Can connect to server but no access to the remote network...

jagdtigger

Greetings.

Im trying to setup openvpn on my RPI2(os: raspbian) but im stuck in the last steps. Clients connecting fine and the TAP interface gets IP from the correct range(and it cant collide with a lan address, VPN:192.168.1.50-99 LAN:192.168.1.100-200). But i cant connect to none of the remote network machines and cant ping them.

server.conf:

port 1234
proto udp
dev tap
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.10 255.255.255.0 192.168.1.50 192.168.1.99
keepalive 10 120
tls-auth /etc/openvpn/keys/ta.key 1
cipher AES-128-CBC
persist-key
persist-tun
status openvpn-status.log
verb 3
key-direction 0

client.conf:

key-direction 1
client
dev tap
dev-node OPENVPN01
proto udp
remote some.dyndns.net 1234
resolv-retry infinite
nobind
persist-key
persist-tun
ca ./keyring01/ca.crt
cert ./keyring01/client02.crt
key ./keyring01/client02.key
remote-cert-tls server
tls-auth ./keyring01/ta.key 1
cipher AES-128-CBC
verb 3

ifconfig:

pi@raspberrypi ~ $ ifconfig
br0       Link encap:Ethernet  HWaddr b8:27:eb:81:ee:d1  
          inet addr:192.168.1.10  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::ba27:ebff:fe81:eed1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:58 errors:0 dropped:0 overruns:0 frame:0
          TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:5571 (5.4 KiB)  TX bytes:4344 (4.2 KiB)

eth0      Link encap:Ethernet  HWaddr b8:27:eb:81:ee:d1  
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:140 errors:0 dropped:0 overruns:0 frame:0
          TX packets:103 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:31032 (30.3 KiB)  TX bytes:7980 (7.7 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0      Link encap:Ethernet  HWaddr 22:33:87:99:3a:af  
          inet6 addr: fe80::2033:87ff:fe99:3aaf/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:648 (648.0 B)

maikcat

first use dev tap0 in your server config instead of dev tap,
also tap0 MUST be in promisc mode as well.
please post the output of:

brctl show
iptables -L -v
iptables -L -t nat -v

Michael.

jagdtigger

Ok, i changed the server config and here is the output of the commands:
brctl show

bridge name	bridge id		STP enabled	interfaces
br0		8000.b827eb81eed1	yes		eth0

iptables -L -v

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

iptables -L -t nat -v

Chain PREROUTING (policy ACCEPT 12 packets, 1089 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 7 packets, 755 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 304 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 4 packets, 304 bytes)
 pkts bytes target     prot opt in     out     source               destination

ifconfig

br0       Link encap:Ethernet  HWaddr b8:27:eb:81:ee:d1  
          inet addr:192.168.1.10  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::ba27:ebff:fe81:eed1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:76 errors:0 dropped:0 overruns:0 frame:0
          TX packets:45 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:15319 (14.9 KiB)  TX bytes:3810 (3.7 KiB)

eth0      Link encap:Ethernet  HWaddr b8:27:eb:81:ee:d1  
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:92 errors:0 dropped:0 overruns:0 frame:0
          TX packets:76 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:19872 (19.4 KiB)  TX bytes:6170 (6.0 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0      Link encap:Ethernet  HWaddr c2:cf:52:6a:a8:f4  
          inet6 addr: fe80::c0cf:52ff:fe6a:a8f4/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:648 (648.0 B)

maikcat

when issuing brctl show you should see tap0 as part of br0 interface.

how exactly did you created the bridge?

Michael.

jagdtigger

In /etc/network/interfaces:

auto lo

iface lo inet loopback
allow-hotplug eth0

allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
iface default inet dhcp

auto br0
iface br0 inet static
	address 192.168.1.10
	netmask 255.255.255.0
	network 192.168.1.0
	broadcast 192.168.1.255
	bridge_ports eth0 tap0
	bridge_fd 9
	bridge_hello 2
	bridge_maxage 12
	bridge_stp on
	bridge_prio 1000
	dns-nameservers 192.168.1.1
	default_gateway 192.168.1.1

Traffic

FYI:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

maikcat

try to create tap0 manually & try to add it to br0 BEFORE starting openvpn service..

usually the br0 interface created via openvpn startup script..

Michael.

jagdtigger

Well i just did the opposite, added tap0 to the bridge after openvpn starts with a line in rc.local. Its not elegant but it works 🙂 .

Traffic

Possibly worth checking these: