Hi all,
My objective is to build a bridged vpn in that way that i won't have to worry if my internal ip address space is in conflict with the clients internal lan address space (i want to avoid the renumbering of my lan, even if i use the most used subnets, 192.168.0.0 or 192.168.1.0). The vpn would be used for gaming, so that broadcasts are important. This is why i want it to be the bridged version, with the tap interface. The official faq lists this problem but doesn't show the exact steps which one have to execute to have a working installation, only mentions the NETMAP target of netfilter. This means probably, heavy usage of iptables to do some advanced S&Dnating, at least this is my idea about it. After searching around i stumbled upon this page:
http://nimlabs.org/~nim/dirtynat.html. And i'm trying to set my server up as described on this site, but without much success. And i'm beggining to think that the way it's described there is not even possible to do. Altough a lot of information is missing, like the exact bridge setup, and the server config file, so i had to guess those. Maybe my configuration is also flawed, i'm not sure. The one thing i'm sure of is that my understanding of openvpn is not enough to accomplish what i want. My server config is:
port 1194
proto udp
dev tap0
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.64.201 255.255.255.0 192.168.64.205 192.168.64.210
push "route 192.168.64.0 255.255.255.0 192.168.64.201"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
My internal lan is 192.168.32.0/24, and i would like to map that to 192.168.64.0/24 (or whatever else actualy)
My ifconfig entries after raising the bridge:
br0 Link encap:Ethernet HWaddr 00:21:85:0a:9e:56
inet addr:192.168.32.3 Bcast:192.168.32.255 Mask:255.255.255.0
inet6 addr: fe80::221:85ff:fe0a:9e56/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:19 errors:0 dropped:0 overruns:0 frame:0
TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1414 (1.3 KiB) TX bytes:1436 (1.4 KiB)
eth0 Link encap:Ethernet HWaddr 00:21:85:0a:9e:56
inet6 addr: fe80::221:85ff:fe0a:9e56/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:154920 errors:0 dropped:0 overruns:0 frame:0
TX packets:128044 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:230092970 (219.4 MiB) TX bytes:9373215 (8.9 MiB)
Interrupt:44 Base address:0x2000
tap0 Link encap:Ethernet HWaddr 76:5b:75:e0:05:1c
UP BROADCAST PROMISC MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
According to the instructions i should give the tap0 interface under the bridge the ip of 192.168.64.201, so it could be the gateway for the clients. and also that at this point i should be able (after connecting to the vpn, which works correctly) to ping the gateway (tap0 interface of the vpn server) from client and vice versa. This doesnt work and i'm suspicious that it cannot work because the tap0 interface is under the bridge, so by my logic and by what i understand about bridges, assigning an ip address to an interface that is a part of a bridge interface doesnt makes sense. The ping is stuck, by watching tcpdump because the tap0 interface cannot get the mac address of the clients mac. it pumps out arp requests but never gets the reply because they are going to the br0 interface directly, at least this is what i concluded from the arp and route tables of both the client and the vpn server.
So, is there someone more knowledgeable about this, who could confirm that the mentioned site,
http://nimlabs.org/~nim/dirtynat.html, describes a working solution for this vpn setup or am i the one who is missing something in my setup? Thank you.
