Pushing server-side DHCP settings to client

[deleted]

I am trying to run an Openvpn configuration, that creates a Level 2 vpn and retrieves & pushes the server-side DHCP settings to the vpn-client. The only thing that shall not be pushed, are the server-side gateway settings.

Something in the configuration doesn't work properly. Before starting Openvpn with the server.conf, I run some bridge-command, to bridge br0 and eth0 and then get DHCP.
When connecting with the vpn-client, the vpn-server recognizes the request, but according to the error message of the vpn-client, the vpn-server does not provide the correct network configuration.

What is wrong in the settings? (privided below)

server.conf:

port 1194
proto udp
dev tap0
ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key  # This file should be kept secret
dh ./easy-rsa2/keys/dh2048.pem
server-bridge
push "route 0.0.0.0 255.255.255.255 net_gateway"
keepalive 10 120
comp-lzo
user openvpn
group openvpn
persist-key
status openvpn-status.log
verb 3

bridge-start:

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="0.0.0.0"
eth_netmask="0.0.0.0"
eth_broadcast="0.0.0.0"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

#ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
ifconfig $br
dhclient

bridge-stop:

#!/bin/bash

####################################
# Tear Down Ethernet bridge on Linux
####################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged together
tap="tap0"

ifconfig $br down
brctl delbr $br

for t in $tap; do
    openvpn --rmtun --dev $t
done

vpn-server log:

root@vpnserver:/etc/openvpn# openvpn server.conf
Mon Nov 30 09:31:53 2015 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Mon Nov 30 09:31:53 2015 WARNING: you are using user/group/chroot/setcon without persist-tun -- this may cause restarts to fail
Mon Nov 30 09:31:53 2015 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mon Nov 30 09:31:53 2015 Diffie-Hellman initialized with 2048 bit key
Mon Nov 30 09:31:53 2015 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Nov 30 09:31:53 2015 TUN/TAP device tap0 opened
Mon Nov 30 09:31:53 2015 TUN/TAP TX queue length set to 100
Mon Nov 30 09:31:53 2015 GID set to openvpn
Mon Nov 30 09:31:53 2015 UID set to openvpn
Mon Nov 30 09:31:53 2015 UDPv4 link local (bound): [undef]
Mon Nov 30 09:31:53 2015 UDPv4 link remote: [undef]
Mon Nov 30 09:31:53 2015 MULTI: multi_init called, r=256 v=256
Mon Nov 30 09:31:53 2015 Initialization Sequence Completed
Mon Nov 30 09:32:05 2015 46.223.128.13:21188 TLS: Initial packet from [AF_INET]46.223.128.13:21188, sid=d54a742e 6545e76b
Mon Nov 30 09:32:06 2015 46.223.128.13:21188 VERIFY OK: depth=1, C=DE, ST=B, L=Berlin, O=MyComp, OU=changeme, CN=changeme, name=changeme, emailAddress=info@webmaster
Mon Nov 30 09:32:06 2015 46.223.128.13:21188 VERIFY OK: depth=0, C=DE, ST=B, L=Berlin, O=MyComp, OU=changeme, CN=client, name=changeme, emailAddress=info@webmaster
Mon Nov 30 09:32:10 2015 46.223.128.13:21188 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 30 09:32:10 2015 46.223.128.13:21188 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 30 09:32:10 2015 46.223.128.13:21188 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 30 09:32:10 2015 46.223.128.13:21188 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 30 09:32:10 2015 46.223.128.13:21188 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Nov 30 09:32:10 2015 46.223.128.13:21188 [client] Peer Connection Initiated with [AF_INET]46.223.128.13:21188
Mon Nov 30 09:32:10 2015 client/46.223.128.12:21188 MULTI: no dynamic or static remote --ifconfig address is available for client/46.223.128.13:21188
Mon Nov 30 09:32:13 2015 client/46.223.128.12:21188 PUSH: Received control message: 'PUSH_REQUEST'
Mon Nov 30 09:32:13 2015 client/46.223.128.12:21188 send_push_reply(): safe_cap=940
Mon Nov 30 09:32:13 2015 client/46.223.128.12:21188 SENT CONTROL [client]: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 net_gateway,route-gateway dhcp,ping 10,ping-restart 120' (status=1)

vpn-server ip and bridge configuration:

root@srv-connect:/etc/openvpn# ifconfig
br0       Link encap:Ethernet  Hardware Adresse 52:54:00:52:64:45  
          inet Adresse:10.10.10.80  Bcast:10.10.10.255  Maske:255.255.255.0
          inet6-Adresse: 2a02:8071:91a8:5401:e1a9:85f7:66dd:f642/64 Gültigkeitsbereich:Global
          inet6-Adresse: 2a02:8071:91a8:5401:5054:ff:fe52:6333/64 Gültigkeitsbereich:Global
          inet6-Adresse: fe80::5054:ff:fe52:6444/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:1490 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:991 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX-Bytes:315843 (315.8 KB)  TX-Bytes:187001 (187.0 KB)

eth0      Link encap:Ethernet  Hardware Adresse 52:54:00:52:64:45  
          inet Adresse:10.10.10.80  Bcast:10.10.10.255  Maske:255.255.255.0
          inet6-Adresse: 2a02:8071:91a8:5401:5054:ff:fe52:6333/64 Gültigkeitsbereich:Global
          inet6-Adresse: fe80::5054:ff:fe52:6444/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:1761 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:1070 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX-Bytes:449739 (449.7 KB)  TX-Bytes:195438 (195.4 KB)

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:65536  Metrik:1
          RX-Pakete:40 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:40 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX-Bytes:2624 (2.6 KB)  TX-Bytes:2624 (2.6 KB)

tap0      Link encap:Ethernet  Hardware Adresse 7e:ae:b9:a7:09:ec  
          inet6-Adresse: fe80::7cae:b9ff:fea7:9eb/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST PROMISC MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:159 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:100 
          RX-Bytes:0 (0.0 B)  TX-Bytes:71431 (71.4 KB)

Traffic

Bambusman wrote

ifconfig
br0       Link encap:Ethernet  Hardware Adresse 52:54:00:52:64:45 
          inet Adresse:10.10.10.80  Bcast:10.10.10.255  Maske:255.255.255.0
          <..>
eth0      Link encap:Ethernet  Hardware Adresse 52:54:00:52:64:45 
          inet Adresse:10.10.10.80  Bcast:10.10.10.255  Maske:255.255.255.0
          <..>

How do you assign this address ?

[deleted]

I get this address from within the bridge-start file. The last line in the code calls dhclient, hence requesting the DHCP server to provide an IP.

Is everything alright with the Openvpn settings? What about the bridge?

Traffic

Bambusman wroteI get this address from within the bridge-start file. The last line in the code calls dhclient

Maybe you have found a limitation .. try setting up the bridge according to the manual and see what happens.

https://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html