I'm setting up a
bridged OpenVPN for the first time. The server is a VM hosted Ubuntu Server 13.10 and the client is a Mac running Yosemite (10.10) and Tunnelblick. I am able to connect and ping client from server, server from client but that is where it stops. I've tried using tcpdump but honestly I can't make much of it. What is really weird is that I don't see any incoming packets on the client when pinging from the server, although the ping is answered. I'm guessing I have some routing issue going. I am also painfully aware of the sub-optimal ranges in the subnets (using pretty much standard, albeit different subnets so it should not matter, however I do promise to change the subnets later).
The server setup is the following:
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
#auto eth0
#iface eth0 inet dhcp
# Set up the bridge interface for OpenVPN
auto br0
iface br0 inet dhcp
bridge_ports eth0
bridge_fd 9
bridge_hello 2
bridge_maxage 12
bridge_stp off
iface eth0 inet manual
up ifconfig $IFACE 0.0.0.0 up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down
br0 Link encap:Ethernet HWaddr 08:00:27:e6:a5:4a
inet addr:192.168.0.4 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::a00:27ff:fee6:a54a/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:31614 errors:0 dropped:0 overruns:0 frame:0
TX packets:24999 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3789589 (3.7 MB) TX bytes:7467415 (7.4 MB)
eth0 Link encap:Ethernet HWaddr 08:00:27:e6:a5:4a
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:27171 errors:0 dropped:0 overruns:0 frame:0
TX packets:26224 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3684235 (3.6 MB) TX bytes:8081557 (8.0 MB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:90 errors:0 dropped:0 overruns:0 frame:0
TX packets:90 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7696 (7.6 KB) TX bytes:7696 (7.6 KB)
tap0 Link encap:Ethernet HWaddr 66:5b:60:ee:50:45
inet6 addr: fe80::645b:60ff:feee:5045/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:3057 errors:0 dropped:0 overruns:0 frame:0
TX packets:2215 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:345181 (345.1 KB) TX bytes:545247 (545.2 KB)
server.conf
port 1194
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.0.4 255.255.255.0 192.168.0.220 192.168.0.230
push "route 192.168.0.1 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 6
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
The two last lines are up and down scripts:
up.sh
#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/sbin/brctl addif $BR $DEV
down.sh
#!/bin/sh
BR=$1
DEV=$2
/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down
Routing on server when VPN is connected:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.0.1 0.0.0.0 UG 0 0 0 br0
192.168.0.0 * 255.255.255.0 U 0 0 0 br0
Routing on client when VPN is connected:
Internet:
Destination Gateway Flags Refs Use Netif Expire
0/1 192.168.0.4 UGSc 3 0 tap0
default 192.168.1.1 UGSc 9 0 en0
<Actual outside IP>/32 192.168.1.1 UGSc 1 0 en0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 5 11563 lo0
128.0/1 192.168.0.4 UGSc 5 0 tap0
169.254 link#4 UCS 0 0 en0
192.168.0 link#11 UC 5 0 tap0
192.168.0.1 6c:70:9f:d1:7d:13 UHLWIir 1 0 tap0 1167
192.168.0.4 8:0:27:e6:a5:4a UHLWIir 11 28 tap0 1173
192.168.0.5 3c:4a:92:b1:f1:b5 UHLWI 0 0 tap0 1175
192.168.0.255 ff:ff:ff:ff:ff:ff UHLWbI 0 19 tap0
192.168.1 link#4 UCS 3 0 en0
192.168.1.1/32 link#4 UCS 1 0 en0
192.168.1.1 0:18:84:89:15:34 UHLWIir 5 210 en0 1177
192.168.1.116/32 link#4 UCS 0 0 en0
192.168.1.181 54:e4:3a:d6:5a:53 UHLWIi 1 3 en0 765
192.168.1.194 78:7e:61:3c:c1:ca UHLWIi 2 42 en0 1167
192.168.1.255 ff:ff:ff:ff:ff:ff UHLWbI 0 34 en0
Finally the only "error messages" I can see in the Tunnelblick logs are:
2014-12-20 14:42:30 us=999755 /sbin/route add -net 83.248.255.12 192.168.1.1 255.255.255.255
route: writing to routing socket: File exists
add net 83.248.255.12: gateway 192.168.1.1: File exists
2014-12-20 14:42:31 us=2356 /sbin/route add -net 0.0.0.0 192.168.0.4 128.0.0.0
add net 0.0.0.0: gateway 192.168.0.4
2014-12-20 14:42:31 us=4405 /sbin/route add -net 128.0.0.0 192.168.0.4 128.0.0.0
add net 128.0.0.0: gateway 192.168.0.4
2014-12-20 14:42:31 *Tunnelblick: No 'connected.sh' script to execute
2014-12-20 14:42:31 us=5998 MANAGEMENT: >STATE:1419082951,ADD_ROUTES,,,
2014-12-20 14:42:31 us=6064 /sbin/route add -net 192.168.0.1 192.168.0.4 255.255.255.0
route: writing to routing socket: File exists
add net 192.168.0.1: gateway 192.168.0.4: File exists
2014-12-20 14:42:31 us=7665 /sbin/route add -net 192.168.0.0 192.168.0.4 255.255.255.0
route: writing to routing socket: File exists
add net 192.168.0.0: gateway 192.168.0.4: File exists
My bet is something is up with routing. And I am a complete n00b when it comes to routing tbh. Please, if anyone knows whats up I would appreciate any assistance! 🙂
