Hello
I have a Dell Poweredge R210-II where I'm running Ubuntu server 17.10 on. I want to use it to access my samba shares from my NAS which is on another IP address than my OpenVPN server. Because I am unable to set static routes onto my router, I want to use OpenVPN in bridged mode. I can login to the server from another network, but I can't seem to access my samba shares. I also can't ping to any of the devices in the local network. My router has forwarded port 1194 to my server (192.168.0.13 / UDP). I set up a domain name with no-ip.org, which replies when I ping to it.
Client is running windows 10 x64.
my openvpn server.conf is as follows:
port 1194
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
topology subnet
ifconfig-pool-persist ipp.txt
server-bridge 192.168.0.13 255.255.255.0 192.168.0.20 192.168.0.30
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option WINS 192.168.0.10"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4
my bridge configuration works, as I can see with 'ip addr' that the bridge br0 and the tap tap0 are created.
bridge config:
#!/bin/bash
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eno2"
eth_ip="192.168.0.13"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"
eth_gateway="192.168.0.1"
eth_mac="MY:MA:CA:DD:RE:SS"
# define bridge interface
br="br0"
# define list of TAP interfaces to be bridged together
tap="tap0"
bridge start:
#!/bin/bash
. ./bridge-conf
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
iptables -A INPUT -i $t -j ACCEPT
done
iptables -A INPUT -i $br -j ACCEPT
iptables -A FORWARD -i $br -j ACCEPT
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
#ip link set $br address $eth_mac
#route add default gw $eth_gateway $br
exit 0
my firewall on my server allows 1194/ udp, 22, OpenSSH
rules in /etc/ufw/before.rules:
# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eno1
-A POSTROUTING -s 192.168.0.0/24 -o eno2 -j MASQUERADE
COMMIT
# END OPENVPN RULES
sysctl.conf:
#
# Configuration file for setting network variables. Please note these settings
# override /etc/sysctl.conf and /etc/sysctl.d. If you prefer to use
# /etc/sysctl.conf, please adjust IPT_SYSCTL in /etc/default/ufw. See
# Documentation/networking/ip-sysctl.txt in the kernel source code for more
# information.
#
# Uncomment this to allow this host to route packets between interfaces
net/ipv4/ip_forward=1
net/ipv6/conf/default/forwarding=1
net/ipv6/conf/all/forwarding=1
# Disable ICMP redirects. ICMP redirects are rarely used but can be used in
# MITM (man-in-the-middle) attacks. Disabling ICMP may disrupt legitimate
# traffic to those sites.
net/ipv4/conf/all/accept_redirects=0
net/ipv4/conf/default/accept_redirects=0
net/ipv6/conf/all/accept_redirects=0
net/ipv6/conf/default/accept_redirects=0
# Ignore bogus ICMP errors
net/ipv4/icmp_echo_ignore_broadcasts=1
net/ipv4/icmp_ignore_bogus_error_responses=1
net/ipv4/icmp_echo_ignore_all=0
# Don't log Martian Packets (impossible addresses)
# packets
net/ipv4/conf/all/log_martians=0
net/ipv4/conf/default/log_martians=0
#net/ipv4/tcp_fin_timeout=30
#net/ipv4/tcp_keepalive_intvl=1800
# Uncomment this to turn off ipv6 autoconfiguration
#net/ipv6/conf/default/autoconf=1
#net/ipv6/conf/all/autoconf=1
# Uncomment this to enable ipv6 privacy addressing
#net/ipv6/conf/default/use_tempaddr=2
#net/ipv6/conf/all/use_tempaddr=2
and finally my client's log:
Thu Feb 01 19:43:20 2018 NOTE: --user option is not implemented on Windows
Thu Feb 01 19:43:20 2018 NOTE: --group option is not implemented on Windows
Thu Feb 01 19:43:20 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Thu Feb 01 19:43:20 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Feb 01 19:43:20 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Thu Feb 01 19:43:20 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Feb 01 19:43:20 2018 Need hold release from management interface, waiting...
Thu Feb 01 19:43:20 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Feb 01 19:43:20 2018 MANAGEMENT: CMD 'state on'
Thu Feb 01 19:43:20 2018 MANAGEMENT: CMD 'log all on'
Thu Feb 01 19:43:20 2018 MANAGEMENT: CMD 'echo all on'
Thu Feb 01 19:43:20 2018 MANAGEMENT: CMD 'hold off'
Thu Feb 01 19:43:20 2018 MANAGEMENT: CMD 'hold release'
Thu Feb 01 19:43:20 2018 MANAGEMENT: CMD 'password [...]'
Thu Feb 01 19:43:20 2018 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Feb 01 19:43:20 2018 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Feb 01 19:43:20 2018 MANAGEMENT: >STATE:1517510600,RESOLVE,,,,,,
Thu Feb 01 19:43:21 2018 TCP/UDP: Preserving recently used remote address: [AF_INET][censored ip]:1194
Thu Feb 01 19:43:21 2018 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Feb 01 19:43:21 2018 UDP link local: (not bound)
Thu Feb 01 19:43:21 2018 UDP link remote: [AF_INET][censored ip]:1194
Thu Feb 01 19:43:21 2018 MANAGEMENT: >STATE:1517510601,WAIT,,,,,,
Thu Feb 01 19:43:21 2018 MANAGEMENT: >STATE:1517510601,AUTH,,,,,,
Thu Feb 01 19:43:21 2018 TLS: Initial packet from [AF_INET][censored ip]:1194, sid=fa88ba65 e12b27e0
Thu Feb 01 19:43:21 2018 VERIFY OK: [censored]
Thu Feb 01 19:43:21 2018 VERIFY KU OK
Thu Feb 01 19:43:21 2018 Validating certificate extended key usage
Thu Feb 01 19:43:21 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 01 19:43:21 2018 VERIFY EKU OK
Thu Feb 01 19:43:21 2018 VERIFY OK: [censored]
Thu Feb 01 19:43:21 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 01 19:43:21 2018 [server] Peer Connection Initiated with [AF_INET][censored ip]:1194
Thu Feb 01 19:43:22 2018 MANAGEMENT: >STATE:1517510602,GET_CONFIG,,,,,,
Thu Feb 01 19:43:22 2018 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 01 19:43:22 2018 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,dhcp-option WINS 192.168.0.10,route-gateway 192.168.0.13,ping 10,ping-restart 120,ifconfig 192.168.0.20 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: route options modified
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: route-related options modified
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: peer-id set
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: adjusting link_mtu to 1656
Thu Feb 01 19:43:22 2018 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 01 19:43:22 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 01 19:43:22 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 01 19:43:22 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 01 19:43:22 2018 interactive service msg_channel=968
Thu Feb 01 19:43:22 2018 ROUTE_GATEWAY 192.168.43.1/255.255.255.0 I=5 HWADDR=[censored]
Thu Feb 01 19:43:22 2018 open_tun
Thu Feb 01 19:43:22 2018 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{[censored]}.tap
Thu Feb 01 19:43:22 2018 TAP-Windows Driver Version 9.21
Thu Feb 01 19:43:22 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.0.20/255.255.255.0 on interface {[censored]} [DHCP-serv: 192.168.0.0, lease-time: 31536000]
Thu Feb 01 19:43:22 2018 Successful ARP Flush on interface [2] {[censored]}
Thu Feb 01 19:43:22 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Feb 01 19:43:22 2018 MANAGEMENT: >STATE:1517510602,ASSIGN_IP,,192.168.0.20,,,,
Thu Feb 01 19:43:22 2018 write UDP: Unknown error (code=10065)
Thu Feb 01 19:43:22 2018 write UDP: Unknown error (code=10065)
Thu Feb 01 19:43:27 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:27 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:32 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:32 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:33 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:33 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:34 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:34 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:35 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:35 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:36 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:36 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:37 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:37 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:38 2018 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Thu Feb 01 19:43:38 2018 Route: Waiting for TUN/TAP interface to come up...
Thu Feb 01 19:43:39 2018 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Thu Feb 01 19:43:39 2018 C:\WINDOWS\system32\route.exe ADD [censored ip] MASK 255.255.255.255 192.168.43.1
Thu Feb 01 19:43:39 2018 Route addition via service succeeded
Thu Feb 01 19:43:39 2018 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.0.13
Thu Feb 01 19:43:39 2018 Route addition via service succeeded
Thu Feb 01 19:43:39 2018 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.0.13
Thu Feb 01 19:43:39 2018 Route addition via service succeeded
Thu Feb 01 19:43:39 2018 MANAGEMENT: >STATE:1517510619,ADD_ROUTES,,,,,,
Thu Feb 01 19:43:39 2018 C:\WINDOWS\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 192.168.0.13
Thu Feb 01 19:43:39 2018 Route addition via service succeeded
Thu Feb 01 19:43:39 2018 Initialization Sequence Completed
Thu Feb 01 19:43:39 2018 MANAGEMENT: >STATE:1517510619,CONNECTED,SUCCESS,192.168.0.20,[censored ip],1194,,
I am looking to solve this problem for more then 5 nights in a row now, any suggestions are very welcome!
