VPN Bridge internet access across brouter

flyboy-hill

I have an OpenVPN server running on my Ubuntu 14.04 PC that is also my gateway to the internet (and is running Squid3).
I have created a bridged VPN between my LAN's eth1 and tap0. My WAN is on eth0.

            Internet
                |
     +----------+---------+
     |  +-------+------+  |
     |  |     eth0     |  |
     |  | Routing/NAT  |  |
 VPN-+--+--------------+--+-LAN
     |  |   Bridging   |  |
     |  |     br0      |  |
     |  |  tap0  eth1  |  |
     |  +--------------+  |
     +--------------------+

My bridge works perfectly connecting VPN clients to my LAN devices and the server itself.
OpenVPN clients can access the internet through the bridge if they connect to the HTTP proxy (Squid3).
What I am struggling with is how to give the OpenVPN clients access to the internet if they don't use the HTTP proxy, or if they aren't using http. What it looks like is happening is that the bridge is sending ALL packets to my LAN, when the ARP fails for an internet address (which is not unreasonable for a bridge!); but the trouble with this is that my gateway is the bridge (I don;t have a separate gateway on my LAN). I therefore believe I have Bridge/Router (brouter) scenario.

I have looked into Proxy-Arp and ebtables (with Ubuntu 14.04 the br_netfilter module needs manually loading), but have been unsuccessful in getting it working so far. I am also unsure which would be the best to solve my problem in the most efficient way (assuming there is a way 😉 )?

Traffic

flyboy-hill wroteI am also unsure which would be the best to solve my problem in the most efficient way (assuming there is a way

Please see the Forum rules (top of page)

flyboy-hill

I have tried the following:

# Route VPN bridge traffic to iptables that is not bound for LAN
modprobe br_netfilter
#ebtables -t broute -A BROUTING -p ipv4 -i tap+                      --ip-dst ! 192.168.0.0/16 -j DROP
#ebtables -t broute -A BROUTING -p arp  -i tap+ --arp-op Request --arp-ip-dst ! 192.168.0.0/16 -j DROP
ebtables -t nat -A PREROUTING -p ipv4 -i tap+                      --ip-dst ! 192.168.0.0/16 -j DROP
ebtables -t nat -A PREROUTING -p arp  -i tap+ --arp-op Request --arp-ip-dst ! 192.168.0.0/16 -j DROP

Which does not work, but am unsure why.
I am using Ubuntu's network Manager, on the client side, to configure the VPN client, and routing table looks like this after connecting (default route is VPN):

stephen@my-VirtualBox:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     50     0        0 tap0
default         10.120.0.1      0.0.0.0         UG    100    0        0 eth1
10.120.0.0      *               255.255.224.0   U     100    0        0 eth1
cpc4-papw5-2-0- 10.120.0.1      255.255.255.255 UGH   100    0        0 eth1
link-local      *               255.255.0.0     U     1000   0        0 eth1
192.168.10.0    *               255.255.255.0   U     50     0        0 tap0
192.168.10.0    *               255.255.255.0   U     950    0        0 tap0