We're using OpenVPN on CentOS to connect a branch Office to our main location. The current setup with a single bridge works fine [code]Main Office (192.168.1.0/24) | Branch (192.168.1.0/24) ----------------------------------|------------------------------------ OpenVPN Server br0: 192.168.1.253 | OpenVPN Client br0: 192.168.1.2544[/code] Now we need to bridge a separate VLAN to the branch office. The goal is to replace the rented connections to other offices (which are rather expensive) with a bridged OpenVPN setup. [code] The new setup VLAN 1 untagged \ / VLAN 1 untagged Switch Port 1 > OVPN Server br0 >-- Switch - - Port1 VLAN 2 tagged / \ \ VLAN 2 tagged \ \ Port 2 - VLAN 2 untagged [/code] I thought this [url]https://forum.openwrt.org/viewtopic.php?id=33678[/url] was the solution to my problem, but it's just a VLAN connection between the OpenVPN server and client and no bridging to both LANs (main and branch office). It also involves instructions for a specific router model while we use CentOS based servers on both sides. I think i read each and every topic, that had 'VLAN' and 'tagging' in it, but i just could not find a solution. Is this possible at all? I don't want to use tunneling and routing, but just make the connection "fully transparent".

It sounds feasible ... looks like your switches [i]handle[/i] the VLANs and OpenVPN just passes data.

An OpenVPN based network bridge in TAP mode will pass all ethernet frames regardless .. No [i]redirection[/i] is required .. thus, "transparent bridge" .. I have no idea what you need on your switches.

Fully transparent network bridging possible?

andre.weidner@muehlhausen.de

We're using OpenVPN on CentOS to connect a branch Office to our main location. The current setup with a single bridge works fine

Main Office (192.168.1.0/24)      |   Branch (192.168.1.0/24)
----------------------------------|------------------------------------
OpenVPN Server br0: 192.168.1.253 |   OpenVPN Client br0: 192.168.1.2544

Now we need to bridge a separate VLAN to the branch office. The goal is to replace the rented connections to other offices (which are rather expensive) with a bridged OpenVPN setup.

The new setup

VLAN 1 untagged \                                                                    / VLAN 1 untagged
                 Switch Port 1 > OVPN Server br0 >--< OVPN Client br0 > Switch - - Port1 
VLAN 2 tagged   /                                                            \       \ VLAN 2 tagged
                                                                              \ 
                                                                               \
                                                                                Port 2 - VLAN 2 untagged

I thought this https://forum.openwrt.org/viewtopic.php?id=33678 was the solution to my problem, but it's just a VLAN connection between the OpenVPN server and client and no bridging to both LANs (main and branch office). It also involves instructions for a specific router model while we use CentOS based servers on both sides.

I think i read each and every topic, that had 'VLAN' and 'tagging' in it, but i just could not find a solution. Is this possible at all? I don't want to use tunneling and routing, but just make the connection "fully transparent".

Traffic

It sounds feasible ... looks like your switches handle the VLANs and OpenVPN just passes data.

andre.weidner@muehlhausen.de

Traffic wroteIt sounds feasible ... looks like your switches handle the VLANs and OpenVPN just passes data.

But how?

Basically i need OpenVPN to redirect all incoming packets on eth0 and eth0.X to be forwarded to the far end of the line. I just have no clue, how to do it.

Failed variants that i tested so far:
1. Two bridges
One bridge "br0" for the Default VLAN 1 with eth0 and tap0. A second bridge "br_vlan" with eth0.2 and tap0.2. Configured on both ends of the line, but no traffic to VLAN 2. How do i have to configure OpenVPN, to include tap0.2?

2. One bridge
One bridge br0 with members eth0/tap0 and eth0.2/tap0.2. This bridges the VLANs, too, i think. And would make the VLANs superfluous.

3. One bridge without eth0.2
Same as above but without eth0.2. Did not expect it to work, but i was desperate 🙂

Traffic

An OpenVPN based network bridge in TAP mode will pass all ethernet frames regardless ..
No redirection is required .. thus, "transparent bridge" ..

I have no idea what you need on your switches.

andre.weidner@muehlhausen.de

Traffic wroteAn OpenVPN based network bridge in TAP mode will pass all ethernet frames regardless ..
No redirection is required .. thus, "transparent bridge" ..

I have no idea what you need on your switches.

TCPDUMP shows packets tagged as VLAN 2 arriving on both br0 interfaces (main and branch office). But it seems like they are not transmitted correctly over to the 'real' (eth) interface to the switch.

For example the client connected to VLAN2 on the switch does not get a reply to his dhcp request, but when connected to VLAN1 everything is fine.

Using the same switch without VPN bridge works (direct connection to our network), too.

I'm running out of ideas 🙁