Bridge Trouble - Server Unreachable

Redox

Hello everyone,

I'm trying to set up an OpenVPN server in bridge mode on Ubuntu 10.04 Server. I need the bridge because gaming should be possible over the VPN. But you should also be able to connect to the Internet from Windows 7 and Ubuntu clients and things like a Windows 7 homegroup or samba shares should work, too.

I've tried to set everything according to the howto here and the Ubuntu OpenVPN tutorial up and already made some progress. I am able to connect with my Windows 7 test client to the server and they can ping each other but (I guess due to wrong gateway settings) am not able to access the Internet. And whenever I try to set up a proper bridge via /etc/network/interfaces my server is unreachable as soon as I do a networking restart. I can only connect via SSH to the server and it has only one interface (eth0) with it's public Internet IP address configured.

So my question is how do I have to configure the bridge and the OpenVPN server in my case so that Internet connection sharing and all the other things are working properly?

Here's my complete status quo:

My initial /etc/network/interfaces

# Loopback device:
auto lo
iface lo inet loopback

# device: eth0
auto  eth0
iface eth0 inet static
  address   78.46.aaa.aaa
  broadcast 78.46.bbb.bbb
  netmask   255.255.255.224
  gateway   78.46.ccc.ccc

# default route to access subnet
up route add -net 78.46.ddd.ddd netmask 255.255.255.224 gw 78.46.ccc.ccc eth0

The commands I ran to get a simple bridge interface:

brctl addbr br0
ifconfig br0 5.5.5.1 netmask 255.255.255.0 up

My ifconfig after that and after I start the OpenVPN server (in that situation I can connect with my test client but I cannot access the internet):

br0       Link encap:Ethernet  HWaddr -:-:-:-:-:-  
          inet addr:5.5.5.1  Bcast:5.5.5.255  Mask:255.255.255.0
          inet6 addr: -::-:-:-:-/- Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:927 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:235200 (235.2 KB)  TX bytes:1282 (1.2 KB)

eth0      Link encap:Ethernet  HWaddr -:-:-:-:-:-  
          inet addr:78.46.---.---  Bcast:78.46.---.---  Mask:255.255.255.224
          inet6 addr: -::-:-:-:-/- Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:86924 errors:0 dropped:0 overruns:0 frame:0
          TX packets:84026 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:12983805 (12.9 MB)  TX bytes:12118406 (12.1 MB)
          Interrupt:25 Base address:0xa000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2510 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2510 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:377350 (377.3 KB)  TX bytes:377350 (377.3 KB)

tap0      Link encap:Ethernet  HWaddr -:-:-:-:-:-  
          inet6 addr: -::-:-:-:-/- Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:927 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:248178 (248.1 KB)  TX bytes:1282 (1.2 KB)

My server .conf:

port 987
proto udp
ca keys/---/ca.crt
cert keys/---/server.crt
key keys/---/server.key
dh keys/---/dh4096.pem
crl-verify keys/---/crl.pem
cipher AES-256-CBC
status servers/---/logs/openvpn-status.log
log-append servers/---/logs/openvpn.log
verb 2
mute 20
max-clients 100
keepalive 10 120
client-config-dir /etc/openvpn/servers/---/ccd
comp-lzo
persist-key
persist-tun
ccd-exclusive
dev tap0
server-bridge 5.5.5.1 255.255.255.0 5.5.5.10 5.5.5.99
push "route 5.5.5.1 255.255.255.0"
user nobody
group nogroup
;scripts from https://help.ubuntu.com/10.04/serverguide/C/openvpn.html
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"

What's not working is as said Internet connection sharing (the Windows 7 test client says “No Internet access” in the Network and Sharing Center) and any tries of me to set up the bridge interface in my interfaces file. I tried to add things like this:

# bridge: br0
auto br0
iface br0 inet static
        address 5.5.5.1
        network 5.5.5.0
        netmask 255.255.255.0
        broadcast 5.5.5.255
        gateway ???
        bridge_ports eth0
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off

For gateway I tried several things but none worked. The server was always no longer reachable...

I would be very grateful for any help on how I have to set things up for a permanent and proper solution! And sorry for my bad English 🙁

Thanks in advance
Redox

maikcat

hi there,

first , you dont need to create br0 yourself,the up script inside openvpn server conf does that for you.

second, change this line to:

>push "route 5.5.5.1 255.255.255.0"
push "route 5.5.5.0 255.255.255.0"

third, did you enabled ip forwarding?

first check that your bridging setup is working,
can you ping 5.5.5.x ips?

after that you will check if internet access is working..

ps:if you want to redirect everything over the tunnel add push "redirect-gateway def1" tou your server.

Michael

Redox

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

maikcat

hi there,

first

>iptables -A POSTROUTING -t nat -j MASQUERADE

if you want to create bridged vpn setup then the above
is totally meaningless...
perfoming nat by your server only needed in case you use
routing and you want to pass *all* traffic through your vpn
BUT when you want your traffic seems to come from vpn server itself.

to the bridge stuff

if you read the vpn docs reffering to bridging setup you will
notice that it bridges tap with eth interfaces (the scripts that does this
are published into openvpn docs)

the only things that you must consider is that *both* interfaces must
be in promiscuous mode and then bridged together

also inside config you must use dev tap0 statement otherwise wont work (in case you use dev tap)

ip forwarding must be enabled

also i recommend for testing disable iptables rules...

if you need more help please let me know.

Michael