Can't ping devices on TAP/Br0 network

tomh

Hi,

I configured my openvpn setup in bridge (tap) mode and got it working with the following setup:

Server.conf:

port 500
proto tcp
dev tap0

ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem

ifconfig-pool-persist ipp.txt
server-bridge 192.168.0.3 255.255.255.0 192.168.0.5 192.168.0.170
server-bridge

push "route 192.168.0.4 255.255.255.0"
push "route 192.168.0.3 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.0.1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 8.8.8.8"

client-to-client
keepalive 60 1000
tls-auth ta.key 0 # This file is secret
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo

user nobody
group nogroup
persist-key
persist-tun

mode server
tls-server

status openvpn-status.log
verb 4

#start/stop bridge for bridging custom
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
script-security 3

Client.ovpn

route-method exe

client

dev tap

proto tcp

{ip} 500

resolv-retry infinite

nobind

remote-cert-tls server
key-direction 1

persist-key
persist-tun

cipher AES-128-CBC
auth SHA256

auth-nocache

comp-lzo
verb 3

I got it working, I can connect both ways to the servers and clients can ping each other. I only can't ping devices already on the network.

ifconfig br0 is bridged with eth2:

br0     Link encap:Ethernet  HWaddr 02:0a:df:54:8c:9d
          inet addr:192.168.0.3  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::a:dfff:fe54:8c9d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:19223 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1657 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2855875 (2.8 MB)  TX bytes:77045 (77.0 KB)
          
eth0   Link encap:Ethernet  HWaddr HIDDEN
          inet addr: HIDDEN
          inet6 addr: HIDDEN
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:843310 errors:0 dropped:78 overruns:0 frame:0
          TX packets:45075 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:81040174 (81.0 MB)  TX bytes:5723496 (5.7 MB)

eth2   Link encap:Ethernet  HWaddr 02:0a:df:54:8c:9d
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1347 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12085 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:69307 (69.3 KB)  TX bytes:2517686 (2.5 MB)

lo       Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0    Link encap:Ethernet  HWaddr d6:70:1b:17:cb:e3
          inet6 addr: * Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:6221 errors:0 dropped:16 overruns:0 frame:0
          TX packets:198 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:822076 (822.0 KB)  TX bytes:12278 (12.2 KB)

UFW is also configured fine on both sides.

IPTables;

****
-A INPUT -i tun0 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A INPUT -i eth2 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -i eth2 -j ACCEPT
****

I looked on this forum but couldn't find the same situation, most where tun and not tap.

What is my next step? Any tips/tricks?

Thanks!! 🙂