Hi, I setting up my own server and client for the first time. What I need is ethernet bridge over UDP. After a few days of learning and tweaking, I got to the place where the connection is established between client and server, and the tap interface does appear on the client system, along with a correct IP address, and with routing entries appearing as well.
But the oddity is that I still cannot send packets either way over the tap. If I try ping with verbose mode, I get:
ping: socket: Permission denied, attempting raw socket...
and then the pings fail.
Following is details about my system, and config files. [Please note: I know in documentation it is bad to involve a 192.168.1.0 subnet, but I was forced to this by preexisting network infrastructure.]
Server system: LibreCMC v-1.4.1a-final, Linux version 4.4.87-gnu (<snip>) (gcc version 5.4.0 (LEDE GCC 5.4.0 unknown) ) #0 Tue Oct 17 04:15:50 2017, OpenVPN 2.4.3 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD], library versions: OpenSSL 1.0.2k 26 Jan 2017, LZO 2.09
Client system: Debian 9, Linux version 4.9.0-4-686-pae (<snip>) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.51-1 (2017-09-28) OpenVPN 2.4.0 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Server config:
[oconf]config openvpn 'myvpn'
option enabled '1'
option dev 'tap0'
option port '1194'
option proto 'udp'
option status '/var/log/openvpn_status.log'
option log '/tmp/openvpn.log'
option verb '3'
option mute '5'
option keepalive '10 120'
option persist_key '1'
option persist_tun '1'
option user 'nobody'
option group 'nogroup'
option ca '/etc/easy-rsa/keys/ca.crt'
option cert '/etc/easy-rsa/keys/myvpn.crt'
option key '/etc/easy-rsa/keys/myvpn.key'
option dh '/etc/easy-rsa/keys/dh2048.pem'
# option mode 'server'
option tls_server '1'
option tls_auth '/etc/easy-rsa/keys/ta.key 0'
option server_bridge '192.168.1.1 255.255.255.0 192.168.1.201 192.168.1.220'
option topology 'subnet'
# option route_gateway '192.168.1.1'
option client_to_client '1'
list push 'persist-key'
list push 'persist-tun'
list push 'redirect-gateway def1'
# allow your clients to access to your network
list push 'route 192.168.1.0 255.255.255.0'
# push DNS to your clients
list push 'dhcp-option DNS 192.168.1.1'
option comp_lzo 'no'[/oconf]
Client config
[oconf]
# Connection_name: Imported-Setup
# Connection_selected
client
### direct
remote <snip> 1194
proto udp
dev tap0
ca certs/asiclient2.ovpn
cert certs/asiclient2.ovpn
key certs/asiclient2.ovpn
tls-auth certs/ta.key 1
auth-user-pass /etc/gadmin-openvpn/client/Imported-Setup/passfile
lladdr 00:11:22:33:44:55
cipher AES-256-CBC
chroot /etc/gadmin-openvpn/client/Imported-Setup
user nobody
group nogroup
persist-key
persist-tun
log /var/log/gadmin-openvpn/client/Imported-Setup/openvpn-client.log
status /var/log/gadmin-openvpn/client/Imported-Setup/openvpn-client-status.log
verb 3
mssfix 1200
mute 20
ping 10
ping-restart 30
allow-pull-fqdn
resolv-retry infinite
up /etc/gadmin-openvpn/client/Imported-Setup/upscript.sh[/oconf]
