confused about configs

brendan

setup:

eth0 - WAN, dynamic IP, dyndns setup
br0 - bridge of eth1 - eth4, IP 192.168.1.254 (/24 net)
br1 - bridge of tap0 - tap1, IP 192.168.50.254 (/24 net)

dhcrelay is setup to relay from br1 to 192.168.1.254 and 192.168.1.1
dhcp is running on 192.168.1.254 and 192.168.1.1, .254 is primary and .1 is secondary
dns is running on 192.168.1.254 and 192.168.1.1, .254 is slave and .1 is master

server startup script:

#!/bin/bash

modprobe tun

openvpn --mktun --dev tap0
openvpn --mktun --dev tap1

brctl addbr br1
brctl addif br1 tap0
brctl addif br1 tap1

ifconfig tap0 0.0.0.0 promisc up
ifconfig tap1 0.0.0.0 promisc up

ifconfig br1 192.168.50.254 netmask 255.255.255.0 broadcast 192.168.50.255

server config:

port 1194
proto udp
dev tap
ca ca.crt
cert vpn.crt
key vpn.key
dh dh2048.pem
cipher AES-256-CBC
server-bridge
push "redirect-gateway def1"
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
comp-lzo
user nobody
group nobody
ping-timer-rem
persist-tun
persist-key
verb 4
mute 20

client config:

client
dev tap
proto udp
remote <removed>
resolv-retry infinite
keepalive 10 120
ping-timer-rem
persist-tun
persist-key
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
cipher AES-256-CBC
pull
comp-lzo
verb 4
mute 20

i am looking to setup a TAP vpn instance on a segment separate from my "internal" network of 192.168.1.0/24. I would like to be able to manage the vpn segment as a zone in dns, and service it with dhcp addresses. with the above, i am able to connect and auth with the openvpn client running on my htc phone, but i do not get an IP through the tunnel. i see no traffic on tap1 or br1. since tap0 is a loopback, i have not gone tcpdumping on it, but assume there is nothing there either.

is what i am trying to do feasible? are there any misconfigurations that i should understand better? thanks in advance.

Mimiko

dhcrelay is setup to relay from br1 to 192.168.1.254 and 192.168.1.1
dhcp is running on 192.168.1.254 and 192.168.1.1, .254 is primary and .1 is secondary
dns is running on 192.168.1.254 and 192.168.1.1, .254 is slave and .1 is master

If dhcp is running on same computer, why you relay from br1? Just configure dhcp to serve on br1 too.

since tap0 is a loopback

tap adapter is not a loopback adapter adpter. Although you can ping locally atached every ethernet adapter and get answer, the loopback concept is different.

br1 - bridge of tap0 - tap1

You are using only one OpenVPN instance, why create two tap adapters? And bridge them? It's definatly wrong. Don't create a bridge. Just assign IP 192.168.50.254 to the tap0, and use it in the config: "dev tap0".

If you whant a separate segment, why you are pushing 192.168.1.0?
If the segment is appart, then configure dhcp to server on tap adapter the desired IP range.
You will have to use masquarading and iptable rules to be able to manage the VPN segment from a computer different than 192.168.1.254.

brendan

Mimiko wroteIf dhcp is running on same computer, why you relay from br1? Just configure dhcp to serve on br1 too.

as a matter of size/scale, it happens to be running in the same computer and another computer on a network locally connected to the gateway. I am trying to construct a solution that does not require that to be so, thereby enabling growth or implementation in a larger environment.

Mimiko wrotetap adapter is not a loopback adapter adpter. Although you can ping locally atached every ethernet adapter and get answer, the loopback concept is different.

you're right, i had some broken rules it seems, and could only ping the 50.254 address from the router, and it showed on the lo adapter because was the only adapter configured to allow the access. see log entry:

2011-10-17T19:55:19.495768-04:00 router kernel: [435379.581208] RULE 0 -- ACCEPT IN= OUT=lo SRC=192.168.50.254 DST=192.168.50.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=22573 SEQ=1

Mimiko wroteYou are using only one OpenVPN instance, why create two tap adapters? And bridge them? It's definatly wrong. Don't create a bridge. Just assign IP 192.168.50.254 to the tap0, and use it in the config: "dev tap0".

see this link: http://openvpn.net/index.php/open-source/documentation/install.html?start=1
under the heading "Notes -- Ethernet bridging, Windows client, Linux Server", the article states:

This script will set up ethernet bridging between eth1, tap0, and tap1. Change the br0 ifconfig to match the ifconfig that would be used for eth1 under normal, non-bridged configuration. Use as many tapX virtual adapters as you will have remote clients connecting.

(emphasis mine)

Mimiko wroteIf you whant a separate segment, why you are pushing 192.168.1.0?

because i thought that was adding the route to the clients routing table. would be needed, right? at least i thought it would be...

Mimiko wroteIf the segment is appart, then configure dhcp to server on tap adapter the desired IP range.

see above, would like a scalable solution.

Mimiko wroteYou will have to use masquarading and iptable rules to be able to manage the VPN segment from a computer different than 192.168.1.254.

right, and getting that correct is not as straight forward as i thought. i think i will need to reorder/restrict my iptables rules so the gateway can get an address from the ISP, but doesnt "leak" dhcp requests from the vpn network out to the ISP.

Mimiko

as a matter of size/scale, it happens to be running in the same computer and another computer on a network locally connected to the gateway. I am trying to construct a solution that does not require that to be so, thereby enabling growth or implementation in a larger environment.

Supposing you whant that VPN clients to get IP from DHCP on LAN, then you will have to make bridge, but not in the way you've done. You have to bridge VPN tunnel addapter with eth interface ointing to LAN where dhcp will be in order for clients to get DHCP requests, or allow OpenVPN server to handle dhcp request from VPN clients.

Use as many tapX virtual adapters as you will have remote clients connecting.

It's a old one. I don't know why it's staiting this way, but nowadays only one tun adapter is enough to handle all client connections.

So, if you whant VPN clients to get IPs from lan DHCP, you must create bridge between tun adapter and local interface where DHCP servers are located. This link will help you: http://openvpn.net/index.php/open-source/faq/77-server/323-i-want-to-set-up-an-ethernet-bridge-on-the-1921681024-subnet-existing-dhcp.html. How to give the VPN clients IPs in different segment - you will have to think about, or by MAC, or by interface. Limiting access to local LAN for VPN clients and vice versa is done with iptables, also it is used for configuring manageent access.

brendan

am i understanding this right? if i add tap0 to br0 (with an IP of 192.168.1.254), i can give 192.168.50.xxx IPs to the clients connecting over the VPN? i dont understand how that would work...

Mimiko

i can give 192.168.50.xxx IPs to the clients connecting over the VPN?

Logically - yes. If on first dhcp request, dhcp server will respond to client giving 192.168.50.x ip, the client will get it, but will not be able to communicate to server or server's lan anymore, just the clients between itself will communicate.