OpenVPN bridge on Azure - can't see subnet

tobiaxor

Hi there,
For the past few days I've been trying to configure vpn bridge on Azure VM. Everything went smooth at first, but suddenly I stumbled upon this problem:
My VPN connection works perfectly, except I can't ping any machine in a server's subnet :/

I can ping my vpn server from windows client, client from server, ping server from other remote machine, but can't ping neither local machine from remote machine in a server subnet, nor vice versa.

Vpn server: 10.4.0.10
Other remote machine: 10.4.0.8
Local machine: 10.4.0.60

So the ping between 10.4.0.60 and 10.4.0.8 doesn't work :/ Looks like some bridging problem. I've checked both sides with wireshark and it looks like nothing goes through the bridge.

Is anyone able to help? Any suggestions?

Server ifconfig (Ubuntu):

br0       Link encap:Ethernet  HWaddr 00:0d:3a:b0:24:cf
          inet addr:10.4.0.10  Bcast:10.4.0.255  Mask:255.255.254.0
          inet6 addr: fe80::20d:3aff:feb0:24cf/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1726 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1710 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:534822 (534.8 KB)  TX bytes:272562 (272.5 KB)

eth0      Link encap:Ethernet  HWaddr 00:0d:3a:b0:24:cf
          inet6 addr: fe80::20d:3aff:feb0:24cf/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:6392 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7624 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2047623 (2.0 MB)  TX bytes:1221731 (1.2 MB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:336 (336.0 B)  TX bytes:336 (336.0 B)

tap0      Link encap:Ethernet  HWaddr 7a:4a:10:f6:2a:db
          inet6 addr: fe80::784a:10ff:fef6:2adb/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:280 errors:0 dropped:3 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:40339 (40.3 KB)  TX bytes:648 (648.0 B)

And my server.conf file:

port 1194
proto tcp
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.4.0.10 255.255.255.0 10.4.0.60 10.4.0.248
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3

My server ip tables:

root@*****:/etc/openvpn# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

root@*****:/etc/openvpn# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.000d3ab024cf       no              eth0
                                                        tap0

Traffic

ensure IP forwarding is enabled on your server

tobiaxor

Nice try, but it's a bridge (tap), and ip forwarding is just for routing
"If you are using a routing-based VPN (dev tun)(...)"

Traffic

Seems that you are right .. :geek:

Even though:

net.ipv4.conf.all.forwarding = 0
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.br0.forwarding = 0
net.ipv4.conf.br0.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 0
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 0
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 0
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.tap0.forwarding = 0
net.ipv4.conf.tap0.mc_forwarding = 0
net.ipv4.ip_forward = 0

I can ping my server LAN devices ..

I guess the best plan would be to set --verb 4 in your configs and post your logs.

tobiaxor

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Traffic

Verb 9 is too much ..

I suggest you use tcpdump on the server and track the packets.

tobiaxor

Already tried it. TcpDump on OpenVPN server shows nothing - no ICMP requests on any interface while pinging remote server from local server
If I ping VPN server from local server ot from remote server - everything looks OK.
Looks like ethernet packets don't even get to the input interface of the VPN Server or are filtered somehow?

I tried: tcpdump -i any icmp -vv
Any other ideas?

tobiaxor

I've just found something odd (Wireshark dump from local computer, windows):

19 221.449573 10.200.200.20 10.4.0.9 ICMP 106 Echo (ping) request id=0x0001, seq=16548/42048, ttl=128 (no response found!)
vs
12 152.363825 10.4.0.60 10.4.0.8 ICMP 74 Echo (ping) request id=0x0001, seq=16542/40512, ttl=128 (reply in 13)

looks like ping to 10.4.0.9 is going on a wrong interface, but why? My routing table looks ok.

Traffic

I had a similar problem with WXP binding to the TAP device for normal LAN packets ..

There is a term for it (but I cannot remember it)
W7 and up does not suffer from this any more .. apparently

tobiaxor

Well I'm almost sure, that this is related to Azure somehow.
This interface on which I try to ping remote server is chosen incorrectly, because of the ARP forwarding problem - my local computer don't get any ARP response from the remote server... Because the broadcast never gets there. Don't know why. Looks like I can see ARP broadcasts on both interfaces on the VPN server: br0 and eth0 (don't see on tap0 though) - but tcpdump on the server in the remote subnet shows nothing. Very odd.

Oh, and one more thing - the ARP packets are tampered somehow by Azure - all the responses I get are from 00:11:22:33.... etc

tobiaxor

Ok, I think I've found the answer.
It looks like Azure switches are not forwarding ANY ARP requests - instead they reply basing on Azure VMs config - they problably have locally replicated NIC list in every subnet and have knowledge about "routing" ethernet frames. If I arping any server in Azure from other server in Azure I get response from the switch, instead of the target machine (confirmed with tcpdump)
42 bytes from 12:34:56:78:9a:bc (10.4.0.8): index=0 time=2.066 msec

I 've also confirmed, that arping from local computer to remote in Azure over vpn is forwarded to the correct "output" interface (eth0) on VPN server, so it's correctly broadcasted to the subnet, but gets no reply because of this:
09:54:48.785419 ARP, Request who-has 10.4.0.9 tell 10.4.0.61, length 28

Since 10.4.0.61 is not assigned to any NIC in Azure configuration, it's discarded by the switch :/ looks like it's impossible to create Azure VPN without NAT :/