Ok. I've done this multiple times and had no issues, but now im lost.
So i have typcal home LAN 192.168.1.0/24, router with internet at 192.168.1.1 and win 10 host as vpn server at 192.168.1.2
Bridged my tap and eth, set manualy ip,gw,mask and dns, here openvpn server cfg, port is forwarded on router
port 443
proto tcp
dev tap
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\srv.crt"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh2048.pem"
topology subnet
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.2 255.255.255.0 192.168.1.50 192.168.1.60
keepalive 10 120
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
verb 3
On the client side i have restricted internet with access throght proxy only, client config
client
dev tap
proto tcp
remote ip 443
resolv-retry infinite
nobind
persist-key
persist-tun
http-proxy [proxy_addr] [3128] auth.txt
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client-wrk.crt"
key "C:\\Program Files\\OpenVPN\\config\\client-wrk.key"
cipher AES-256-CBC
verb 3
Client connects without problems
Tue Nov 06 15:01:10 2018 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Tue Nov 06 15:01:10 2018 Windows version 6.1 (Windows 7) 64bit
Tue Nov 06 15:01:10 2018 library versions: OpenSSL 1.1.0h 27 Mar 2018, LZO 2.10
Tue Nov 06 15:01:10 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Nov 06 15:01:10 2018 Need hold release from management interface, waiting...
Tue Nov 06 15:01:11 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Nov 06 15:01:11 2018 MANAGEMENT: CMD 'state on'
Tue Nov 06 15:01:11 2018 MANAGEMENT: CMD 'log all on'
Tue Nov 06 15:01:11 2018 MANAGEMENT: CMD 'echo all on'
Tue Nov 06 15:01:11 2018 MANAGEMENT: CMD 'bytecount 5'
Tue Nov 06 15:01:11 2018 MANAGEMENT: CMD 'hold off'
Tue Nov 06 15:01:11 2018 MANAGEMENT: CMD 'hold release'
Tue Nov 06 15:01:11 2018 MANAGEMENT: CMD 'proxy HTTP proxy_addr 3128'
Tue Nov 06 15:01:12 2018 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Nov 06 15:01:12 2018 MANAGEMENT: >STATE:1541505672,RESOLVE,,,,,,
Tue Nov 06 15:01:12 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]proxy_addr:3128
Tue Nov 06 15:01:12 2018 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Nov 06 15:01:12 2018 Attempting to establish TCP connection with [AF_INET]proxy_addr:3128 [nonblock]
Tue Nov 06 15:01:12 2018 MANAGEMENT: >STATE:1541505672,TCP_CONNECT,,,,,,
Tue Nov 06 15:01:13 2018 TCP connection established with [AF_INET]proxy_addr:3128
Tue Nov 06 15:01:13 2018 Send to HTTP proxy: 'CONNECT remote_addr:443 HTTP/1.0'
Tue Nov 06 15:01:13 2018 Send to HTTP proxy: 'Host: remote_addr'
Tue Nov 06 15:01:13 2018 Attempting Basic Proxy-Authorization
Tue Nov 06 15:01:13 2018 HTTP proxy returned: 'HTTP/1.0 200 Connection established'
Tue Nov 06 15:01:15 2018 TCP_CLIENT link local: (not bound)
Tue Nov 06 15:01:15 2018 TCP_CLIENT link remote: [AF_INET]proxy_addr:3128
Tue Nov 06 15:01:15 2018 MANAGEMENT: >STATE:1541505675,WAIT,,,,,,
Tue Nov 06 15:01:15 2018 MANAGEMENT: >STATE:1541505675,AUTH,,,,,,
Tue Nov 06 15:01:15 2018 TLS: Initial packet from [AF_INET]proxy_addr:3128, sid=ba33c958 6fe046cc
Tue Nov 06 15:01:15 2018 VERIFY OK: depth=1
Tue Nov 06 15:01:15 2018 VERIFY OK: depth=0
Tue Nov 06 15:01:15 2018 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Tue Nov 06 15:01:15 2018 [srv] Peer Connection Initiated with [AF_INET]proxy_addr:3128
Tue Nov 06 15:01:17 2018 MANAGEMENT: >STATE:1541505677,GET_CONFIG,,,,,,
Tue Nov 06 15:01:17 2018 SENT CONTROL [srv]: 'PUSH_REQUEST' (status=1)
Tue Nov 06 15:01:17 2018 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.1.2,ping 10,ping-restart 120,ifconfig 192.168.1.50 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Tue Nov 06 15:01:17 2018 OPTIONS IMPORT: timers and/or timeouts modified
Tue Nov 06 15:01:17 2018 OPTIONS IMPORT: --ifconfig/up options modified
Tue Nov 06 15:01:17 2018 OPTIONS IMPORT: route-related options modified
Tue Nov 06 15:01:17 2018 OPTIONS IMPORT: peer-id set
Tue Nov 06 15:01:17 2018 OPTIONS IMPORT: adjusting link_mtu to 1658
Tue Nov 06 15:01:17 2018 OPTIONS IMPORT: data channel crypto options modified
Tue Nov 06 15:01:17 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Nov 06 15:01:17 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Nov 06 15:01:17 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Nov 06 15:01:17 2018 interactive service msg_channel=0
Tue Nov 06 15:01:17 2018 open_tun
Tue Nov 06 15:01:17 2018 TAP-WIN32 device [Подключение по локальной сети 3] opened: \\.\Global\{EEFE1821-21D1-4F7F-B005-89190937AA96}.tap
Tue Nov 06 15:01:17 2018 TAP-Windows Driver Version 9.21
Tue Nov 06 15:01:17 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.1.50/255.255.255.0 on interface {EEFE1821-21D1-4F7F-B005-89190937AA96} [DHCP-serv: 192.168.1.0, lease-time: 31536000]
Tue Nov 06 15:01:17 2018 Successful ARP Flush on interface [15] {EEFE1821-21D1-4F7F-B005-89190937AA96}
Tue Nov 06 15:01:17 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Nov 06 15:01:17 2018 MANAGEMENT: >STATE:1541505677,ASSIGN_IP,,192.168.1.50,,,,
Tue Nov 06 15:01:22 2018 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Tue Nov 06 15:01:22 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Nov 06 15:01:22 2018 Initialization Sequence Completed
Tue Nov 06 15:01:22 2018 MANAGEMENT: >STATE:1541505682,CONNECTED,SUCCESS,192.168.1.50,proxy_addr,3128,local_client_ip,50219
I had this working no problems, but after i recreated bridge interface on my vpn server cant ping anything.
Here is routing table on client
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.50 21
10.0.0.0 255.0.0.0 10.2.12.254 10.2.12.90 120
10.2.12.0 255.255.255.0 On-link 10.2.12.90 276
10.2.12.90 255.255.255.255 On-link 10.2.12.90 276
10.2.12.255 255.255.255.255 On-link 10.2.12.90 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.50 276
192.168.1.50 255.255.255.255 On-link 192.168.1.50 276
192.168.1.255 255.255.255.255 On-link 192.168.1.50 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.50 276
224.0.0.0 240.0.0.0 On-link 10.2.12.90 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.50 276
255.255.255.255 255.255.255.255 On-link 10.2.12.90 276
===========================================================================
Постоянные маршруты:
Сетевой адрес Маска Адрес шлюза Метрика
10.0.0.0 255.0.0.0 10.2.12.254 100
On my tap interface i have 0 sent packets. So i think something wrong with bridge interface?
Looked through wireshark and it seems no arp broadcast response for 192.168.1.1
