxxx 51194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/asusClient.crt
key /etc/openvpn/ssl/asusClient.key
ns-cert-type server
comp-lzo
verb 5

Server ifconfig

br0       Link encap:Ethernet  HWaddr 00:23:7D:93:A8:6D  
          inet addr:192.168.1.50  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::223:7dff:fe93:a86d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

enp7s0    Link encap:Ethernet  HWaddr 00:23:7D:93:A8:6D  
          inet6 addr: fe80::223:7dff:fe93:a86d/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1

ens6      Link encap:Ethernet  HWaddr 64:66:B3:04:6D:05  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1

tap0      Link encap:Ethernet  HWaddr 0E:8A:A4:E3:BB:2D  
          UP BROADCAST PROMISC MULTICAST  MTU:1500  Metric:1

Bridge info

bridge name     bridge id               STP enabled     interfaces
br0             8000.00237d93a86d       no              enp7s0
                                                                tap0

Server routes

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 br0
loopback        *               255.0.0.0       U     0      0        0 lo
192.168.1.0     *               255.255.255.0   U     0      0        0 br0

Client ifconfig

eth0      Link encap:Ethernet  HWaddr 10:BF:48:56:84:0A  
          inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
          inet6 addr: fe80::12bf:48ff:fe56:840a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

tap0      Link encap:Ethernet  HWaddr 26:CE:0A:17:FB:8E  
          inet addr:192.168.1.52  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::24ce:aff:fe17:fb8e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

Client routes

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         dsldevice.lan   0.0.0.0         UG    0      0        0 eth0
xxxx.adsl       dsldevice.lan   255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 tap0
192.168.10.0    *               255.255.255.0   U     1      0        0 eth0

All pings, client->server, server->client respond with destination host unreachable.

I've tried forcing the route to server gateway (although docs state it's not needed):

192.168.1.0     192.168.1.1     255.255.255.255 UGH   0      0        0 tap0

I've also tried "tcpdump -nnel -i br0 icmp" and no traffic comes through.
The server can connect to the internet fine though.

brendan

are you forwarding traffic in your kernel?

sudo sysctl -a |grep "\.forward"

all interfaces associated with the bridge should have a 1 as the value in the output. if not, then:

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

should be added to your /etc/sysctl.conf (or where ever your distro puts that file).

diggy

Yes, IP forwarding is enabled. It's mentioned in the setup details in my first post. Sorry if I didn't make it clear.
Thanks for the effort though.

diggy

diggy wrote Client LAN gateway: 192.168.1.1/24 (aka dsldevice.lan)

I've written this down wrong.
Client LAN gateway is: 192.168.10.254/24 (aka dsldevice.lan)

brendan

what do the server and client logs show? are you getting errors?

diggy

Nope, no errors at all. Just traffic doesn't get through.
I've also tried disabling the firewall in both client and server so there is no firewall rules issue.
I'm guessing it has something to do with routing, but I can pinpoint it.

diggy

diggy wroteI can't pinpoint it.

brendan

are your clients on the 192.168.1.0/24 network when connected over the VPN? is the 192.168.1.1 IP their gateway? is that IP active and handling traffic? you say that 192.168.10.1 is the gateway. do your network configs match your server-bridge directive?

maikcat

in openvpn config dev tap must be dev tap0

Michael.

diggy

You are absolutely right!

I've totally missed out checking that. I've been going through the configuration for days, without giving a second look at obvious things.

Now it works. Thank you so much Michael!

maikcat

na sai kala re patrioti 🙂

glad to helped you out.

Regards

Michael.