Hello everyone, first of all sorry my english is a bit sucky and/or broken at parts.
I'm having a little issue with OpenVPN S2S Layer-2 Bridging and DHCP over the bridge.
First of all, all my clients no matter on which site of the tunnel get ip adresses assigned by the dhcp server, that is no problem.
But only the clients on the "OpenVPN Access Server"-side get local ip adresses AND the default gw assigned by the dhcp server, everything on the client site doesn't get the default gw.
First of all i thought about the standard gateway not really accessible but i can ping everything everywhere on either site...
I have a setup like in this howto:
https://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/site-to-site-layer-2-bridging-using-openvpn-access-server/
Please note, that when I'm writing now I will refer to "left site" and "right site" according to the graphic from the link above.
My Network is like this:
Network: 192.168.5.0/24
Right site:
Router: 192.168.5.1 (default gw)
OpenVPN Access Server: 192.168.5.70
DHCP Server: 192.168.5.7
Left site:
OpenVPN Client with ip_forwarding=1: 192.168.5.2 (Bridge Interface)
And a few machines with static network configuration...
Please note, that when I set the ip config with default gw (192.168.5.1) manually, everything works great on either site!
Here are the configs from the client machine (192.168.5.2).
OpenVPN client.conf:
setenv FORWARD_COMPATIBLE 1
client
server-poll-timeout 4
nobind
remote oas1.pathin.org 1194 udp
remote oas1.pathin.org 1194 udp
remote oas1.pathin.org 443 tcp
remote oas1.pathin.org 1194 udp
remote oas1.pathin.org 1194 udp
remote oas1.pathin.org 1194 udp
remote oas1.pathin.org 1194 udp
remote oas1.pathin.org 1194 udp
dev tap
dev-type tap
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO
up "/bin/bash /etc/openvpn/bridge-up.sh"
down "/bin/bash /etc/openvpn/bridge-down.sh"
script-security 2
route-nopull
interface config
# The loopback network interface
auto lo eth0 eth1
iface lo inet loopback
#eth0 - WAN
iface eth0 inet static
address 94.23.159.212
netmask 255.255.255.255
broadcast 94.23.159.212
post-up route add 94.23.36.254 dev eth0
post-up route add default gw 94.23.36.254
post-down route del 94.23.36.254 dev eth0
post-down route del default gw 94.23.36.254
#eth1 - LAN
iface eth1 inet manual
pre-up ifconfig $IFACE up
post-down ifconfig $IFACE down
bridge-up.sh
#!/bin/bash
PATH=$PATH:/sbin:
bridge="vpn0"
tap="tap0"
eth="eth1"
if [[ ! $(ifconfig $tap 2>/dev/null) ]]; then
echo TAP is not active, quitting...
exit
fi
eth_addr=192.168.5.2
eth_mask=255.255.255.0
default_route=$(ip r | awk '/^default/ {print $3}')
default_if=$(ip r | awk '/^default/ {print $5}')
echo Creating bridge interface $bridge...
ifconfig $bridge down 2>/dev/null; brctl delbr $bridge 2>/dev/null
brctl addbr $bridge
echo Adding TAP interface $eth to bridge $bridge...
brctl addif $bridge $tap
echo Adding Ethernet interface $eth to bridge $bridge...
brctl addif $bridge $eth
echo Turning promiscuous mode on for TAP interface $tap...
ifconfig $tap 0.0.0.0 promisc up
echo Turning promiscuous mode on for Ethernet interface $eth...
ifconfig $eth 0.0.0.0 promisc up
if [[ -n $eth_addr && -n eth_mask ]]; then
echo Setting bridge IP address $eth_addr with netmask $eth_mask...
ifconfig $bridge $eth_addr netmask $eth_mask
fi
if [[ $default_if == $eth ]]; then
echo Setting gateway for new bridge interface $bridge...
ip r add default via $default_route dev $bridge
fi
echo Creating interface down symbolic link...
ln -s /sbin/bridge-stop /etc/sysconfig/network/scripts/ifdown-$bridge 2>/dev/null
exit 0
I guess bridge down is not important...
Thanks for all the help in advance...
Greetings,
Patrick Fischer
