bridging MULTI: bad source address from client, packet dropp

nroberto13

Hi,

I'm using openvpn in bridging mode. the env is:
server vers 2.2.2-2
A. client vers 2.2.2-2
B. client vers 2.3.4-1
all three are openwrt linux running on netgear routers.

the vpn is working fine between the server and client A, but doesn't work between server and client B. before migrating to 2.3.4-1, client B was running same version 2.2.2-2 and worked fine.
the client B has NO error messages, but the servers throws messages llike:

MULTI: bad source address from client [ff:88:53:2e:88:86], packet dropped

the client confs are identical:

option enabled 1
option client 1
option remote <servername>
option port 1194
option proto udp
option dev tap
option ca /etc/config/vpn.clnt/ca.crt
option cert /etc/config/vpn.clnt/yyy.crt
option key /etc/config/vpn.clnt/yyy.key
option comp_lzo no
option keepalive "10 120"
option status /tmp/openvpn.status
option persist-key 1
option persist-tun 1
option verb 7
option mute 20
option nobind 1
option tun-mtu 1500
option log /tmp/openvpn.log

the server conf ;

option enabled 1
option tls_server 1
option port 1194
option proto udp
option dev tap
option ca /etc/config/vpn.srv/ca.crt
option cert /etc/config/vpn.srv/xxx.crt
option key /etc/config/vpn.srv/xxx.key
option dh /etc/config/vpn.srv/dh1024.pem
option ifconfig_pool_persist /tmp/openvpn_ipp.txt
option server_bridge "192.168.3.1 255.255.240.0 192.168.2.1 192.168.15.254"
option client_config_dir /etc/config/vpn.srv/ccd
option client_to_client 1
option keepalive "10 120"
option comp_lzo 0
option persist_key 1
option persist_tun 1
option status /tmp/openvpn-status.log
option verb 6
option mute 20
option log /tmp/openvpn.log

the tap0 interface is bridged with the local lan interface.

any advise is much appreciated.

Traffic

nroberto13 wroteMULTI: bad source address from client [ff:88:53:2e:88:86], packet dropped

Generally this is not a problem .. it is due to the server not having routing information for packets from an unrecognised source. This is usually the ethernet address of the client:
https://community.openvpn.net/openvpn/wiki/317-qmulti-bad-source-address-from-client--packet-droppedq-or-qget-inst-by-virt-failedq

An actual possible problem is in your server config:

option server_bridge "192.168.3.1 255.255.240.0 192.168.2.1 192.168.15.254"

Your server is configured to hand out the DHCP address in use by the server itself: 192.168.3.1

nroberto13

thanks for the reply.
on the client side, I have a separate dhcp which assigns IPs to the net behind the vpn client from the 192.168.5.1/24 subnet, so there's no ip conflict. anyway the same conf works in 2.2 but doesn't in 2.3.

Traffic

nroberto13 wroteMULTI: bad source address from client [ff:88:53:2e:88:86], packet dropped

Perhaps you can identify this MAC address ..

nroberto13

that is the mac of one workstation from behind the client router.

Traffic

Then it can be safely ignored ...

Or you can read this and configure your server with appropriate routing to fix the problem:
HOWTO: Expanding the scope of the VPN to include additional machines