Hi there!
I'm new here. A couple of days ago I was trying to build a bridge VPN server with L2 (TAP). I managed to get a connection between the server and a client (both Arch Linux), and they can ping each other and SSH each other. But the client can't reach the subnet from the server, which is very frustrating since I followed every tutorial on the internet.
My server:
IP: 17.0.0.185
GW: 17.0.0.1
Server Config:
local 17.0.0.185
port 1194
proto udp
dev tap0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/lab0-vpn.crt
key /etc/openvpn/lab0-vpn.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server-bridge 17.0.0.185 255.255.255.0 17.0.0.210 17.0.0.220
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6
push "route 17.0.0.0 255.255.255.0"
Client config:
client
dev tap
proto udp
remote 190.2.36.173 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/archjew.crt
key /etc/openvpn/archjew.key
remote-cert-tls server
tls-auth /etc/openvpn/ta.key 1
comp-lzo
verb 3
Server's ip addr
# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eno16780032: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP group default qlen 1000
link/ether 00:0c:29:27:39:57 brd ff:ff:ff:ff:ff:ff
inet6 fe80::20c:29ff:fe27:3957/64 scope link
valid_lft forever preferred_lft forever
3: tap0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP group default qlen 100
link/ether 76:e5:aa:e1:7b:9b brd ff:ff:ff:ff:ff:ff
inet6 fe80::74e5:aaff:fee1:7b9b/64 scope link
valid_lft forever preferred_lft forever
4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 00:0c:29:27:39:57 brd ff:ff:ff:ff:ff:ff
inet 17.0.0.185/24 brd 17.0.0.255 scope global br0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe27:3957/64 scope link
valid_lft forever preferred_lft forever
Bridge configuration:
# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.000c29273957 no eno16780032
tap0
Client route when connected
Destination Gateway Genmask Flags Metric Ref Use Iface
default gateway 0.0.0.0 UG 600 0 0 wlan0
17.0.0.0 * 255.255.255.0 U 0 0 0 tap0
192.168.1.0 * 255.255.255.0 U 600 0 0 wlan0
Server route ("ip route" output)
default via 17.0.0.1 dev br0
17.0.0.0/24 dev br0 proto kernel scope link src 17.0.0.185
Ping from client
$ ping 17.0.0.185
PING 17.0.0.185 (17.0.0.185) 56(84) bytes of data.
64 bytes from 17.0.0.185: icmp_seq=1 ttl=64 time=14.5 ms
64 bytes from 17.0.0.185: icmp_seq=2 ttl=64 time=13.2 ms
64 bytes from 17.0.0.185: icmp_seq=3 ttl=64 time=13.2 ms
^C
--- 17.0.0.185 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 13.261/13.698/14.537/0.593 ms
What a
tcpdump sees:
$ tcpdump -v -n -i tap0 | grep echo
tcpdump: listening on tap0, link-type EN10MB (Ethernet), capture size 262144 bytes
17.0.0.210 > 17.0.0.185: ICMP echo request, id 6371, seq 1, length 64
17.0.0.185 > 17.0.0.210: ICMP echo reply, id 6371, seq 1, length 64
17.0.0.210 > 17.0.0.185: ICMP echo request, id 6371, seq 2, length 64
17.0.0.185 > 17.0.0.210: ICMP echo reply, id 6371, seq 2, length 64
17.0.0.210 > 17.0.0.185: ICMP echo request, id 6371, seq 3, length 64
17.0.0.185 > 17.0.0.210: ICMP echo reply, id 6371, seq 3, length 64
Ping to the GW in server's subnet:
$ ping 17.0.0.1
PING 17.0.0.1 (17.0.0.1) 56(84) bytes of data.
From 17.0.0.210 icmp_seq=1 Destination Host Unreachable
From 17.0.0.210 icmp_seq=2 Destination Host Unreachable
From 17.0.0.210 icmp_seq=3 Destination Host Unreachable
From 17.0.0.210 icmp_seq=4 Destination Host Unreachable
--- 17.0.0.1 ping statistics ---
6 packets transmitted, 0 received, +4 errors, 100% packet loss, time 5009ms
pipe 4
Tcpdump doesn't see anythin in this case.
Yes, forwarding is enabled and iptables is disabled in my server.
I will appreciate any help! Thank you very much!
Agustín
