HI all following instructions at the very top of this forum: Goal: to build a "clustered" VPN server, i.e, some groups of Road Warriors will access some group of Servers (printers, Windows , Samba,etc). Our setup pictures three machines: our vpn hub, various Servers connected to this hub and various RW also connected to this very same hub. These Servers and RWs are both most likely to be behind NATs. One group of RWs is not allowed to see any group of servers but only the ones we assign. We use TAP because we need that each RW have access to all Server's network resources transparently. Each cluster (RWs+Server) will be under its own opervpn's hub tapX interface. Now we are trying to do just one RW to access just one server. Baby steps! Server: [code]server-bridge 'nogw' port 1194 proto udp dev tap tls-server ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/cert.crt key /etc/openvpn/keys/key.key dh /etc/openvpn/keys/dh.pem mode server client-to-client keepalive 10 120 max-clients 10 user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 4 script-security 2 up /etc/openvpn/scripts/ss.sh [/code] ss.sh contains: [code]#!/bin/bash # # starts up VPN. # $dev is the tap device created by openvpn. # prefix=2222:1111:aaaa:1 ip link set $dev up ip -6 addr add ${prefix}::1/64 dev $dev[/code] Cliente (ubuntu) config contains: [code]remote opvpn.com.br port 1194 proto udp nobind dev tap0 user nobody group nogroup persist-key persist-tun tls-client ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/client.crt key /etc/openvpn/keys/client.key dh /etc/openvpn/keys/dh.pem script-security 2 verb 4[/code] Client's network/inteface contains [code] auto lo tap0 iface lo inet loopback iface tap0 inet manual pre-up ip tuntap add tap0 mode tap user root up ip link set dev tap0 up post-down ip link del dev tap0[/code] I also have a RADVD server running giving IPv6 addresses at opvpn.com.br (real name changed to protect the innocent!) This setup is working fine. We can "see" the servers on the other tunnel end, ping them, mount them, etc. The problem lays in the fact we will have to tamper with the RW computer's files more than we want. For instance: change its /etc/network/interfaces file. Install openvpn and send our config file is all we would like to do. No tampering at all. Here is what is NOT working: if we change "dev tap0" to "dev tap" at client´s config file to let openvpn handle the tap interface, this goes down the drain. We see tap1 (tap0 already exists) be created but it does not goes UP, and, of course, no IPv6 addresses are created. Why openvpn at client's side is not working when tapX device is created on the fly? Regards BB

Have you read this: [url]https://community.openvpn.net/openvpn/wiki/IPv6[/url]

To tap or not to tap !!

bitbrusher

HI all

following instructions at the very top of this forum:

Goal: to build a "clustered" VPN server, i.e, some groups of Road Warriors will access some group of Servers (printers, Windows , Samba,etc). Our setup pictures three machines: our vpn hub, various Servers connected to this hub and various RW also connected to this very same hub. These Servers and RWs are both most likely to be behind NATs. One group of RWs is not allowed to see any group of servers but only the ones we assign. We use TAP because we need that each RW have access to all Server's network resources transparently. Each cluster (RWs+Server) will be under its own opervpn's hub tapX interface.

Now we are trying to do just one RW to access just one server. Baby steps!

Server:

server-bridge 'nogw'
port 1194
proto udp
dev tap
tls-server
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/cert.crt
key /etc/openvpn/keys/key.key
dh /etc/openvpn/keys/dh.pem
mode server
client-to-client
keepalive 10 120
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4
script-security 2
up /etc/openvpn/scripts/ss.sh

ss.sh contains:

#!/bin/bash
#
#	starts up  VPN.
#	$dev is the tap device created by openvpn.
#
prefix=2222:1111:aaaa:1
ip link set $dev up
ip -6 addr add ${prefix}::1/64 dev $dev

Cliente (ubuntu) config contains:

remote opvpn.com.br
port 1194
proto udp
nobind
dev tap0
user nobody
group nogroup
persist-key
persist-tun
tls-client
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
dh /etc/openvpn/keys/dh.pem
script-security 2
verb 4

Client's network/inteface contains

auto lo tap0
iface lo inet loopback
iface tap0 inet manual
 	pre-up ip tuntap add tap0 mode tap user root
 	up ip link set dev tap0 up
 	post-down ip link del dev tap0

I also have a RADVD server running giving IPv6 addresses at opvpn.com.br (real name changed to protect the innocent!)

This setup is working fine. We can "see" the servers on the other tunnel end, ping them, mount them, etc.

The problem lays in the fact we will have to tamper with the RW computer's files more than we want. For instance: change its /etc/network/interfaces file.

Install openvpn and send our config file is all we would like to do. No tampering at all.

Here is what is NOT working: if we change "dev tap0" to "dev tap" at client´s config file to let openvpn handle the tap interface, this goes down the drain.

We see tap1 (tap0 already exists) be created but it does not goes UP, and, of course, no IPv6 addresses are created.

Why openvpn at client's side is not working when tapX device is created on the fly?

Regards BB

maikcat

We use TAP because we need that each RW have access to all Server's network resources transparently.

use tap in 2 cases:

1)if you want to use bridging

2)or you want your client to be in the same broadcast domain

if you want to use bridging you need the following:

-Create the bridge interface BEFORE openvpn starts up, meaning creating a br0 interface WITH lan & tap0 under it

-Set both eth & tap0 in promisc mode

-use dev tap0 (the 0 next to tap IS mandatory) in your openvpn config

you can check your bridge status by using brctl show

Michael.

bitbrusher

Hi

As we say, our setup IS working, but not as we'd like (no tampering with any other client's files than necessary).

May be you, or anyone else, can help me with something a bit of topic:
how can we inform Ubuntu's Network Manager to use tapX instead of tap?

Isn't it strange that an application that is around for years lacks this simple, yet indispensable option, to launch a VPN?
Any tip?

For the record, we are still not convinced that it is necessary to manually configure any tapX device.
Why OpenVPN creates one if someones use "dev tap"? Why admit tap and tapX at the configuration file?

Would you guys explain me these, please?

Regards

BB

bitbrusher

Hi

As you can see above by our set-up, no IPv4 addressing is necessary to our project.

After playing around with server's "push" parameter, we discovered that if you do not force an IPv4 down the client's throat, "device tap" (automatically created by opvenVPN at client) does not go UP, and IPv6 just does not work at all (for sure)!!

Forcing an IPv6 does not bring the tap device UP either. Only v4 does the trick.

Is this by design or did we stumble at a bug?

Regards

BB

Traffic

Have you read this:
https://community.openvpn.net/openvpn/wiki/IPv6

bitbrusher

Hi Traffic et all.

Thank you for your indication, but we have already seen this document a few days ago.

And it does not apply to us since it " will discuss a routed setup; a bridged (dev tap) setup is not recommended in general, and users doing so are presumably advanced enough to know what they're doing.", and we like to think, from time to time,that we know what we are doing :mrgreen:

We started a "transparent VPN". Just like a switch. And it is working.
We have IPv6 packets (that openVPN does not know anything about, nor should it) running thru it.
After all it IS a bridge (or isn't it?)

But see! The question the is not about transporting IPv4, IPv6, Novell Netware, or whatever.
We simply does not understand why force an IPv4 (and only an IPv4, since any other does not work)
to an interface to have it brought up?
This is a level 2 device. (remember we are talking device tap here and not about supporting interface - ethX, for instance)
At least this could be on docs.

Can you answer this?
Thank you, again.

regards

BB