Thanks for the confirmation - I have been through the howto as that's how I got the bridge interface up and running, so anyhoo, some files:
server.conf
port 51194
proto udp
dev tun0
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/hollyhop.crt
key /etc/openvpn/certs/hollyhop.key # This file should be kept secret
dh /etc/openvpn/certs/dh2048.pem
server 10.131.134.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.131.132.0 255.255.254.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 212.23.3.100"
push "dhcp-option DNS 212.23.6.100"
keepalive 10 120
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
max-clients 15
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
mute 20
explicit-exit-notify 1
server2.conf
port 52194
proto udp
dev tap0
ca /etc/openvpn/certs2/ca.crt
cert /etc/openvpn/certs2/hollyhop.crt
key /etc/openvpn/certs2/hollyhop.key # This file should be kept secret
dh /etc/openvpn/certs2/dh2048.pem
#tls-auth /etc/openvpn/certs2/ta.key 0
server-bridge 10.131.132.8 255.255.254.0 10.131.132.101 10.131.132.105
ifconfig-pool-persist ipp2.txt
keepalive 10 120
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
max-clients 5
persist-key
persist-tun
status /var/log/openvpn2-status.log
log-append /var/log/openvpn2.log
verb 3
mute 20
explicit-exit-notify 1
Output of ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.131.132.7 netmask 255.255.254.0 broadcast 10.131.133.255
ether b8:27:eb:f2:86:16 txqueuelen 1000 (Ethernet)
RX packets 405595 bytes 131052047 (124.9 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 284536 bytes 132596748 (126.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth1: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
ether 00:e0:4c:53:44:58 txqueuelen 1000 (Ethernet)
RX packets 722940 bytes 188980175 (180.2 MiB)
RX errors 11699 dropped 11327 overruns 11092 frame 22786
TX packets 202 bytes 13660 (13.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1000 (Local Loopback)
RX packets 9 bytes 720 (720.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 9 bytes 720 (720.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether ba:67:4f:69:89:9e txqueuelen 100 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.131.134.1 netmask 255.255.255.255 destination 10.131.134.2
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 1877 bytes 269139 (262.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1814 bytes 986159 (963.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
/code]
Iptables rules
[code]# Generated by iptables-save v1.4.21 on Wed Apr 4 16:00:35 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 50722 -j ACCEPT
-A INPUT -i br0 -p tcp -m state --state NEW -m tcp --dport 50722 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 51194 -j ACCEPT
-A INPUT -i br0 -p udp -m state --state NEW -m udp --dport 52194 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -i tap0 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -i tap0 -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-A OUTPUT -o br0 -j ACCEPT
COMMIT
# Completed on Wed Apr 4 16:00:35 2018
# Generated by iptables-save v1.4.21 on Wed Apr 4 16:00:35 2018
*nat
:PREROUTING ACCEPT [10670:1087065]
:INPUT ACCEPT [26:1100]
:OUTPUT ACCEPT [46:3834]
:POSTROUTING ACCEPT [46:3834]
-A POSTROUTING -s 10.131.134.0/24 -j SNAT --to-source 10.131.132.7
COMMIT
# Completed on Wed Apr 4 16:00:35 2018
So basically the tun instance works fine, but the tap one never connects the server logs seem to indicate no connection attempt is seen and the client (Tunnelblick on MacBook) times out.
