I'm attemtpting to set up a server to allow clients to connect in and I'd like it to act as if they were on my LAN. They should be able to see all the computers on my network, and all my computers should be able to see them. I don't want the clients to use me as their default gateway by default (although, if they want to change their default gateway to route all outbound traffic through me, that's fine too). At the moment, I am only concerned with IPv4, not IPv6.
So far, I appear to have set up bridging correctly, and the clients are able to connect and get an IP from the VPN server. The client can ping the server and vice versa. However, the clients can not ping any other computer on the network, nor can any other computer on the network ping the client. The server can ping other computers on the network and vice versa.
When I run wireshark on the client, I can see the ICMP packets going out. I can also see broadcast packets coming in from things like a printer who really really wants everyone on the network to know about it. When I run wireshark on the server, I do not see the incoming ICMP packets, but I do see the broadcast traffic. Since the client can see the broadcast packets, I believe the bridge between eth0 and tun0 is set up propertly. I have flushed the iptables rules on both sides, just to be sure that wasn't getting in the way. I tried enabling ip_forward in /proc.
At this point, I would like to know what my next step should be in troubleshooting this issue.
To understand my configuration, it'll help if I explain my network setup.
Internet ---> Router1 (192.168.0.1, 192.168.0.0/24) ---> Router2 (192.168.0.3, 192.168.192.0/24) ---> VPN Server (192.168.192.103)
Router1 is set to use 192.168.0.3 as the DMZ, so all new conncetions from the Internet will be port forwarded there. Router2 is set up to forward VPN traffic (TCP/21) to the VPN server. I am using TCP/21 instead of the normal ports to ensure that the clients are able to connect to me, as some of them have very restrictive outbound filters in place which are beyond their control. I am currently testing from a computer on the Router1 network, which is pointing at the IP of Router2. This is the closest I can emulate clients connecting from the Internet, without going off site (and thus dealing with outbound packet filters).
client's config
client
dev tap
proto tcp
remote 192.168.0.3 21
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert adamLaptop.crt
key adamLaptop.key
cipher BF-CBC
verb 5
server's config
mode server
local 192.168.192.103 ## ip/hostname of server
port 21
proto tcp-server
dev tap0 # If you need multiple tap devices, add them here
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
cipher BF-CBC # Blowfish (default)
ifconfig-pool-persist ipp.txt
server-bridge 192.168.192.103 255.255.255.0 192.168.192.139 192.168.192.149
push "route 192.168.192.0 255.255.255.0"
push "dhcp-option DNS 192.168.192.104"
push "dhcp-option DOMAIN diseasedmind.com"
max-clients 10 ## set this to the max number of clients that should be connected at a time
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 5
up.sh
#!/bin/sh
BR=$1
DEV=$2
MTU=$3
#sudo ip tuntap add mode tap $DEV
/sbin/ip link set "$DEV" up promisc on mtu "$MTU"
/sbin/brctl addif $BR $DEV
iptables -A INPUT -i $DEV -j ACCEPT
iptables -A INPUT -i $BR -j ACCEPT
iptables -A FORWARD -i $BR -j ACCEPT
down.sh
#!/bin/sh
BR=$1
DEV=$2
/sbin/brctl delif $BR $DEV
/sbin/ip link set "$DEV" down
