it was just working, i swear...

brendan

client config

client
dev tap
proto udp
remote host.domain.tld
resolv-retry infinite
keepalive 10 120
ping-timer-rem
persist-tun
persist-key
ca ca.crt
cert laptop.crt
key laptop.key
tls-auth tls-auth.key 1
ns-cert-type server
cipher AES-256-CBC
auth sha256
route-delay 10
script-security 2
up "up.sh"
down "down.sh"
pull
comp-lzo
verb 4
mute 20
explicit-exit-notify 2

up script

#!/bin/bash

/usr/sbin/ifdown tap0 2>/dev/null
/usr/sbin/ifup tap0 &

server config

mode server
tls-server
local host.domain.tld
port 1194
proto udp
dev tap0 mktun
script-security 2
up TapUp.sh
ca ca.crt
cert vpn.crt
key vpn.key
tls-auth tls-auth.key 0
dh dh2048.pem
cipher AES-256-CBC
keysize 256
auth sha256
server-bridge
push "redirect-gateway def1"
push "route-gateway dhcp"
passtos
keepalive 10 120
comp-lzo
fast-io
user nobody
group nobody
ping-timer-rem
persist-tun
persist-key
verb 4
mute 20

i keep getting

Error: No suitable device found: no device found for connection 'tap0'.

when i try to connect to the vpn. why is the device not being found any more? the tun.ko module is loaded in the kernel, the ifcfg-tap0 file exists in /etc/sysconfig/network-scripts/, but i cannot bring up the interface by any means. what can i check?

brendan

its not a typo, but if it is wrong, the instance does not complain and starts successfully. the idea was to make the tunnels resilient to DHCP changes

TapUp.sh

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="p1p1 p1p3 bond0 bond0.50 tap0"
eth_ip="192.168.50.1"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.50.255"

for t in $tap; do
    /usr/sbin/openvpn --mktun --dev $t
done

for t in $tap; do
    /usr/sbin/brctl addif $br $t
done

for t in $tap; do
    /sbin/ifconfig $t 0.0.0.0 promisc up
done

for e in $eth; do
	/sbin/ifconfig $e 0.0.0.0 promisc up
done

/sbin/ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

the client up script should bring up the tap0 interface on the client side and results in the DHCP request being sent down the tunnel to my DHCP servers, so that i can leverage them for additional fucntionality.

brendan

the issue is not with the server side, but with the client side. effing NetworkManager is mucking things up.

nmcli con del tap0

then recreate /etc/sysconfig/network-scripts/ifcfg-tap0 and it works again.

brendan

yes i foolishly tried to have NM import the OpenVPN connection, and about half of the directives were written into a config, and the rest were just ignored. i am assuming that the process to take my config and create the NM connection is what caused this kerfuffle.