problem with bridge + dchp from router

ex1tium

Hey everyone, I have been trying to get OpenVPN working with bridged mode for about week now. First it couldn't get it work at all and now I'm at the point when I got bridged mode working and when I connect I can access my server's local LAN fine. Problem is it doesnt route my traffic thru my servers WAN IP. So when I connect from client it show my client's ip on (http://whatismyip.com) and not the servers WAN ip. I think the problem must be someway related to dhcp which my router handles (D-link DIR100). First I tried tunnel mode and it worked fine but since I can't game with it I need to have bridged. Lets start with my servers lan ip address and routing. I'll provide logs at the end of the post. I would really like to get this working since I'm trying to help friend who lives in dorm and they close all ports except 80 at midnight, however if he is connected to say for example game server when ports close he will be able to continue play on that server until he disconnects.

Router:
Router IP: 10.0.0.1
subnet mask: 255.255.255.0
local domain name: behemothrouter
enable DNS relay [x]

DCHP server (<- router)
DCHP ip address range 10 to 100 (adresses within the LAN subnet)
DHCP lease time 90000 minutes

I have made it so that my server always gets the same IP from DHCP which is 10.0.0.11

[b]Routing info from server[/b]

root@xxxxxxxxx:/etc/openvpn# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags     Metric    Ref       Use Iface
10.0.0.0        0.0.0.0         255.255.255.0     U          0           0          0        br0
0.0.0.0         10.0.0.1        0.0.0.0              UG         100        0         0         br0

ifconfig:

br0       Link encap:Ethernet  HWaddr 00:50:fc:f7:13:d6
          inet addr:10.0.0.11  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::250:fcff:fef7:13d6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:100037 errors:0 dropped:0 overruns:0 frame:0
          TX packets:88633 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13280715 (13.2 MB)  TX bytes:15087712 (15.0 MB)

eth0      Link encap:Ethernet  HWaddr 00:50:fc:f7:13:d6
          inet6 addr: fe80::250:fcff:fef7:13d6/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:97356 errors:0 dropped:0 overruns:0 frame:0
          TX packets:101225 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:17107820 (17.1 MB)  TX bytes:17169324 (17.1 MB)
          Interrupt:19 Base address:0x1400

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1475 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1475 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:129836 (129.8 KB)  TX bytes:129836 (129.8 KB)

tap0      Link encap:Ethernet  HWaddr 2a:42:b8:71:e2:19
          inet6 addr: fe80::2842:b8ff:fe71:e219/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:6861 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2551 errors:0 dropped:2 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:1408125 (1.4 MB)  TX bytes:377790 (377.7 KB)

I will include info about my bridges too

root@xxxxxxxxx:/etc/openvpn# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0050fcf713d6       no              eth0
                                                                   tap0

here is my /etc/network/interfaces file:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet dhcp

#OpenVPN virtual interface
auto br0
iface br0 inet static
        address 10.0.0.11
        netmask 255.255.255.0
        broadcast 10.0.0.255
        gateway 10.0.0.1
        bridge_ports eth0
        #bridge_fd 9
        #bridge_hello 2
        #bridge_maxage 12
        #bridge_stp off

Server config:

local 10.0.0.11 1194
dev tap0
proto tcp
port 1194

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

user nobody
group nogroup
#;server 10.0.0.11 255.255.255.0
server-bridge 10.0.0.11 255.255.255.0 10.0.0.20 10.0.0.25
persist-key
persist-tun

#status openvpn-status.log
#verb 3
client-to-client

push "route 10.0.0.11 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"


log-append /var/log/openvpn

Client config:

dev tap0
client
proto tcp
remote x.x.x.x 1194
resolv-retry infinite
nobind
user nobody
group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
# Set log file verbosity.
verb 3

And finally my logs from client and server:

Server:

Sat Oct 29 17:01:12 2011 client1/84.248.221.230:53855 Connection reset, restarting [-1]
Sat Oct 29 17:02:21 2011 SIGTERM[hard,] received, process exiting
Sat Oct 29 17:02:22 2011 OpenVPN 2.1.3 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Mar 11 2011
Sat Oct 29 17:02:22 2011 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own$
Sat Oct 29 17:02:22 2011 WARNING: --keepalive option is missing from server config
Sat Oct 29 17:02:22 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Oct 29 17:02:22 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Sat Oct 29 17:02:23 2011 TUN/TAP device tap0 opened
Sat Oct 29 17:02:23 2011 GID set to nogroup
Sat Oct 29 17:02:23 2011 UID set to nobody
Sat Oct 29 17:02:23 2011 Listening for incoming TCP connection on [AF_INET]10.0.0.11:1194
Sat Oct 29 17:02:23 2011 TCPv4_SERVER link local (bound): [AF_INET]10.0.0.11:1194
Sat Oct 29 17:02:23 2011 TCPv4_SERVER link remote: [undef]
Sat Oct 29 17:02:23 2011 Initialization Sequence Completed
Sat Oct 29 17:02:37 2011 Re-using SSL/TLS context
Sat Oct 29 17:02:37 2011 TCP connection established with [AF_INET]84.248.221.xxx:54014
Sat Oct 29 17:02:37 2011 TCPv4_SERVER link local: [undef]
Sat Oct 29 17:02:37 2011 TCPv4_SERVER link remote: [AF_INET]84.248.221.xxx:54014
Sat Oct 29 17:02:38 2011 84.248.221.230:54014 [client1] Peer Connection Initiated with [AF_INET]84.248.221.xxx:54014

Client:

Sat Oct 29 17:02:39 2011 NOTE: --user option is not implemented on Windows
Sat Oct 29 17:02:39 2011 NOTE: --group option is not implemented on Windows
Sat Oct 29 17:02:39 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
Sat Oct 29 17:02:39 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 29 17:02:39 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Oct 29 17:02:39 2011 Control Channel MTU parms [ L:1575 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Oct 29 17:02:39 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Oct 29 17:02:39 2011 Data Channel MTU parms [ L:1575 D:1450 EF:43 EB:4 ET:32 EL:0 ]
Sat Oct 29 17:02:39 2011 Local Options hash (VER=V4): '10f35004'
Sat Oct 29 17:02:39 2011 Expected Remote Options hash (VER=V4): 'a917298a'
Sat Oct 29 17:02:39 2011 Attempting to establish TCP connection with 80.222.114.xxx:1194
Sat Oct 29 17:02:39 2011 TCP connection established with 80.222.114.xxx:1194
Sat Oct 29 17:02:39 2011 TCPv4_CLIENT link local: [undef]
Sat Oct 29 17:02:39 2011 TCPv4_CLIENT link remote: 80.222.114.xxx:1194
Sat Oct 29 17:02:39 2011 TLS: Initial packet from 80.222.114.xxx:1194, sid=ce5179b8 251e0704
Sat Oct 29 17:02:39 2011 VERIFY OK: depth=1, /C=FI/ST=LAPPI/L=Tornio/O=ex1tium/CN=server/emailAddress=xxxxxxx@gmail.com
Sat Oct 29 17:02:39 2011 VERIFY OK: depth=0, /C=FI/ST=LAPPI/L=Tornio/O=ex1tium/CN=server/emailAddress=xxxxxxx@gmail.com
Sat Oct 29 17:02:40 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Oct 29 17:02:40 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 29 17:02:40 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Oct 29 17:02:40 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Oct 29 17:02:40 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Oct 29 17:02:40 2011 [server] Peer Connection Initiated with 80.222.114.xxx:1194
Sat Oct 29 17:02:43 2011 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Oct 29 17:02:43 2011 PUSH: Received control message: 'PUSH_REPLY,route 10.0.0.11 255.255.255.0,dhcp-option DNS 8.8.8.8,route-gateway 10.0.0.11,ifconfig 10.0.0.20 255.255.255.0'
Sat Oct 29 17:02:43 2011 OPTIONS IMPORT: --ifconfig/up options modified
Sat Oct 29 17:02:43 2011 OPTIONS IMPORT: route options modified
Sat Oct 29 17:02:43 2011 OPTIONS IMPORT: route-related options modified
Sat Oct 29 17:02:43 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Oct 29 17:02:43 2011 ROUTE default_gateway=192.168.1.1
Sat Oct 29 17:02:43 2011 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{95E384E2-C7D6-4159-94D4-6D6BE6670F08}.tap
Sat Oct 29 17:02:43 2011 TAP-Win32 Driver Version 9.8 
Sat Oct 29 17:02:43 2011 TAP-Win32 MTU=1500
Sat Oct 29 17:02:43 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.0.20/255.255.255.0 on interface {95E384E2-C7D6-4159-94D4-6D6BE6670F08} [DHCP-serv: 10.0.0.0, lease-time: 31536000]
Sat Oct 29 17:02:43 2011 Successful ARP Flush on interface [28] {95E384E2-C7D6-4159-94D4-6D6BE6670F08}
Sat Oct 29 17:02:48 2011 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Sat Oct 29 17:02:48 2011 C:\WINDOWS\system32\route.exe ADD 10.0.0.11 MASK 255.255.255.0 10.0.0.11
Sat Oct 29 17:02:48 2011 Warning: address 10.0.0.11 is not a network address in relation to netmask 255.255.255.0
Sat Oct 29 17:02:48 2011 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect.   [status=87 if_index=28]
Sat Oct 29 17:02:48 2011 Route addition via IPAPI failed [adaptive]
Sat Oct 29 17:02:48 2011 Route addition fallback to route.exe
The route addition failed: The parameter is incorrect.
Sat Oct 29 17:02:48 2011 Initialization Sequence Completed

My server uses ubuntu server 11.04 GNU/Linux 2.6.38-11-generic-pae i686
It has UFW firewall enabled and I googled necessary setting for it to work with openvpn:

Added these in  /etc/ufw/before.rules

-A ufw-before-input -i tun+ -j ACCEPT
-A ufw-before-output -i tun+ -j ACCEPT
-A ufw-before-forward -s 10.0.0.0/24 -j ACCEPT
-A ufw-before-forward -d 10.0.0.0/24 -j ACCEPT

# rules for NAT Table of iptables
# required line for ufw
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic from OpenVPN through eth0.
-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

# tell ufw to process the lines
COMMIT

I have also opened ports on my router firewall to allow traffic to port 1194
my client is using Windows 7.
my clients LAN uses subnet of 192.168.1.1

What am I doing wrong and how do I fix it?
Thanks in advance!

Mimiko

In server config you don't need ' push "route 10.0.0.11 255.255.255.0" '.
Also if traffic will be routed thru tunnel, then insteed of OpenVPN handling dhcp requests, use router's dhcp server, ie, inteed of:

server-bridge 10.0.0.11 255.255.255.0 10.0.0.20 10.0.0.25

use

mode server

And add:

push "redirect-gateway def1"

As the bridge is like a real switched lan, then the client will have the same ip mask as router on server side, so you don't need to masquarade. Remove "-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE" from rules. Also rules must look like this:

iptables -A INPUT -i tap+ -j ACCEPT
    iptables -A INPUT -i br0 -j ACCEPT
    iptables -A FORWARD -i br0 -j ACCEPT

ex1tium

thanks for your time. It works 50% now. DHCP gave IP just fine but there still seems to be issues since it doesn't route all traffic. My client's ip stays the same (not the WAN IP of server's LAN). Anyway I gotta upgrade my server for better one next week. I have made so many changes in its default config over the course of time that its getting slow. I'll be in touch when I get new hardware installed.