Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i have setup a linux box (on an esxi5) which acts as an openvpn server. the server is configured to use bridging for the clients, which essentially works, with one exception.

if the client pings some machine on the network which is not the server itself it does not work. i ruled out etherything i know of (iptables, etc) and running tcpdump bioled it down to the following things:

  • i see arp requests on tap0 and br0
  • i see the arp replies on br0
  • i do NOT see the arp replies on tap0

my simple and short question: why does the br0 device not forward the arp reply to the tap0 device?

any idea might help!

share|improve this question
ok - i got a step further. when i watch the mac table of the bridge using brctl showmacs i see the mac address of my vpn client on the tap0 side. if i now start pinging from the vpn client to the subnet the mac address moves over to the over bridge port which of course blocks the arp reply of the subnet. the mac switches back almost immediately when the ping stops. so what i do not know is why the mac address switches to the wrong switchport - all my searches yielded to no results so far. –  fen Dec 12 '11 at 9:46
if it "moves over" to another port, that would be a definite clue that the MAC address is either present more than once in your network or you are seeing the effects of a network loop (two ports of the same bridge connected by an active path). Both are configuration problems which need to be corrected. –  the-wabbit Dec 10 '14 at 6:55

1 Answer 1

Without more info, we are guessing, but lets try:

First make sure that both eth0 and tap0 are in promiscuous mode. br0 should not be in promiscuous mode.

Next check it you have arptables and any iptables rules that might be interfering.

As you already get arp replies, your probably don't have this, but check it anyway.

finally check the rp_filter settings, but also check any extra sysctl parameters you may have set.

share|improve this answer
...and since it's ESXi make sure promiscuous mode is enabled on the virtual switch. –  Gerald Combs Dec 6 '13 at 23:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.