mrc
Hi,
OpenVPN noob. Goal is to have a IPTV STB working over VPN for development purposes.
I installed OpenVPN-AS on Ubuntu-pc connected directly to a fiber-ONT (no router in between, so pc itself have a public ip) and currently using a Asus RT-AC66U with Merlin-AsusWRT as a client.
* VPN-mode is Layer 2 (Ethernet bridging)
* Cipher disabled (reduces load on the client side)
* The two broadband connections I use have 100 Mbps connection.
Problems:
* It seems that I can join multicast, but not leave. (not critical - there are only three multicasts that I need, which should be joined all the time by the STB on the client side - one Live TV channel and the two others are for "system information" and EPG - combined these multicasts has a bandwidth on around 25 Mbps at the most).
* If I on the server-side - the pc running OpenVPN-AS - wants to block multicast adresses, how can that be done? iptables-rules against the WAN-NIC on the pc?
* Flooding. The load on the RT-AC66U is 100 % and I get a lot of packet loss. I guess the router process the multicast in software, instead of using the hardware acceleration it would normally use, and it sends the multicast to every interface it has. Ideas how I can limit this?
Client-issues:
In theory, the RT-AC66U seems to be working for this purpose, if I can get the load down and configured it on other areas the way it needs to be. The alternative would have been to have e.g. a PC as a VPN-client, and then pass the traffic - multicast and regular internet traffic - over to the STB through a second NIC on the pc. Suggestions on how this could be done? I guess a PC here could handle the flooding a little better...
mrc
Ok, I sort of made this work much better - and at the same time it dosn't work.
I put up a PC which I use as a client for OpenVPN. I bridged tap0 to eth1, and connected the STB for Eth1. I get multicasts to the STB, and it seems like also leaving the multicasts workes fine. No packet-loss, and not more bandwidth-usage than it should have.
This is the setup now:
[OpenVPN AS Server] - [ONT] - [INTERNET] - [ONT] - [Ubuntu PC OpenVPN-Client] - [STB]
But I don't get a dhcp-delivered IP-adress to the STB. I put in 172.27.240.5 manually. Reception of multicasts seems to work whatever IP I put on the STB.
To get a IP delivered to the STB, I understand I need to set up a DHCP-server on the OpenVPN AS Server side. Installed isc-dhcp-server. But what interface should I bind this server to on the server? asbr0? And will it work, as I guess there is no routing in this setup?
mrc
ok, a little update...
I put a SOHO-router in front of the OpenVPN AS. This will work as DHCP. On the client side, I still use the OpenVPN-client on a Ubuntu-installation and I bridge tap0 over a different network adapter where the STB is connected.
The STB now get IP-adress and DNS delivered through DHCP. But no Gateway-adress. Setting IP, GW and DNS manually works, but I want/need this to work with DHCP.
I see some solutions out there, but the configuration tips are mostly against OpenVPN "non-AS". Tried some extra config through sacli, but no luck :-( Tips?
Hope here was that the OpenVPN AS was a little easier to manage - using the setup I have now as a POC before installing it on a more permanent hardware and buying the licenses. But in a way, it seems like there is more information around for OpenVPN "non-AS" if you first run intro trouble....
