Can't ping other server hosts within "server-bridge" network

xtracoder

I'm trying to setup simple thing - private network of 2 VPS hosts accessible to external client.
So far I have setup where ping works from client to VPN'en IP of server host where OpenVpn is hosted. But other host in server network is not ping'able from client - can someone help me to fix this?

Now i have ...

1. Ethernet bridge on OpenVpn server (v2.4.7 + Ubuntu 18.04) configured as outlined at "community-resources/ethernet-bridging"
Ping from 'OpenVpn server' to 'another host' work OK.

# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.b602c32d4aec       no              eth1
                                                        tap0

2. OpenVpn server configuration (TCP/443 is used because UDP/443 is cut-off on one of client networks, anyway - switching to UDP does not change anything)

port 443
proto tcp

server-bridge ...
dev tap0
push "route ..."
...

3. Client configuration

client
dev tap0
proto tcp
...

Unfortunatelly presence of any IP address in text triggers "antispam filter" saying "Forbidden. Contains contacts.". Therefore I'm not able to post more useful details.

xtracoder

Ok ... after digging into tcpdump i've found that something is do actually blocking traffic.

In my particular case I'm trying to setup server-bridge network in "Digital Ocean" and it appears that connection between servers in "DO private network" works only for "IP addresses provided by DigitalOcean infrastructure". OpenVPN introduces additional IPs for VPN clients and these ones seem to be blocked by DO infrastucture.

So ... this seems to be a "firewall issue", but not under my control. Will check with DO if problem can be resolved somehow.

If there is someone here who succeeded with "server-bridge network in Digital Ocean" - please let me know the path to success.

TinCanTech

Do you need a bridge ?
https://openvpn.net/community-resources/determining-whether-to-use-a-routed-or-bridged-vpn/

There is plenty of information around ..

xtracoder

After your hint - I guess i do not really need bridge, but routing did not work - therefore I tried bridging.

Now I known how to diagnose the problem (via tcpdump) - and as I see it, root cause in both cases is the same - 'something' outside of my control is blocking trafic (from OpenVPN server to another host in server network) having "unknown source IP".

xtracoder

Got reply from Digital Ocean

Some current limitations of private networking that you might be bumping up against:

- Traffic is restricted to the private network. Incoming packets from any source other than the private network are silently discarded at the network level.

- Currently, traffic on the private network applies MAC address origin checks. This prevents the use of Droplets as gateways between the private and public networks.
https://www.digitalocean.com/docs/networking/private-networking/overview/

... so neither routing nor bridging will work in Digital Ocean private network. But ... connecting other hosts from that private network as VPN clients gives same result with "client-to-client" enabled, however this requires explicit configuration for each 'server host'. Not a big deal in my case of 3 servers.

TinCanTech

Not so much of an Ocean any longer then ...

TinCanTech

I know DO have a tutorial about setting up openvpn on a droplet .. look for that.