Problem making a complete Layer 2 network with openvpn

fbazille

Hi everybody !

I would like to have a network like that : http://prntscr.com/cjtf3o

My IP network is:

LAN and remote LAN 192.168.1.0/24
@IP of Openvpn server LAN : 192.168.1.254
@IP of Openvpn server WAN :

@IP of my computer/DHCP server in LAN : 192.168.1.200, with GW : 192.168.1.254

/etc/openvpn/server.conf :

port 1194
proto udp
dev tap0

ca ca.crt
cert server.crt
key server.key 
dh dh2048.pem

ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.254 255.255.255.0 192.168.1.50 192.168.1.100
server-bridge
push "route 192.168.1.0 255.255.255.0"

keepalive 10 120

tls-auth ta.key 0 
key-direction 0

cipher AES-128-CBC   # AES
auth SHA256

comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log

verb 3

My server had ens160 (WAN), and ens192(LAN) who is bridged to br0

Content of /etc/network/interfaces :

 auto lo
iface lo inet loopback

auto ens160
iface ens160 inet static
        address publicIP
        netmask 
        gateway 

auto ens192
iface ens192 inet static

auto br0
iface br0 inet static
        bridge_ports ens192
        address 192.168.1.254
        netmask 255.255.255.0
        broadcast 192.168.1.255

result of ifconfig

br0       Link encap:Ethernet  HWaddr 00:50:56:bf:1e:cb
          inet adr:192.168.1.254  Bcast:192.168.1.255  Masque:255.255.255.0
          adr inet6: fe80::250:56ff:febf:1ecb/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Packets reçus:18 erreurs:0 :0 overruns:0 frame:0
          TX packets:140 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:1000
          Octets reçus:1052 (1.0 KB) Octets transmis:10753 (10.7 KB)

ens160    Link encap:Ethernet  HWaddr 00:50:56:bf:0b:6a
          inet adr:PublicIP Bcast:  Masque:
          adr inet6: fe80::250:56ff:febf:b6a/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Packets reçus:39948 erreurs:0 :0 overruns:0 frame:0
          TX packets:3267 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:1000
          Octets reçus:7335411 (7.3 MB) Octets transmis:909818 (909.8 KB)

ens192    Link encap:Ethernet  HWaddr 00:50:56:bf:1e:cb
          adr inet6: fe80::250:56ff:febf:1ecb/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Packets reçus:20 erreurs:0 :0 overruns:0 frame:0
          TX packets:174 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:1000
          Octets reçus:1424 (1.4 KB) Octets transmis:14733 (14.7 KB)

lo        Link encap:Boucle locale
          inet adr:127.0.0.1  Masque:255.0.0.0
          adr inet6: ::1/128 Scope:Hôte
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          Packets reçus:12345 erreurs:0 :0 overruns:0 frame:0
          TX packets:12345 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:1
          Octets reçus:916720 (916.7 KB) Octets transmis:916720 (916.7 KB)

tap0      Link encap:Ethernet  HWaddr 56:0a:02:1f:00:97
          adr inet6: fe80::540a:2ff:fe1f:97/64 Scope:Lien
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Packets reçus:30053 erreurs:0 :7550 overruns:0 frame:0
          TX packets:66 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:100
          Octets reçus:3184068 (3.1 MB) Octets transmis:8560 (8.5 KB)

My connection to the VPN is Ok client sided and the bridge connections is ok too, but when i try from my remote LAN to ping my server (192.168.1.200) Host unreachable, but when i try 192.168.1.254 it's ok.

I think i'm missing a point and if you have any idea, i would be grateful.
Of course, if you want more details about my config/log files please asks.

PS: sorry for my poor english (not my mother's language)

TinCanTech

Your server config:

fbazille wroteserver-bridge 192.168.1.254 255.255.255.0 192.168.1.50 192.168.1.100
server-bridge

Has --server-bridge twice .. only the second line will be processed.

fbazille

Thanks for your reply TinCanTech.

I choose to keep the first line: server-bridge 192.168.1.254 255.255.255.0 192.168.1.50 192.168.1.100

I also made a change in my /etc/network/interfaces file on the server :

auto br0
iface br0 inet static
        bridge_ports ens192 tap0
        address 192.168.1.254
        netmask 255.255.255.0
        broadcast 192.168.1.255

I add to the bridge tap0 which seems me logical, and now from my "remote LAN" with a static IP i'm able to ping the 192.168.1.254 but not the 192.168.1.200 (Server in LAN)

result of arp -a on the server:

? (@Public) à 00:15:24:41:ff:ff [ether] sur ens160
? (192.168.1.200) à 00:50:56:bf:13:88 [ether] sur br0 (Server IP)
? (192.168.1.12) à b4:b0:17:8a:5f:8b [ether] sur br0 (Laptop in remote LAN)
? (192.168.1.10) à b4:b5:2f:73:46:0b [ether] sur br0 (Laptop in remote LAN)

If i remove the bridge i'm not able to ping the 192.168.1.254 so I don't know what to add or remove in my config.

TinCanTech

fbazille wroteLAN and remote LAN 192.168.1.0/24

Your client's Real LAN is also 192.168.1.0/24 .. so you have over-lapping networks.

Please read these:

fbazille

Thanks again for your help.

I forgot to say that my environment is VMware and i had to allow promiscious mode to my network.
Now the ping works correctly, but the DHCP does not.

TinCanTech wroteYour client's Real LAN is also 192.168.1.0/24 .. so you have over-lapping networks.

Yes but there is no overlap since i want layer 2, it's the same network 🙂

fbazille

You can mark as solved that topic, the layer 2 is correctly working.
I will open an other topic about my problem forwarding web packet trough the VPN.