I am trying to setup a bridge connection to a network from outside with TAP, using the network DHCP server and no NAT.
I have began with a VirtualBox setup i Debian 10 to get the scripts and configurations in order.
1. Client1 with OpenVPN client on the 192.168.1.x network, can reach virtualbox1.
2. Virtualbox1 with OpenVPN server, eth0=192.168.1.201, eth1/br0=192.168.2.245
3. Virtualbox2 with DHCP server, eth1=192.168.2.1
The OpenVPN setup itself works, I can establish the connection.
I want to reach virtualbox2 from client1 through the bridge on virtualbox1 and vice versa.
I have achieved that virtualbox2/dnsmasq logs that receives a request for the IP address and that it sends it to client1 when I request it with dhclient tap0 on client1, but the response does not get through. If I manually assign the IP to tap0 on client1 and then ping virtualbox2, then it does not get through. From virtualbox1 I can ping both client1 and virtualbox2.
I started off with
https://openvpn.net/community-resources/ethernet-bridging/ but since I failed to get it to work I started experimenting, sorry for wrong configurations. :oops:
remote 192.168.1.201
port 1194
client
dev tap
proto udp4
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
verb 3
float
remote-cert-tls server
auth-nocache
virtualbox1 /etc/network/interfaces
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.1.201
netmask 255.255.255.0
auto br0
iface br0 inet static
address 192.168.2.245
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
gateway 192.168.2.1
dns-nameservers 192.168.2.1
bridge_ports eth1
bridge_fd 0
bridge_hello 2
bridge_maxage 12
bridge_stp on
bridge_prio 1000
auto eth1
iface eth1 inet manual
up ifconfig $IFACE 0.0.0.0 up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down
port 1194
proto udp4
dev tap0
keepalive 100 1200
persist-key
persist-tun
tls-server
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
script-security 2
remote-cert-tls client
# server-bridge 192.168.2.245 255.255.255.0 192.168.2.2 192.168.2.50
# push "redirect-gateway"
# push "dhcp-option DNS 192.168.2.1"
# push "route 192.168.2.1 255.255.255.0"
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
virtualbox1 /etc/openvpn/up.sh
#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/sbin/brctl addif $BR $DEV
virtualbox1 /etc/openvpn/down.sh
#!/bin/sh
BR=$1
DEV=$2
/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down
virtualbox1 startup script added to /etc/rc.local
#!/bin/sh
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -F
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
iptables -I FORWARD -i tap0 -o br0 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i tap0 -o br0 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i br0 -o tap0 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
virtualbox2 /etc/dnsmasq.d/config.ini
interface=eth1
listen-address=127.0.0.1,192.168.2.1
dhcp-range=eth1,192.168.2.2,192.168.2.254,12h
log-facility=/var/log/dnsmasq
I suspect the problem is in the iptables configuration or related to the routing. Please help, any suggestions or examples are welcome.
EDIT:
Replying to myself here, the cause of the problem seems to be that I had Promiscous mode set to Deny in both virtualboxes under the machine Settings -> Network -> Adapter -> Advanced -> Promiscuous mode -> Deny.
The iptables lines does not seem to be needed.
