Client connected but can't ping

sappy

I am trying to build a bridge server.
The client can connect sucessfully but cannot ping nor access to anything trought the tunnel. I know it's usually a firewall issue but everything seems ok.
The server is a raspberry pi. I already had a functional server on it but after a change of router it doesn't work anymore.

Here is the server config :

port 1195
proto udp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server-bridge 192.168.10.200 255.255.255.0 192.168.10.201 192.168.10.254
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Here is the ifconfig result :

br0 Link encap:Ethernet HWaddr b8:27:eb:14:da:2e
inet adr:192.168.10.200 Bcast:192.168.10.255 Masque:255.255.255.0
adr inet6: fe80::ba27:ebff:fe14:da2e/64 Scope:Lien
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6876 errors:0 dropped:0 overruns:0 frame:0
TX packets:1768 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:807993 (789.0 KiB) TX bytes:237043 (231.4 KiB)

eth0 Link encap:Ethernet HWaddr b8:27:eb:14:da:2e
inet adr:192.168.10.100 Bcast:192.168.10.255 Masque:255.255.255.0
adr inet6: fe80::ba27:ebff:fe14:da2e/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:642163 errors:0 dropped:0 overruns:0 frame:0
TX packets:6208 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:1000
RX bytes:32446426 (30.9 MiB) TX bytes:498263 (486.5 KiB)

lo Link encap:Boucle locale
inet adr:127.0.0.1 Masque:255.0.0.0
adr inet6: ::1/128 Scope:H▒te
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:24 errors:0 dropped:0 overruns:0 frame:0
TX packets:24 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:2112 (2.0 KiB) TX bytes:2112 (2.0 KiB)

tap0 Link encap:Ethernet HWaddr ea:bf:eb:8e:26:af
adr inet6: fe80::e8bf:ebff:fe8e:26af/64 Scope:Lien
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1069 errors:0 dropped:0 overruns:0 frame:0
TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:100
RX bytes:91928 (89.7 KiB) TX bytes:942 (942.0 B)

And here is the iptables :

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Another stupid question : Does it matter which IP address the router need to follow the port ? Because the client can connect with the 192.168.10.200 but not the 192.168.10.100.

Any help is welcome.

Best regards,

TinCanTech

sappy wrotebr0 Link encap:Ethernet HWaddr b8:27:eb:14:da:2e
inet adr:192.168.10.200 Bcast:192.168.10.255 Masque:255.255.255.0
<..>
eth0 Link encap:Ethernet HWaddr b8:27:eb:14:da:2e
inet adr:192.168.10.100 Bcast:192.168.10.255 Masque:255.255.255.0

Looks like you have not built your bridge correctly ..

What does this give you:

$ brctl show

sappy

Thank you for your comment !

Here is the script that creates the bridge :

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.10.200"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.10.255"

for t in $tap; do
openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
brctl addif $br $t
done

for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

What could be wrong with it ?

TinCanTech

TinCanTech wroteWhat does this give you:

$ brctl show

while your server is up ..

sappy

Ok I successfully fixed the server thanks to you.
The mistake was the bad ip address in the script. It should be :
eth_ip="192.168.10.100"

Thank you again.

TinCanTech

I am still not convinced you have set it up correctly .. but that is your decision.

sappy

Well, now that the IP is correct the ifconfig gives :

br0 Link encap:Ethernet HWaddr 3e:73:1d:ca:1d:50
inet adr:192.168.10.100 Bcast:192.168.10.255 Masque:255.255.255.0
adr inet6: fe80::3c73:1dff:feca:1d50/64 Scope:Lien
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6930 errors:0 dropped:0 overruns:0 frame:0
TX packets:6454 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:972190 (949.4 KiB) TX bytes:2194684 (2.0 MiB)

eth0 Link encap:Ethernet HWaddr b8:27:eb:14:da:2e
inet adr:192.168.10.100 Bcast:192.168.10.255 Masque:255.255.255.0
adr inet6: fe80::ba27:ebff:fe14:da2e/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:11199 errors:0 dropped:0 overruns:0 frame:0
TX packets:10531 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:1000
RX bytes:2518352 (2.4 MiB) TX bytes:2794176 (2.6 MiB)

lo Link encap:Boucle locale
inet adr:127.0.0.1 Masque:255.0.0.0
adr inet6: ::1/128 Scope:H▒te
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

tap0 Link encap:Ethernet HWaddr 3e:73:1d:ca:1d:50
adr inet6: fe80::3c73:1dff:feca:1d50/64 Scope:Lien
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:3948 errors:0 dropped:0 overruns:0 frame:0
TX packets:6002 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 lg file transmission:100
RX bytes:473822 (462.7 KiB) TX bytes:1832407 (1.7 MiB)

And brctl show :

bridge name bridge id STP enabled interfaces
br0 8000.3e731dca1d50 no eth0
tap0

Looks better to you ?

TinCanTech

sappy wrotebr0 Link encap:Ethernet HWaddr 3e:73:1d:ca:1d:50
inet adr:192.168.10.100 Bcast:192.168.10.255 Masque:255.255.255.0
<..>

eth0 Link encap:Ethernet HWaddr b8:27:eb:14:da:2e
inet adr:192.168.10.100 Bcast:192.168.10.255 Masque:255.255.255.0

As i understand it .. this line should not be present ..

eg (my setup):

br0       Link encap:Ethernet  HWaddr 00:30:1b:42:65:ac  
          inet addr:10.x.x.x  Bcast:10.x.x.255  Mask:255.255.255.0
          inet6 addr: fe80::xxx/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:45 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:186 (186.0 B)  TX bytes:9049 (9.0 KB)

eth0      Link encap:Ethernet  HWaddr 00:30:1b:42:65:ac  
          inet6 addr: fe80::xxx/64 Scope:Link
          inet6 addr: 2xxx/64 Scope:Global
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:35493 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32079 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:24532535 (24.5 MB)  TX bytes:5296445 (5.2 MB)

The ethernet device should not have an IPv4 address ..

My bridge:

$ brctl show
bridge name       bridge id              STP enabled       interfaces
br0               8000.00301b4265ac      no                eth0
                                                           tap0

Your bridge:

brctl show :

bridge name bridge id STP enabled interfaces
br0 8000.3e731dca1d50 no eth0
tap0

It looks like this line has failed in the bridge-start script:

ifconfig $eth 0.0.0.0 promisc up

Try running the script without starting openvpn ..