likid0
Hi,
I have setup and open VPN server using the TAP device with OVS, pings from the clients to the server work ok, but pings from one client to another client going through the openvpn server don't work. The problem is that arp request don't get from one client to the other:
openvpn server tap 69.169.1.1
openvpn client1 tap 69.169.1.179
openvpn client2 tap 69.169.1.181
ping from 69.169.1.179 to 69.169.1.1 work
ping from 69.169.1.181 to 69.169.1.1 work
ping from 69.169.1.181 to 69.169.1.179 doesn't work
while doing ping from 179 to 181, if I tcpdump on 69.169.1.1 I can see the ARP request but there is no answer:
root@:client1~# tcpdump -n -i br-tap0 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br-tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:25:45.006734 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:25:46.006737 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:25:47.024398 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:25:48.022743 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:25:49.022725 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
[root@server ~]# tcpdump -n -i br-eth0 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br-eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:26:35.901400 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:26:36.918812 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:26:37.917092 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:26:38.917072 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
16:26:39.934858 ARP, Request who-has 69.169.1.181 tell 69.169.1.179, length 28
But client2(181) doesn't get the ARP resquest:
]$ S tcpdump -n -i tap0 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 262144 bytes
client2(181) pings ok the server:
~]$ ping 69.169.1.1
PING 69.169.1.1 (69.169.1.1) 56(84) bytes of data.
64 bytes from 69.169.1.1: icmp_seq=1 ttl=64 time=27.6 ms
64 bytes from 69.169.1.1: icmp_seq=2 ttl=64 time=28.3 ms
But no luck with client1:
~]$ arp -a | grep 180
? (69.169.1.180) at <incomplete> on tap0
tap0 config client1:
~]$ ip addr list tap0
12: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/ether 2a:3b:20:b3:c2:bd brd ff:ff:ff:ff:ff:ff
inet 69.169.1.181/24 brd 69.169.1.255 scope global tap0
valid_lft forever preferred_lft forever
inet6 fe80::283b:20ff:feb3:c2bd/64 scope link
valid_lft forever preferred_lft forever
From client1 179 to client2 181, the same behaviour, while pinging on client1:
]$ S tcpdump -n -i tap0 arp or icmp (01-23 16:47)
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 262144 bytes
16:47:55.751288 ARP, Request who-has 69.169.1.179 tell 69.169.1.181, length 28
16:47:56.753284 ARP, Request who-has 69.169.1.179 tell 69.169.1.181, length 28
16:47:58.267164 ARP, Request who-has 69.169.1.5 tell 69.169.1.100, length 46
16:47:58.750611 ARP, Request who-has 69.169.1.179 tell 69.169.1.181, length 28
Reaches the server, but not the other client:
[root@server ~]# tcpdump -n -i br-eth0 arp or icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br-eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:50:34.475023 ARP, Request who-has 69.169.1.179 tell 69.169.1.181, length 28
16:50:34.874843 ARP, Request who-has 69.169.1.5 tell 69.169.1.100, length 46
16:50:35.475435 ARP, Request who-has 69.169.1.179 tell 69.169.1.181, length 28
16:50:36.477759 ARP, Request who-has 69.169.1.179 tell 69.169.1.181, length 28
16:50:37.998300 ARP, Request who-has 69.169.1.5 tell 69.169.1.100, length 46
16:50:38.476430 ARP, Request who-has 69.169.1.179 tell 69.169.1.181, length 28
~# tcpdump -n -i br-tap0 arp or icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br-tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
16:50:36.318213 ARP, Request who-has 69.169.1.5 tell 69.169.1.100, length 46
16:50:39.441064 ARP, Request who-has 69.169.1.5 tell 69.169.1.100, length 46
no iptables in play.
Client config:
:~# cat /etc/openvpn/client.conf | grep -v ^# | grep -v ^$
client
dev tap
proto udp
remote X.x.x.x 3399
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert li.crt
key li.key
ns-cert-type server
comp-lzo
verb 3
Server Config:
# cat /etc/openvpn/server.conf | grep -v ^# | grep -v ^$ | grep -v \;
port 3399
proto udp
dev tap
ca ca.crt
cert fo.crt
key fo.key # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
push "route 69.169.1.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 5
On the server the Tap device is attached as a port to the br-eth0 bridge:
#ovs-vsctl show
f2149834-835e-4caa-bbfb-1de2e882b463
Bridge "br-eth0"
Port "eth0"
Interface "eth0"
Port "br-eth0"
Interface "br-eth0"
type: internal
Port "tap0"
Interface "tap0"
ovs_version: "2.3.1"
Thnx
