Hello I want to thank you for your help first of all. I will start with an explanation of how I want the finished product to work. Datacenter -> Server A(openvpn server/router configured as a bridge) -> Client A (OFFSITE, openvpn client, enp1s0 goes to WAN connecting to the OVPN Server, enp2s0 goes to LAN) -> All LAN computers get assigned public IPS from Client A. Here is what I have so far: Server A: /etc/network/interfaces: [code] auto br0 iface br0 inet static address 67.215.1.2 netmask 255.255.255.0 gateway 67.215.1.1 pre-up openvpn --mktun --dev tap0 bridge_ports ens3 tap0 bridge_fd 3 [/code] OpenVPN command: /usr/sbin/openvpn --dev tap0 --config /etc/openvpn/server.conf --port 1194 [oconf=Server config] tls-server ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh2048.pem [/oconf] ip route show: [code] root@vpn3:~# ip route show default via 67.215.1.1 dev br0 onlink 67.215.1.0/24 dev br0 proto kernel scope link src 67.215.233.2 root@vpn3:~# [/code] Client A (acting as offsite tunnel/router): OpenVPN command: /usr/sbin/openvpn --remote 67.215.1.2 --dev tap0 --route-gateway 67.215.1.1 --redirect-gateway def1 --ifconfig 67.215.1.3 255.255.255.0 --config /etc/openvpn/180.server.conf --port 1194 [oconf=Client config] client ca /etc/openvpn/ca.crt cert /etc/openvpn/vpn-test2.crt key /etc/openvpn/vpn-test2.key ns-cert-type server cipher AES-256-CBC [/oconf] Now the tunnel IS working and Client A is being assigned a Public IPv4 address from the block at the data center, Client A can browse the internet as 67.215.1.3 (client a) and the public can connect to and access all services on 67.215.1.3 (client a). Client A can ping Server A 67.215.1.2 however the server CAN NOT ping or access Client A (67.215.1.3). I assume I am missing some sort of ip routing rule, but otherwise the tunnel is working fine. Second question I have is how can I now make Client A act as again its own bridge through the OpenVPN so that I can now use Client A as a router to route other clients on the same switch public ips 67.215.1.4 to 67.215.1.254 so they don't have to each have their own tunnel can I simply create a new bridge to enp2s0 or does the openvpn client need additional configuration? I have been experimenting each way for a few days and have not been able to get it working. [img]https://i.imgur.com/CFAZudy.png[/img] https://i.imgur.com/CFAZudy.png Willing to give a $50.00 reward via PayPal to whomever can help me get this fully working. Thank you very much.

OpenVPN as bridge (tap) to router. Half working. Please Help

mvipe01

Hello I want to thank you for your help first of all.

I will start with an explanation of how I want the finished product to work.

Datacenter -> Server A(openvpn server/router configured as a bridge) -> Client A (OFFSITE, openvpn client, enp1s0 goes to WAN connecting to the OVPN Server, enp2s0 goes to LAN) -> All LAN computers get assigned public IPS from Client A.

Here is what I have so far:
Server A:
/etc/network/interfaces:

          auto br0
          iface br0 inet static
              address 67.215.1.2
              netmask 255.255.255.0
              gateway 67.215.1.1
              pre-up openvpn --mktun --dev tap0
              bridge_ports ens3 tap0
              bridge_fd 3

OpenVPN command: /usr/sbin/openvpn --dev tap0 --config /etc/openvpn/server.conf --port 1194

tls-server
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem

ip route show:

          root@vpn3:~# ip route show
          default via 67.215.1.1 dev br0 onlink
          67.215.1.0/24 dev br0 proto kernel scope link src 67.215.233.2
          root@vpn3:~#

Client A (acting as offsite tunnel/router):
OpenVPN command: /usr/sbin/openvpn --remote 67.215.1.2 --dev tap0 --route-gateway 67.215.1.1 --redirect-gateway def1 --ifconfig 67.215.1.3 255.255.255.0 --config /etc/openvpn/180.server.conf --port 1194

client
ca /etc/openvpn/ca.crt
cert /etc/openvpn/vpn-test2.crt
key /etc/openvpn/vpn-test2.key
ns-cert-type server
cipher AES-256-CBC

Now the tunnel IS working and Client A is being assigned a Public IPv4 address from the block at the data center, Client A can browse the internet as 67.215.1.3 (client a) and the public can connect to and access all services on 67.215.1.3 (client a). Client A can ping Server A 67.215.1.2 however the server CAN NOT ping or access Client A (67.215.1.3). I assume I am missing some sort of ip routing rule, but otherwise the tunnel is working fine.

Second question I have is how can I now make Client A act as again its own bridge through the OpenVPN so that I can now use Client A as a router to route other clients on the same switch public ips 67.215.1.4 to 67.215.1.254 so they don't have to each have their own tunnel can I simply create a new bridge to enp2s0 or does the openvpn client need additional configuration? I have been experimenting each way for a few days and have not been able to get it working.

https://i.imgur.com/CFAZudy.png

Willing to give a $50.00 reward via PayPal to whomever can help me get this fully working.

Thank you very much.