[Bridging] am I missing something? no traffic exchanged

erupter

Hi people. I'm feeling a bit stupid as there are tons of pages about routing vs bridging and tons of posts with configurations.
Still I can't manage my own.

My prv network is 192.168.1.0/24
My vpn server is 192.168.1.2
My network gateway is 192.168.1.1
configured to portforward 1194 to 192.168.1.2

If using single bridging, I can connect to the vpn-server and its prv network services (it's running on a Netgear ReadyNAS and I can access the NAS features).
So I tried going full bridging and nothing works.

server.conf


local		192.168.1.2
port		1194
proto		udp
mssfix		1400
#push		"dhcp-option DNS 10.8.0.0"
push		"dhcp-option WINS 192.168.1.2"

dev 		tap
ca		/etc/openvpn/ca.crt
cert		/etc/openvpn/MyVPNServer.crt
key		/etc/openvpn/MyVPNServer.key
dh		/etc/openvpn/dh1024.pem
server-bridge	192.168.1.2 	255.255.255.0	192.168.1.200	192.168.1.210
ifconfig-pool-persist ipp.txt
push		"route 192.168.1.0 255.255.255.0"
keepalive	10 		120
cipher		BF-CBC
comp-lzo
max-clients	5
persist-key

status		openvpn-status.log
verb		3

client.conf

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# This is the address the client will
# "appear as" when it connects to the
# bridged LAN.
ifconfig 192.168.1.200 255.255.255.0
ifconfig-nowarn
	
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.

dev tap

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
#dev-node tap0

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote testingonly.no-ip.org 31266
remote testingonly.no-ip.org 8080
# remote 192.168.1.202 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
user nobody
group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca C:\\Program\ Files\ (x86)\\OpenVPN\\keys\\ca.crt
cert C:\\Program\ Files\ (x86)\\OpenVPN\\keys\\Client01.crt
key C:\\Program\ Files\ (x86)\\OpenVPN\\keys\\Client01.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
cipher BF-CBC

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

#route	192.168.1.0	255.255.255.0	10.8.0.1

I think I'm missing something, maybe ip routing on the server?
But it's clearly stated that when doing full bridging the routing comes for free...
Still my Tap adapter gets the Ip 192.168.1.200/24 but it can't ping anything at all.

Also where is the log actually saved?

Mimiko

For bridge you don't have to push "route 192.168.1.0 255.255.255.0".
The logs vor the server is usually in /var/openvpn. But you have to enable it with --log or --log-append options.
What is full bridging? There is no such entity for OpenVPN.

erupter

Thanks.
But commenting the push command didn't do it.
I'm still unable to ping anything.

The "full-bridging" refers to the fact that I originally followed a tutorial from a guy who went for routing, but changed the adapter from tun to tap.
In that case (almost identical configuration, save for the fact that I had a "server" directive instead of "server-bridge" in the server.conf with subsequent alternative net pool on 10.8.0.0) I was able to at least ping the server itself and access the ReadyNas features (including shares).

Now with the (supposedly) correct bridging configuration, I'm unable to ping anything at all.
The current adapter situation is this

Ethernet adapter Local Area Connection 9:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::50ea:807a:9cf:3eaa%42
   IPv4 Address. . . . . . . . . . . : 192.168.1.200
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

which appears correct for my home network.
Still I can't reach any machine on it.

erupter

Did a "ipconfig -all"
Is it wrong to have system-wide ip routing disabled?

Windows IP Configuration

   Host Name . . . . . . . . . . . . : FCD-04
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : creationn.net

Ethernet adapter Local Area Connection 9:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Win32 Adapter V9
   Physical Address. . . . . . . . . : 00-FF-E3-D1-90-FC
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::50ea:807a:9cf:3eaa%42(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.200(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : domenica 12 febbraio 2012 11:00:30
   Lease Expires . . . . . . . . . . : lunedì 11 febbraio 2013 11:00:30
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 192.168.1.0
   DHCPv6 IAID . . . . . . . . . . . : 989921251
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-F3-04-5D-E0-CB-4E-8E-9C-06

   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   Primary WINS Server . . . . . . . : 192.168.1.2
   NetBIOS over Tcpip. . . . . . . . : Enabled

erupter

Ok I now discovered that on the ReadyNAS there is (currently) no way of putting up a bridge adapter. (bridge-utils don't compile).

So here are my new config files:
server.conf

#	local configureation
management	192.168.1.2	7075
local		192.168.1.2
port		1194
proto		udp
mssfix		1400
dev		tun
#dev-node	tap-bridge

#	Bridging configuration
#server-bridge	192.168.1.2	255.255.255.0	192.168.1.200	192.168.1.210

#	Routing configuration
server		10.8.0.0	255.255.255.0
push		"route	192.168.1.0	255.255.255.0"
#route		192.168.1.0	255.255.255.0	10.8.0.0

#	Common DHCP configuration
push		"dhcp-option DNS 10.8.0.0"
push		"dhcp-option WINS 192.168.1.2"

#	Certificates
ca		/etc/openvpn/ca.crt
cert		/etc/openvpn/MyVPNServer.crt
key		/etc/openvpn/MyVPNServer.key
dh		/etc/openvpn/dh1024.pem

ifconfig-pool-persist ipp.txt
status		openvpn-status.log

keepalive	10 		120
cipher		BF-CBC
comp-lzo
max-clients	5
persist-key
verb		5

client.conf

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# This is the address the client will
# "appear as" when it connects to the
# bridged LAN.
#ifconfig 192.168.1.200 255.255.255.0
#ifconfig-nowarn
	
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.

dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
#dev-node tap0

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote testingonly.no-ip.org 31266
remote testingonly.no-ip.org 8080
# remote 192.168.1.202 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
user nobody
group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca C:\\Program\ Files\ (x86)\\OpenVPN\\keys\\ca.crt
cert C:\\Program\ Files\ (x86)\\OpenVPN\\keys\\Client01.crt
key C:\\Program\ Files\ (x86)\\OpenVPN\\keys\\Client01.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
cipher BF-CBC

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 5

# Silence repeating messages
;mute 20

#route	192.168.1.0	255.255.255.0	10.8.0.1

Still can't ping anything.

This is the ifconfig of the vpn server

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 b)  TX bytes:1900 (1.8 KiB)

I don't get why there is a tunnel from 0.1 to 0.2, and I also don't get why the server is bind to something like 0.5, in fact my client gets a 0.6 ip from the pool...

erupter

I posted 4 answers to my thread, still none has appeared.
I hope this one gets through.

The main problem is that I can't get the bridge-utils on my NAS, they are not supported.

I used the term "full-bridging" because right now I have a Tap adapter that allows me to communicate with the openvpn server, but I'm unable to communicate with the rest of the network.

network is 192.168.1.0/24
vpn server is 192.168.1.2
gateway is 192.168.1.1

Right now I get through with a tap adapter and a routing configuration: the client gets an ip in the class 10.8.0.0/24 and is able to ping 192.168.1.2.
Quite strangely to me there is JUST ONE other station that gets through: it's 192.168.1.234 which I'm able to ping from outside. All other stations on the network are unreachable.

Now I can't put up any real bridging (no br facilities).
And a routing wouldn't allow me to access the services I want.
Besides changing the machine hosting the server to a more capable one, are there any other suggestions?

Mimiko

To clarify, ther is no "full-bridging". Its either a bridging or routing configuration using tap or tun adapters. As you discovered, your OpenVPN server can't be configured in bridge mode. So only routing is appriopiate. In routing modem the IP assigned you have seen is normal and lay in concept of /30 network. The reason you can'y get trouth the server is that OpenVPN serve is not at the same time the efault route for network computers. To resolve this, you must enable routing on your OpenVPN server and follow one method from this guide: https://forums.openvpn.net/topic9465.html