oVPN TAP Bridge DHCP troubles

mrgenie

I previously used DD-wrt Routers to setup a bridged TAP oVPN network succesfully.

To prevent DHCP going over the networks and clients getting their IP's randomly from any DHCP I limited access to DHCP so only local DHCP would be giving IP's to local clients.

insmod ebtables
insmod ebt_ip
insmod ebtable_filter
ebtables -F
ebtables -I FORWARD -i tap1 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP
ebtables -I FORWARD -o tap1 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP
ebtables -I INPUT -i tap1 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP
ebtables -I OUTPUT -o tap1 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP

Works perfect! You get 1 single large network, where every client can reach all clients in all client networks but for internet everyone using their own local internet.

But Routers are simply too slow. I got, depending on routers, between 4 and 8Mbps connections. fastest on a Asus RT-AC66U with 8Mbps

So I now setup an environment with Server2012R2 on Xeon processors. Which indeed is much faster, nett I now get 40Mbps, which is the max of my internet connection
so I can't test if the Xeon would be able to achieve even faster transfer rates. But I'm already pleased I can use 100% of my bandwidth.

However, clients on different LAN segmets usually get the Ip's from their local DHCP, but sometimes from the other networks DHCP, and then all their traffic
is rerouted over VPN of course, even their youtube video views are going over the VPN to use the others internet.

I can of course set manually the IP, Gateway, DNS, etc to prevent this and disable DHCP everywhere, but this is too much work for me.

I want a simple rule as above, for DD-wrt, to prevent DHCP going over the VPN network.

Blocking ports 67/68 won't work if I'm correct, haven't tried it, becuase I think DHCP is over a lower layer on the netwerk then the windows firewall can handle.

So how can i tell oVPN to allow all traffic, but not DHCP over the VPN?

Thank you in advance.

Traffic

mrgenie wroteclients on different LAN segmets usually get the Ip's from their local DHCP

clients on different LANs must get their DHCP for their local LAN from their Local DHCP server before OpenVPN even starts .. or they would not have any network connectivity (unless you make them static IPs in their own LANs)

Perhaps you can post your configs and logs ..

Kj3fvL89Kqj8kZq9

Hi,

In may case I have two routers: openwrt (server have static wan ip, local adreess 10.0.0.1) and ddwrt (client 10.0.0.5) with openvpn bridge.

In start up script of ddrwrt i create this code

insmod ebtables 
insmod ebtable_filter 
insmod ebt_ip.o 
ebtables -I FORWARD -i tap0 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP 
ebtables -I FORWARD -o tap0 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP 
ebtables -I INPUT -i tap0 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP 
ebtables -I OUTPUT -o tap0 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP

And always ok. DHCP dont go via bridge, but I have new problem. My case is:

Macbook connected to wifi on server side, takes dhcp from server, and can see all network on the server and client side.

Then Macbook connected to wifi on client side, takes dhcp from client, and can see all network on the server and client side.

Then Macbook again connected to wifi on server side, takes dhcp, and ... and cant see client side of the bridge 🙁

-------

Other words.

1) device connect to server - OK, have dhcp from server, see server and client side of bridge
2) device connetc to client - OK, have dhcp from client, see server and client side of bridge
3) device again connect to server second time after connect tp client - problem, device cant see client side of the bridge

Sorry about my english.