Hello everybody! I'm new to this forum and I need your help to implement the following configuration:
The vpn-server (on the right) acts as a gateway to Internet for his clients (the access points connected through the vpn) and the wireless stations connected to the access points. The access point has two interfaces: eth0 is connected to the local wan gateway and wlan0 is the wireless interface. I want to put wlan0 and tap0 into br0 bridge because I need that all the wireless stations belong to the same subnet.
The openvpn client gets his address from the openvpn server process, while the wireless client receive the network configuration from a dhcp server on the vpn server. I proceed this way:
1) start openvpn on the server with the following configuration:
proto tcp
port 1194
dev tap0
server 10.0.0.0 255.255.255.0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/client.key
dh /etc/openvpn/keys/dh2048.pem
persist-key
persist-tun
keepalive 10 60
topology subnet
push "redirect-gateway def1"
user nobody
group nogroup
daemon
log-append /var/log/openvpn/openvpn.log
status /var/log/openvpn/status.log
verb 4
2) start the openvpn client with the following configuration:
client
proto tcp
remote <public server ip>
rport 1194
nobind
dev tap0
dev-type tap
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
comp-lzo
persist-key
persist-tun
daemon
log-append /var/log/openvpn/openvpn.log
status /var/log/openvpn/status.log
verb 4
At this point, the vpn works as expected between client and server; I can ping the server and hosts on the Internet. ip_forwarding and nat are enabled on the server.
3) I create the br0 bridge and assign to it the same ip address of tap0 on the client
4) start hostapd; it puts wlan0 in master mode and adds it to br0 bridge. ip_forwarding is enabled.
5) I add tap0 to br0; at this point the wireless stations can connect and receive the network configuration from the remote dhcp server, but they can only ping the server ip address, not hosts on Internet. At the same time, the vpn client stops reaching the server, probably because of the wrong routing table after the br0 brings up.
Can you help me to correct this configuration to achieve my topology working?
Thanks in advance,
Gica
