I am following the instructions on creating a bridge available at
https://openvpn.net/community-resources/ethernet-bridging/ on a Raspberry Pi 3 running debian stretch. However, it's not working the way I expect. My goal is to have OpenVPN clients be assigned IP addresses within my LAN's subnet (192.168.1.x in my case).
bridge-start sets up the bridge without any problems (I haven't tested it from any OpenVPN client yet because of the problem I ran into).
However, bridge-stop, while it eliminates the bridge, does not return my system to its initial state. Initially that involved the eth0 interface not being re-assigned its original IP address (192.168.1.5 in my case). Instead, it was left in an unassigned state, which removed the Pi from my LAN (eth0 is its only interface to the LAN). Since the Pi runs dnsmasq for my LAN that caused network-wide problems. I was able to recover from that by simply rebooting the Pi.
I tried adding the following line:
ifconfig eth0 up 192.168.1.5
immediately after the bridge-stop script tore down the bridge, but, while that re-assigns the correct IP address to eth0, and allows the Pi to interact with the LAN, the services (e.g., DNS resolution via dnsmasq) are no longer available from computers on my LAN (a Windows 10 desktop in this particular case).
Renewing the Windows machine's DHCP release (DHCP services are also provided by the Pi, via dnsmasq) allowed local DNS resolution, but resolving external sites (i.e., dnsmasq interacting with the public Google DNS servers) did not work. Again, rebooting the Pi restored everything. But that's not a workable solution.
I suspect my situation is complicated by how I am using dnsmasq, /etc/hosts and /etc/ethers to assign "static" IP addresses (i.e., the IP addresses are fixed, tied to particular MAC addresses, but not static in that they are assigned by dnsmasq), but I'm not sure.
Here are the relevant files:
bridge-stop:
#!/bin/bash
####################################
# Tear Down Ethernet bridge on Linux
####################################
# define bridge interface
br="br0"
# define list of TAP interfaces to be bridged together
tap="tap0"
# added restore IP address
eth="eth0"
eth_ip="192.168.1.5"
ifconfig $br down
brctl delbr $br
# added to restore IP address
ifconfig $eth up $eth_ip
for t in $tap; do
openvpn --rmtun --dev $t
done
/etc/ethers:
# mapping of MAC addresses to fixed/static IP addresses
bc:67:1c:f7:9e:6c portal.localnet
F8:F5:32:F6:BC:F1 arris.localnet
44:94:FC:5D:56:2C wireheadkitchen.localnet
40:16:7e:f4:04:38 wireheadupstairs.localnet
1C:6F:65:39:09:8D colossus.localnet
00:40:ad:96:96:6d sungod.localnet
b8:27:eb:44:ea:65 raspberrypi.localnet
b8:27:eb:c2:85:7f mycroft.localnet
/etc/hosts:
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
# make sure the following entries are kept synchronized with what's in
# /etc/dnsmasq.d/localnet.conf
192.168.1.1 arris
192.168.1.2 portal
192.168.1.3 wireheadkitchen
192.168.1.4 raspberrypi
192.168.1.5 mycroft
192.168.1.6 wireheadupstairs
192.168.1.8 colossus
192.168.1.10 sungod
/etc/dnsmasq.d/localnet.conf:
# make sure we read /etc/ethers so that fixed IPs get assigned correctly
read-ethers
# don't forward anything other than FQDNs
domain-needed
# don't forward addresses outside the routed address space
bogus-priv
# use the upstream DNS servers in strict order
strict-order
# we are localnet!
local=/localnet/
# only listen on the eth0 interface
interface=eth0
# append domain to simple names read from /etc/hosts
expand-hosts
# append our domain name to simple names
domain=localnet
# tell Windows to release the DHCP lease when it shuts down
dhcp-option=vendor:MSFT,2,1i
# store a boatload of name resolutions to speed up process
cache-size=10000
# set the range of addresses we manage via DHCP
dhcp-range=192.168.1.21,192.168.1.200,12h
# note that the range 192.168.1.230 - 129.168.1.240 is reserved for VPN clients
# and is administered by OpenVPN
# set the parameters we want clients to use to access gateway, etc.
dhcp-option=option:netmask,255.255.255.0
dhcp-option=option:router,192.168.1.254
dhcp-option=option:domain-name,localnet
