Bridging on Proxmox Host - after connect not OpenVPN server not reachable

Slarti

Hi folks,

I have a proxmox host, who runs the ovpn server on bridge mode. The client connects to the openvpn server and gets the IP address from the pool correctly (10.42.41.41), but when I want to ping the server 10.42.42.1 it is not reachable.

My server.conf file:

port 443
proto udp
dev tap
ca /etc/openvpn/my_ca/keys/ca.crt
cert /etc/openvpn/my_ca/keys/server.crt
key /etc/openvpn/my_ca/keys/server.key
dh /etc/openvpn/my_ca/keys/dh4096.pem
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
;server 10.42.41.0 255.255.255.0
ifconfig-pool-persist ipp.txt
server-bridge 10.42.41.1 255.255.255.0 10.42.41.41 10.42.41.49
# Configure server mode for ethernet bridging
# using a DHCP-proxy, where clients talk
# to the OpenVPN server-side DHCP server
# to receive their IP address allocation
# and DNS server addresses. You must first use
# your OS's bridging capability to bridge the TAP
# interface with the ethernet NIC interface.
# Note: this mode only works on clients (such as
# Windows), where the client-side TAP adapter is
# bound to a DHCP client.
server-bridge
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 3

My /etc/network/interfaces is this:

### Hetzner Online GmbH - installimage
# Loopback device:
auto lo
iface lo inet loopback
iface lo inet6 loopback


#Please ignore vmbr0 as it is working - local host
auto vmbr0
iface vmbr0 inet static
        address 1.2.3.4
        netmask 255.255.255.224
        pointtopoint 1.2.3.254
        gateway 1.2.3.254
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0
        bridge_hello 2
        bridge_maxage 12

#VM Containers
        up route add -host 5.6.7.8 dev vmbr0
                iptables -t nat -A POSTROUTING -s 5.6.7.8/24 -o vmbr0 -j MASQUERADE

#openVPN
        up route add -net 10.42.41.0 netmask 255.255.255.0 gw 10.42.41.1 vmbr0
                iptables -t nat -A POSTROUTING -s 10.42.41.0/24 -o vmbr0 -j MASQUERADE

# VMs
auto vmbr10
iface vmbr10 inet static
        address 192.168.0.1
        netmask 255.255.255.0
        bridge_ports none
        bridge_stp off
        bridge_fd 0

        post-up echo 1> /proc/sys/net/ipv4/ip_forward
        up route add -net 192.168.0.0 netmask 255.255.255.0 gw 192.168.0.1 vmbr10
        post-up iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o vmbr0 -j MASQUERADE

Does anyone has an idea, please?
Thanks.

kcastner

Hi Slarti,

you said following:

Slarti wrote I want to ping the server 10.42.42.1 it is not reachable.

have you already tried to reach the client from the server?
like sending a ping to client?

please check it out.
if that works, client may just miss routing rules.

what about your client config? can you post it, please?

best regards
kcastner

Slarti

Hi Kcastner,

Thanks for coming back to me. Sorry for the delay, as I was away.

Yes I have tried to ping the client:

# ping 10.42.41.41
PING 10.42.41.41 (10.42.41.41) 56(84) bytes of data.
From 10.42.41.1 icmp_seq=1 Destination Host Unreachable
From 10.42.41.1 icmp_seq=2 Destination Host Unreachable
From 10.42.41.1 icmp_seq=3 Destination Host Unreachable
^C
--- 10.42.41.41 ping statistics ---
6 packets transmitted, 0 received, +3 errors, 100% packet loss, time 5000ms
pipe 3

The host ip config:

tap0      Link encap:Ethernet  HWaddr 4e:00:08:9a:f7:71  
          inet addr:10.42.41.1  Bcast:10.42.41.255  Mask:255.255.255.0
          inet6 addr: fe80::4c00:8ff:fe9a:f771/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:742 (742.0 B)

The host routes:

# ip route
default via *Public Network of the VPN Host* dev vmbr0 
*Public Network of the VPN Host*/27 dev vmbr0  proto kernel  scope link  src *Public IP of the VPN Host* 
*Public IP of the VPN Host* dev vmbr0  scope link 
10.42.41.0/24 dev tap0  proto kernel  scope link  src 10.42.41.1

and here is the client route:

Destination        Gateway            Flags        Refs      Use   Netif Expire
0/1                10.42.41.1         UGSc           65        0    tap0       
default            10.42.42.254       UGSc            4     1711     en0       
*public vpn host IP*/32       10.42.42.254       UGSc            1        0     en0       
10.42.41/24        link#10            UC              3        0    tap0      !
10.42.41.1         link#10            UHLWIir        18        0    tap0      !
10.42.41.41        aa:45:73:b3:d0:1b  UHLWIi          1        1     lo0       
10.42.41.255       ff:ff:ff:ff:ff:ff  UHLWbI          0       55    tap0      !

client iface:

tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	ether aa:45:73:b3:d0:1b 
	inet 10.42.41.41 netmask 0xffffff00 broadcast 10.42.41.255
	media: autoselect
	status: active
	open (pid 67675)

client ovpn conf
[oconf]

client
dev tap
proto udp
remote *public host IP and port*
resolv-retry infinite
nobind
persist-key
persist-tun
<ca>
 [Security-related line(s) omitted]
</ca>
<cert>
 [Security-related line(s) omitted]
</cert>
<key>
 [Security-related line(s) omitted]
</key>
verb 3

[/oconf]

Thank you
Slarti

Slarti

Anyone, please?

TinCanTech

You are using Proxmox, probably in a data centre and this is probably your real job.

I can help but I must charge you a fee.

You can contact me privately: tincanteksup <at> gmail <dot> com if you so chose ..