Hi,
I have an issue with my openvpn server in tap mode.
When i connect to it, the server reply with a "wrong" arp mac. It sometimes reply with the mac of the real interface instead of the bridge one.
I have to delete my arp cache or set a static arp entry for make it works.
The openvpn service is two pfsense VM on two VMWare server with CARP. Promiscuous mode is enable on vswitch and i try to change Net.ReversePathFwdCheckPromisc to 1 in vsphere.
server.conf
dev ovpns1
verb 3
dev-type tap
dev-node /dev/tap1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp4
cipher AES-128-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
multihome
tls-server
server-bridge x.x.x.x 255.255.255.0 x.x.x.x x.x.x.x
client-config-dir /var/etc/openvpn-csc/server1
plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-script.so /usr/local/sbin/ovpn_auth_verify_async user xxxxxxxxxxxxxxxxxxxx= false server1 1194
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'openvpn.axione.fr' 1"
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route x.x.x.x 255.255.255.0"
push "dhcp-option DNS x.x.x.x"
push "dhcp-option DNS x.x.x.x"
duplicate-cn
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.1024
crl-verify /var/etc/openvpn/server1.crl-verify
tls-auth /var/etc/openvpn/server1.tls-auth 0
ncp-ciphers AES-256-GCM:AES-128-GCM
comp-lzo no
persist-remote-ip
float
push "route x.x.x.x 255.255.252.0"
push "route x.x.x.x 255.255.255.0 vpn_gateway 500"
status /var/log/openvpn-status.log
ifconfig
vmx0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=60009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0c:29:8e:d7:14
hwaddr 00:0c:29:8e:d7:14
inet6 fe80::20c:29ff:fe8e:d714%vmx0 prefixlen 64 scopeid 0x1
inet x.x.x.x netmask 0xfffffff8 broadcast x.x.x.x
inet x.x.x.x netmask 0xfffffff8 broadcast x.x.x.x vhid 2
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
carp: MASTER vhid 2 advbase 1 advskew 0
vmx1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=60009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0c:29:8e:d7:3c
hwaddr 00:0c:29:8e:d7:3c
inet6 fe80::20c:29ff:fe8e:d73c%vmx1 prefixlen 64 scopeid 0x2
inet x.x.x.x netmask 0xffffff00 broadcast x.x.x.x
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
vmx2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=200099<RXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6>
ether 00:0c:29:8e:d7:1e
hwaddr 00:0c:29:8e:d7:1e
inet6 fe80::20c:29ff:fe8e:d71e%vmx2 prefixlen 64 scopeid 0x3
inet 10.1.208.13 netmask 0xffffff00 broadcast 10.1.208.255
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
vmx3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=60009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0c:29:8e:d7:46
hwaddr 00:0c:29:8e:d7:46
inet6 fe80::20c:29ff:fe8e:d746%vmx3 prefixlen 64 scopeid 0x4
inet x.x.x.x netmask 0xffffff00 broadcast x.x.x.x
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
vmx4: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=60009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0c:29:8e:d7:28
hwaddr 00:0c:29:8e:d7:28
inet6 fe80::20c:29ff:fe8e:d728%vmx4 prefixlen 64 scopeid 0x5
inet x.x.x.x netmask 0xffffff80 broadcast x.x.x.x
inet x.x.x.x netmask 0xffffff80 broadcast x.x.x.x vhid 1
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
carp: MASTER vhid 1 advbase 1 advskew 0
vmx5: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=60009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
ether 00:0c:29:8e:d7:32
hwaddr 00:0c:29:8e:d7:32
inet6 fe80::20c:29ff:fe8e:d732%vmx5 prefixlen 64 scopeid 0x6
inet 10.1.254.124 netmask 0xfffffffe broadcast 255.255.255.255
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
enc0: flags=0<> metric 0 mtu 1536
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
groups: enc
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
groups: lo
pflog0: flags=100<PROMISC> metric 0 mtu 33160
groups: pflog
pfsync0: flags=41<UP,RUNNING> metric 0 mtu 1500
groups: pfsync
pfsync: syncdev: vmx5 syncpeer: 10.1.254.125 maxupd: 128 defer: off
syncok: 1
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether 02:8e:3f:b1:51:00
nd6 options=1<PERFORMNUD>
groups: bridge
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: ovpns1 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 12 priority 128 path cost 2000000
member: vmx2 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
ifmaxaddr 0 port 3 priority 128 path cost 2000
ovpns1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=80000<LINKSTATE>
ether 00:bd:76:22:ff:01
hwaddr 00:bd:76:22:ff:01
inet6 fe80::2bd:76ff:fe22:ff01%ovpns1 prefixlen 64 scopeid 0xc
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
groups: tap openvpn
Opened by PID 42100
tcpdump
10:24:20.975265 ARP, Request who-has 10.1.208.13 (00:0c:29:8e:d7:1e) tell 10.1.208.198, length 28
10:24:20.975278 ARP, Reply 10.1.208.13 is-at 00:0c:29:8e:d7:1e, length 28 <=== NOT GOOD
10:29:43.861600 ARP, Request who-has 10.1.208.13 tell 10.1.208.197, length 28
10:29:43.861633 ARP, Reply 10.1.208.13 is-at 00:bd:76:22:ff:01, length 28 <=== GOOD
Do you know why the server do this ?
Regards
