OpenVPN bridge can't access machines on local network

[laleshii]

Hello,

Followed this guide: https://wiki.archlinux.org/index.php/OpenVPN_Bridge

This is my setup: I have a wireless router(192.168.2.1) which connects to the Internet through a PPPoE connection and acts as a gateway and DHCP server for the local network. I'm trying to make a VPN on a machine(192.168.2.201). I bridged the VPN tap0 with eth0 through br0 like in the guide. Connecting works ok and the client receives the proper IP but I cannot access other machines on the local network (ping works only server and client).

This is my server.conf:

Code: Select all

port 1194
proto tcp
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.2.1 255.255.255.0 192.168.2.202 192.168.2.210
push "route 192.168.2.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 6

This is my client.conf:

Code: Select all

client
dev tap
proto tcp
remote hostname.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 6

If you need any more info just reply.
Thank you.
Rares

[Mimiko]

You didn't enabled forwarding. Read this link http://www.openvpn.net/index.php/open-s ... html#scope and follow the links mentioned there.

[laleshii]

To quote the document you have linked me:

Including multiple machines on the server side when using a bridged VPN (dev tap)

One of the benefits of using ethernet bridging is that you get this for free without needing any additional configuration.

UPDATE: I tried IP forwarding. First enabled it. Now:

Code: Select all

# sysctl net.ipv4.ip_forward

net.ipv4.ip_forward = 1

Tried running:

Code: Select all

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i br0 -j ACCEPT

But with no luck. Am I doing something wrong?

[maikcat]

please post output of:

ifconfig

iptables -L -v

iptables -L -v -t nat

brctl show

on your server..

Michael.