OpenVPN server-bridge DHCP help

jrosetto

I have OpenVPN-Server 2.4.0 installed and working in TAP mode on a Debian Stretch install. I would like to have the VPN connections handled by the DHCP pool handled from my router. When I set the configuration to 'server-bridge' a windows machine will connect fine, but a linux machine is unable to get an IP. Here is the openvpn-server log during the connection from a linux machine. I set a line in bold which I think is the problem but am unsure on how to go about fixing it after doing some googling.

Tue Jan 23 14:47:34 2018 XX.XX.XXX.81:34336 TLS: Initial packet from [AF_INET]XX.XX.XXX.81:34336, sid=c52763dd 2ec0e7bb
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 VERIFY OK: depth=1, CN=ca
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 VERIFY OK: depth=0, CN=client
steve: authentication ok.
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 TLS: Username/Password authentication succeeded for username 'steve' [CN SET]
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 [steve] Peer Connection Initiated with [AF_INET]XX.XX.XXX.81:34336
Tue Jan 23 14:47:42 2018 steve/XX.XX.XXX.81:34336 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_f24a7e322513d2e28c05438412ff540a.tmp
Tue Jan 23 14:47:42 2018 steve/XX.XX.XXX.81:34336 MULTI: no dynamic or static remote --ifconfig address is available for steve/XX.XX.XXX.81:34336
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 VERIFY OK: depth=1, CN=ca
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 VERIFY OK: depth=0, CN=client
steve: authentication ok.
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 TLS: Username/Password authentication succeeded for username 'steve' [CN SET]
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jan 23 14:47:49 2018 steve/XX.XX.XXX.81:34336 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jan 23 14:47:49 2018 steve/XX.XX.XXX.81:34336 SENT CONTROL [steve]: 'PUSH_REPLY,route-gateway dhcp,ping 10,ping-restart 120' (status=1)

If I switch to 'server-bridge 192.168.1.1 255.255.255.0 192.168.1.241 192.168.1.249' I am able to connect on both windows and linux without issues.
Here is the output when it works. The problem is I have a large pool setup for my DHCP because we get a lot of fly by leases and I need a decent amount of VPN ip's as well so this isn't a great solution and changing to a larger subnet would be a nitemare with everything I have setup currently.

Tue Jan 23 14:47:34 2018 XX.XX.XXX.81:34336 TLS: Initial packet from [AF_INET]XX.XX.XXX.81:34336, sid=c52763dd 2ec0e7bb
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 VERIFY OK: depth=1, CN=ca
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 VERIFY OK: depth=0, CN=client
steve: authentication ok.
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 TLS: Username/Password authentication succeeded for username 'steve' [CN SET]
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jan 23 14:47:41 2018 XX.XX.XXX.81:34336 [steve] Peer Connection Initiated with [AF_INET]XX.XX.XXX.81:34336
Tue Jan 23 14:47:42 2018 steve/XX.XX.XXX.81:34336 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_f24a7e322513d2e28c05438412ff540a.tmp
Tue Jan 23 14:47:42 2018 steve/XX.XX.XXX.81:34336 MULTI: no dynamic or static remote --ifconfig address is available for steve/XX.XX.XXX.81:34336
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 VERIFY OK: depth=1, CN=ca
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 VERIFY OK: depth=0, CN=client
steve: authentication ok.
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 TLS: Username/Password authentication succeeded for username 'steve' [CN SET]
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 23 14:47:48 2018 steve/XX.XX.XXX.81:34336 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jan 23 14:47:49 2018 steve/XX.XX.XXX.81:34336 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jan 23 14:47:49 2018 steve/XX.XX.XXX.81:34336 SENT CONTROL [steve]: 'PUSH_REPLY,route-gateway dhcp,ping 10,ping-restart 120' (status=1)

I'm not really sure if this is an openvpn forum question or a mikrotik forum question so I'm hoping someone can point me in the right direction or give me some advise.

Thanks.

brendan

i am running Fedora, so files and names have been changed to protect the distro... 🙂 i had to create an interface file for the tap0 interface. fedora/redhat use /etc/sysconfig/network-scripts/ifcfg-<interface_name>, so i used ifcfg-tap0. this allows me to use TAP and push DHCP to my ISC instance.

DEVICE=tap0
ONBOOT=no
BOOTPROTO=dhcp
TYPE=Ethernet
NAME=tap0
IPV6INIT=no
IPV6_AUTOCONF=no
IPV6_DEFROUTE=no
IPV6_FAILURE_FATAL=no
IPV6_PEERDNS=no
IPV6_PEERROUTES=no
NOZEROCONF=yes
NM_CONTROLLED=no

TiTex

you are doing it wrong in my opinion
see https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
https://community.openvpn.net/openvpn/wiki/BridgingOverview