Can't ping other server hosts within "server-bridge" network

Need help configuring your VPN? Just post here and you'll get that help.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
xtracoder
OpenVpn Newbie
Posts: 5
Joined: Tue Jul 09, 2019 8:03 am

Can't ping other server hosts within "server-bridge" network

Post by xtracoder » Tue Jul 09, 2019 12:08 pm

I'm trying to setup simple thing - private network of 2 VPS hosts accessible to external client.
So far I have setup where ping works from client to VPN'en IP of server host where OpenVpn is hosted. But other host in server network is not ping'able from client - can someone help me to fix this?

Now i have ...

1. Ethernet bridge on OpenVpn server (v2.4.7 + Ubuntu 18.04) configured as outlined at "community-resources/ethernet-bridging"
Ping from 'OpenVpn server' to 'another host' work OK.

Code: Select all

# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.b602c32d4aec       no              eth1
                                                        tap0
2. OpenVpn server configuration (TCP/443 is used because UDP/443 is cut-off on one of client networks, anyway - switching to UDP does not change anything)

server

port 443
proto tcp

server-bridge ...
dev tap0
push "route ..."
...


3. Client configuration

client

client
dev tap0
proto tcp
...


Unfortunatelly presence of any IP address in text triggers "antispam filter" saying "Forbidden. Contains contacts.". Therefore I'm not able to post more useful details.

xtracoder
OpenVpn Newbie
Posts: 5
Joined: Tue Jul 09, 2019 8:03 am

Re: Can't ping other server hosts within "server-bridge" network

Post by xtracoder » Fri Jul 12, 2019 12:20 am

Ok ... after digging into tcpdump i've found that something is do actually blocking traffic.

In my particular case I'm trying to setup server-bridge network in "Digital Ocean" and it appears that connection between servers in "DO private network" works only for "IP addresses provided by DigitalOcean infrastructure". OpenVPN introduces additional IPs for VPN clients and these ones seem to be blocked by DO infrastucture.

So ... this seems to be a "firewall issue", but not under my control. Will check with DO if problem can be resolved somehow.

If there is someone here who succeeded with "server-bridge network in Digital Ocean" - please let me know the path to success.

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 6008
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can't ping other server hosts within "server-bridge" network

Post by TinCanTech » Fri Jul 12, 2019 1:08 am

Do you need a bridge ?
https://openvpn.net/community-resources ... idged-vpn/

There is plenty of information around ..

xtracoder
OpenVpn Newbie
Posts: 5
Joined: Tue Jul 09, 2019 8:03 am

Re: Can't ping other server hosts within "server-bridge" network

Post by xtracoder » Fri Jul 12, 2019 10:08 am

After your hint - I guess i do not really need bridge, but routing did not work - therefore I tried bridging.

Now I known how to diagnose the problem (via tcpdump) - and as I see it, root cause in both cases is the same - 'something' outside of my control is blocking trafic (from OpenVPN server to another host in server network) having "unknown source IP".

xtracoder
OpenVpn Newbie
Posts: 5
Joined: Tue Jul 09, 2019 8:03 am

[Solved] Can't ping other server hosts within "server-bridge" network (Digital Ocean VPS)

Post by xtracoder » Mon Jul 15, 2019 12:43 am

Got reply from Digital Ocean
Some current limitations of private networking that you might be bumping up against:

- Traffic is restricted to the private network. Incoming packets from any source other than the private network are silently discarded at the network level.

- Currently, traffic on the private network applies MAC address origin checks. This prevents the use of Droplets as gateways between the private and public networks.
https://www.digitalocean.com/docs/netwo ... /overview/
... so neither routing nor bridging will work in Digital Ocean private network. But ... connecting other hosts from that private network as VPN clients gives same result with "client-to-client" enabled, however this requires explicit configuration for each 'server host'. Not a big deal in my case of 3 servers.

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 6008
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can't ping other server hosts within "server-bridge" network

Post by TinCanTech » Mon Jul 15, 2019 1:38 am

Not so much of an Ocean any longer then ...

User avatar
TinCanTech
OpenVPN Protagonist
Posts: 6008
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can't ping other server hosts within "server-bridge" network

Post by TinCanTech » Mon Jul 15, 2019 9:57 pm

I know DO have a tutorial about setting up openvpn on a droplet .. look for that.

Post Reply