Client cannot ping any host on remote network

hansgso

I have installed OpenVPN on a server behind a firewall (over port 1194).

A NAT config on the firewall transfers an extern IP (192.168.3.80) to the IP of the vpn server (192.168.168.10).

When a client connects it gets an IPaddress as configured:

IPv4 Address. . . . . . . . . . . : 192.168.168.80
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

I can see it is also in the route table

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.227 20
80.246.183.221 255.255.255.255 192.168.3.1 192.168.3.227 21
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.3.0 255.255.255.0 On-link 192.168.3.227 276
192.168.3.227 255.255.255.255 On-link 192.168.3.227 276
192.168.3.255 255.255.255.255 On-link 192.168.3.227 276
192.168.168.0 255.255.255.0 192.168.168.10 192.168.168.80 20
192.168.168.80 255.255.255.255 On-link 192.168.168.80 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.3.227 276
224.0.0.0 240.0.0.0 On-link 192.168.168.80 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.3.227 276
255.255.255.255 255.255.255.255 On-link 192.168.168.80 276
===========================================================================

This ALL looks OK.

But I cannot ping any machine on the VPN network

C:\Windows\System32>ping 192.168.168.10 (this is the VPN server)

Pinging 192.168.168.10 with 32 bytes of data:
Request timed out.

Ping statistics for 192.168.168.10:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Control-C
^C

When I try tracert, it goes to a different getaway??

C:\Windows\System32>tracert 192.168.168.10

Tracing route to CUC_ColoWS [192.168.168.10]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms adslrouter [192.168.3.1]
2 * * * Request timed out.
3 * * * Request timed out.
4 ^C
C:\Windows\System32>

How can I fix this?

client vpn config
----------------------------
client
dev tap
proto udp
remote 192.168.3.80 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
----------------------------

server vpn config
----------------------------
local 192.168.168.10
port 1194
proto udp
dev tap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server-bridge 192.168.168.10 255.255.255.0 192.168.168.80 192.168.168.100
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
----------------------------

Hans

Traffic

Please post your server & client logs

hansgso

Hi

Client log:

Mon Feb 16 16:22:36 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Mon Feb 16 16:22:36 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Mon Feb 16 16:22:36 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Feb 16 16:22:36 2015 Need hold release from management interface, waiting...
Mon Feb 16 16:22:37 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Feb 16 16:22:37 2015 MANAGEMENT: CMD 'state on'
Mon Feb 16 16:22:37 2015 MANAGEMENT: CMD 'log all on'
Mon Feb 16 16:22:37 2015 MANAGEMENT: CMD 'hold off'
Mon Feb 16 16:22:37 2015 MANAGEMENT: CMD 'hold release'
Mon Feb 16 16:22:37 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Feb 16 16:22:37 2015 MANAGEMENT: >STATE:1424100157,RESOLVE,,,
Mon Feb 16 16:22:37 2015 UDPv4 link local: [undef]
Mon Feb 16 16:22:37 2015 UDPv4 link remote: [AF_INET]192.168.3.80:1194
Mon Feb 16 16:22:37 2015 MANAGEMENT: >STATE:1424100157,WAIT,,,
Mon Feb 16 16:22:37 2015 MANAGEMENT: >STATE:1424100157,AUTH,,,
Mon Feb 16 16:22:37 2015 TLS: Initial packet from [AF_INET]192.168.3.80:1194, sid=120ebe47 9c6f1367
Mon Feb 16 16:22:37 2015 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Feb 16 16:22:37 2015 VERIFY OK: nsCertType=SERVER
Mon Feb 16 16:22:37 2015 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Feb 16 16:22:37 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 16 16:22:37 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 16 16:22:37 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 16 16:22:37 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 16 16:22:37 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb 16 16:22:37 2015 [server] Peer Connection Initiated with [AF_INET]192.168.3.80:1194
Mon Feb 16 16:22:38 2015 MANAGEMENT: >STATE:1424100158,GET_CONFIG,,,
Mon Feb 16 16:22:40 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb 16 16:22:40 2015 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.168.10,ping 10,ping-restart 120,ifconfig 192.168.168.81 255.255.255.0'
Mon Feb 16 16:22:40 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb 16 16:22:40 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb 16 16:22:40 2015 OPTIONS IMPORT: route-related options modified
Mon Feb 16 16:22:40 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb 16 16:22:40 2015 MANAGEMENT: >STATE:1424100160,ASSIGN_IP,,192.168.168.81,
Mon Feb 16 16:22:40 2015 open_tun, tt->ipv6=0
Mon Feb 16 16:22:40 2015 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{215E5A46-45E0-4653-B68C-9FBA85AE0D7D}.tap
Mon Feb 16 16:22:40 2015 TAP-Windows Driver Version 9.21
Mon Feb 16 16:22:40 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.168.81/255.255.255.0 on interface {215E5A46-45E0-4653-B68C-9FBA85AE0D7D} [DHCP-serv: 192.168.168.0, lease-time: 31536000]
Mon Feb 16 16:22:40 2015 NOTE: FlushIpNetTable failed on interface [19] {215E5A46-45E0-4653-B68C-9FBA85AE0D7D} (status=5) : Access is denied.
Mon Feb 16 16:22:45 2015 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Mon Feb 16 16:22:45 2015 Initialization Sequence Completed
Mon Feb 16 16:22:45 2015 MANAGEMENT: >STATE:1424100165,CONNECTED,SUCCESS,192.168.168.81,192.168.3.80

Server client log :

OpenVPN CLIENT LIST
Updated,Mon Feb 16 16:25:14 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
cu001,192.168.3.227:62612,132127,83845,Mon Feb 16 15:06:48 2015
cu001,192.168.3.227:56348,54010,6566,Mon Feb 16 16:22:37 2015
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
00:ff:21:5e:5a:46,cu001,192.168.3.227:56348,Mon Feb 16 16:22:40 2015
GLOBAL STATS
Max bcast/mcast queue length,1
END

Where is the server log?

Hans

Traffic

hansgso wroteWhere is the server log?

Depends on your operating system ..

See --log in The Manual v23x

hansgso

OK,

This is then client log:

Mon Feb 16 16:58:33 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Mon Feb 16 16:58:33 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Mon Feb 16 16:58:33 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Feb 16 16:58:33 2015 Need hold release from management interface, waiting...
Mon Feb 16 16:58:34 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Feb 16 16:58:34 2015 MANAGEMENT: CMD 'state on'
Mon Feb 16 16:58:34 2015 MANAGEMENT: CMD 'log all on'
Mon Feb 16 16:58:34 2015 MANAGEMENT: CMD 'hold off'
Mon Feb 16 16:58:34 2015 MANAGEMENT: CMD 'hold release'
Mon Feb 16 16:58:34 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Feb 16 16:58:34 2015 MANAGEMENT: >STATE:1424102314,RESOLVE,,,
Mon Feb 16 16:58:34 2015 UDPv4 link local: [undef]
Mon Feb 16 16:58:34 2015 UDPv4 link remote: [AF_INET]192.168.3.80:1194
Mon Feb 16 16:58:34 2015 MANAGEMENT: >STATE:1424102314,WAIT,,,
Mon Feb 16 16:58:34 2015 MANAGEMENT: >STATE:1424102314,AUTH,,,
Mon Feb 16 16:58:34 2015 TLS: Initial packet from [AF_INET]192.168.3.80:1194, sid=4ccbe3dd 41864bdd
Mon Feb 16 16:58:34 2015 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Feb 16 16:58:34 2015 VERIFY OK: nsCertType=SERVER
Mon Feb 16 16:58:34 2015 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Feb 16 16:58:34 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 16 16:58:34 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 16 16:58:34 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 16 16:58:34 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 16 16:58:34 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb 16 16:58:34 2015 [server] Peer Connection Initiated with [AF_INET]192.168.3.80:1194
Mon Feb 16 16:58:35 2015 MANAGEMENT: >STATE:1424102315,GET_CONFIG,,,
Mon Feb 16 16:58:36 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb 16 16:58:36 2015 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.168.10,ping 10,ping-restart 120,ifconfig 192.168.168.80 255.255.255.0'
Mon Feb 16 16:58:36 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb 16 16:58:36 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb 16 16:58:36 2015 OPTIONS IMPORT: route-related options modified
Mon Feb 16 16:58:36 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb 16 16:58:36 2015 MANAGEMENT: >STATE:1424102316,ASSIGN_IP,,192.168.168.80,
Mon Feb 16 16:58:36 2015 open_tun, tt->ipv6=0
Mon Feb 16 16:58:36 2015 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{215E5A46-45E0-4653-B68C-9FBA85AE0D7D}.tap
Mon Feb 16 16:58:36 2015 TAP-Windows Driver Version 9.21
Mon Feb 16 16:58:36 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.168.80/255.255.255.0 on interface {215E5A46-45E0-4653-B68C-9FBA85AE0D7D} [DHCP-serv: 192.168.168.0, lease-time: 31536000]
Mon Feb 16 16:58:36 2015 NOTE: FlushIpNetTable failed on interface [19] {215E5A46-45E0-4653-B68C-9FBA85AE0D7D} (status=5) : Access is denied.
Mon Feb 16 16:58:41 2015 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Mon Feb 16 16:58:41 2015 Initialization Sequence Completed
Mon Feb 16 16:58:41 2015 MANAGEMENT: >STATE:1424102321,CONNECTED,SUCCESS,192.168.168.80,192.168.3.80

Same time on the server:

Mon Feb 16 16:58:05 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014
Mon Feb 16 16:58:05 2015 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mon Feb 16 16:58:06 2015 Diffie-Hellman initialized with 2048 bit key
Mon Feb 16 16:58:06 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Feb 16 16:58:06 2015 TUN/TAP device tap0 opened
Mon Feb 16 16:58:06 2015 TUN/TAP TX queue length set to 100
Mon Feb 16 16:58:06 2015 UDPv4 link local (bound): [AF_INET]192.168.168.10:1194
Mon Feb 16 16:58:06 2015 UDPv4 link remote: [undef]
Mon Feb 16 16:58:06 2015 MULTI: multi_init called, r=256 v=256
Mon Feb 16 16:58:06 2015 IFCONFIG POOL: base=192.168.168.80 size=21, ipv6=0
Mon Feb 16 16:58:06 2015 Initialization Sequence Completed
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 TLS: Initial packet from [AF_INET]192.168.3.227:54608, sid=a409254c 97436aa3
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=cu001, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb 16 16:58:34 2015 192.168.3.227:54608 [cu001] Peer Connection Initiated with [AF_INET]192.168.3.227:54608
Mon Feb 16 16:58:34 2015 cu001/192.168.3.227:54608 MULTI_sva: pool returned IPv4=192.168.168.80, IPv6=(Not enabled)
Mon Feb 16 16:58:37 2015 cu001/192.168.3.227:54608 PUSH: Received control message: 'PUSH_REQUEST'
Mon Feb 16 16:58:37 2015 cu001/192.168.3.227:54608 send_push_reply(): safe_cap=940
Mon Feb 16 16:58:37 2015 cu001/192.168.3.227:54608 SENT CONTROL [cu001]: 'PUSH_REPLY,route-gateway 192.168.168.10,ping 10,ping-restart 120,ifconfig 192.168.168.80 255.255.255.0' (status=1)
Mon Feb 16 16:58:37 2015 cu001/192.168.3.227:54608 MULTI: Learn: 00:ff:21:5e:5a:46 -> cu001/192.168.3.227:54608

hans

Traffic

Your configs and logs look OK.

I expect you are using the new NDIS6 TAP driver on your client PC.
Installer (64-bit), Windows Vista and later - openvpn-install-2.3.6-I601-x86_64.exe

Please try with this NDIS5 TAP driver installer instead:
Installer (64-bit), Windows XP and later - openvpn-install-2.3.6-I001-x86_64.exe

http://openvpn.net/index.php/download/community-downloads.html

On server, please post details of: brctl show & ifconfig with OpenVPN UP.

hansgso

Hi

I tried the other windows client, same result.

hans@colows:~$  brctl show
bridge name     bridge id               STP enabled     interfaces
virbr0          8000.000000000000       yes

hans@colows:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:19:b9:e2:b4:e0
          inet addr:192.168.168.10  Bcast:192.168.168.255  Mask:255.255.255.0
          inet6 addr: fe80::219:b9ff:fee2:b4e0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:896 errors:0 dropped:0 overruns:0 frame:0
          TX packets:678 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:119746 (119.7 KB)  TX bytes:71587 (71.5 KB)

eth1      Link encap:Ethernet  HWaddr 00:19:b9:e2:b4:e2
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:119 errors:0 dropped:0 overruns:0 frame:0
          TX packets:119 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8742 (8.7 KB)  TX bytes:8742 (8.7 KB)

virbr0    Link encap:Ethernet  HWaddr 32:1b:db:29:30:e7
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet1    Link encap:Ethernet  HWaddr 00:50:56:c0:00:01
          inet addr:192.168.62.1  Bcast:192.168.62.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fec0:1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:51 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet8    Link encap:Ethernet  HWaddr 00:50:56:c0:00:08
          inet addr:172.16.242.1  Bcast:172.16.242.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fec0:8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:51 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

hans@colows:~$ cat /etc/network/interfaces                                      # This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
    iface eth0 inet static
     address 192.168.168.10
     gateway 192.168.168.168
     netmask 255.255.255.0
     network 192.168.168.0
     broadcast 192.168.168.255
     dns-nameservers 8.8.8.8


iface br0 inet static
  address 192.168.168.10
  netmask 255.255.255.0
  gateway 192.168.168.168
  network 192.168.168.0
  broadcast 192.168.168.255
  bridge_ports eth0

thanx

Hans

Traffic

It appears you have not created your bridge correctly.

Please read this:
http://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html

Take a close look at the bridge-start script which is included in your distro under /usr/share/doc/openvpn

hansgso

I edited the sample bridge script file but I am not sure where I should store it.

Now it is in /etc/openvpn

#!/bin/sh

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.168.10"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.168.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

When I start this script manually, I got this error:

root@colows:/etc/openvpn# ./bridge-start 
Mon Feb 16 20:36:51 2015 ERROR: Cannot ioctl TUNSETIFF tap0: Device or resource busy (errno=16)
Mon Feb 16 20:36:51 2015 Exiting due to fatal error

Beside the error I see the network adapters are now in the ifconfig.

root@colows:/etc/openvpn# ifconfig
br0       Link encap:Ethernet  HWaddr 00:19:b9:e2:b4:e0  
          inet addr:192.168.168.10  Bcast:192.168.168.255  Mask:255.255.255.0
          inet6 addr: fe80::219:b9ff:fee2:b4e0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:45 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:342 (342.0 B)  TX bytes:10115 (10.1 KB)

eth0      Link encap:Ethernet  HWaddr 00:19:b9:e2:b4:e0  
          inet6 addr: fe80::219:b9ff:fee2:b4e0/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:329 errors:0 dropped:0 overruns:0 frame:0
          TX packets:447 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:36310 (36.3 KB)  TX bytes:55638 (55.6 KB)

eth1      Link encap:Ethernet  HWaddr 00:19:b9:e2:b4:e2  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:129 errors:0 dropped:0 overruns:0 frame:0
          TX packets:129 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:9265 (9.2 KB)  TX bytes:9265 (9.2 KB)

tap0      Link encap:Ethernet  HWaddr 4e:70:27:a1:d5:05  
          inet6 addr: fe80::4c70:27ff:fea1:d505/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:75 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:15730 (15.7 KB)

virbr0    Link encap:Ethernet  HWaddr 3a:96:70:25:b1:f3  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet1    Link encap:Ethernet  HWaddr 00:50:56:c0:00:01  
          inet addr:192.168.62.1  Bcast:192.168.62.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fec0:1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:79 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet8    Link encap:Ethernet  HWaddr 00:50:56:c0:00:08  
          inet addr:172.16.242.1  Bcast:172.16.242.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fec0:8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:80 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

And the brctl is now showing the bridge

root@colows:/etc/openvpn# brctl show
bridge name	bridge id		STP enabled	interfaces
br0		8000.0019b9e2b4e0	no		eth0
							tap0
virbr0		8000.000000000000	yes

This looks OK to me, but after this action I cannot access the server anymore with putty over SSH, I have to reboot. Also the VPN client cannot connect.

Did I miss something?

Hans

Traffic

hansgso wroteI am not sure where I should store it.

Now it is in /etc/openvpn

in /etc/openvpn is OK.

hansgso wroteThis looks OK to me, but after this action I cannot access the server anymore with putty over SSH, I have to reboot. Also the VPN client cannot connect.

Did I miss something?

You probably missed the default gateway setting ...

Add to bridge-start and bridge-stop:

route add default gw 192.168.168.xxx

where xxx is the IP of your server LAN gateway.

It ought to be in the sample script but it is (erroneously) missing.

hansgso

Thank you, this works!

Thank you for all the help!

Hans

Traffic

No problem 8-)

@maikcat: please close .. thank you.