Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Rough solution:

iptables -A FORWARD -i br200 -j ACCEPT
iptables -A FORWARD -o br200 -j ACCEPT

I still don't understand what's happening. Bridging is made on L2, iptables shouldn't touch that packets.


Configuration:

Debian 6.0 Squeeze

OpenVPN 2.2.1(from backports)

My task is to connect remote clients with local network on data link layer, so that they stay in one broadcast domain and have the same network/netmask as local clients. I'm using TAP interfaces and bridging. All related interfaces(ethernet(local network), TAP(VPN) and bridge) are set to promiscuous mode. Network/netmask is 172.20.200.0/24. Server address is 172.20.200.2.

Both local and remote clients can ping server, but there is no connection between local and remote clients. Using packet capturing program tshark on server (tshark -i br200 -f "icmp" ) I see icmp echo requests from from remote client to local. On local client I don't see that requests(using Wireshark). Moreover, local client have remote client arp address in arp cache, and remote client have local client arp address in arp cache. So, they see each other on data link network layer. But they just can't ping each other! Firewall and antivirus are disabled on both clients. Where is the problem? I don't understand.

/etc/network/interfaces

auto bond0.200
  iface bond0.200 inet manual
        vlan_raw_device bond0
        up ifconfig bond0.200 0.0.0.0 promisc up

  auto br200
  iface br200 inet static
        bridge_ports bond0.200
        bridge_stp off
        bridge_fd 1
        address 172.20.200.2
        netmask 255.255.255.0
        post-up ifconfig br200 promisc

/etc/openvpn/server.conf

mode server
tls-server
port *****
proto tcp-server
dev tap200

script-security 2

up /etc/openvpn/bridge-start
down /etc/openvpn/bridge-stop

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
#crl-verify crl.pem

auth sha1
cipher AES-256-CBC

; !!!
; comp-lzo

tun-mtu 1500
mssfix 1450

client-config-dir /etc/openvpn/ccd
ccd-exclusive

client-to-client
keepalive 10 120

persist-key
persist-tun

status /var/log/openvpn/server-arm.status
log-append  /var/log/openvpn/server-arm.log

/etc/openvpn/ccd/client-arm23

ifconfig-push 172.20.200.132 255.255.255.0

/etc/openvpn/bridge-start

#!/bin/bash
#set -x
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

br="br200"
tap="tap200"

openvpn --mktun --dev $tap
ifconfig $tap 0.0.0.0 promisc up

brctl addif $br $tap

exit 0

/etc/openvpn/bridge-stop

#!/bin/bash
#set -x
####################################
# Tear Down Ethernet bridge on Linux
####################################

br="br200"
tap="tap200"

brctl delif $br $tap

openvpn --rmtun --dev $tap

exit 0

MTU and MRU on all interfaces coincide.

bond0.200 is vlan device over bond device. Maybe this in some strange way causes errors?

share|improve this question
    
No firewall on the OpenVPN server, right? And you're following the OpenVPN docs? openvpn.net/index.php/open-source/documentation/miscellaneous/… –  cjc Aug 14 '12 at 12:58
    
I tried disabling firewall on server - nothing changed. I think, iptables can't influence bridge behaviour: it's working on Level3. Arptables are not configured: –  Selivanov Pavel Aug 14 '12 at 14:53
    
Yes, I did this with OpenVPN docs. I slightly changed algorithm: bridge is already created in /etc/network/interfaces, bridge-start and bridge-stop scripts just add/remove TAP interface to it. So all network settings are collected in /etc/network/interfaces, not in many scattered files. Using original OpenVPN scripts(creating bridge on vpn server start) does not change nothing. –  Selivanov Pavel Aug 14 '12 at 15:02
    
Are you using ebtables? –  klocek Aug 20 '12 at 16:19
    
No, there is no ebtables rules, policy is ACCEPT in every chain. –  Selivanov Pavel Aug 20 '12 at 17:22
add comment

1 Answer 1

up vote 2 down vote accepted
+100

The most likely you forgot to enable forwarding. Add net.ipv4.ip_forward=1 to /etc/sysctl.conf, then sysctl -p or restart. Also try to add following to OpenVPN config:

server-bridge 172.20.200.2 255.255.255.0 172.20.200.100 172.20.200.200
push "route 172.20.200.0 255.255.255.0"

Note that adding interface to bridge, sets promisc flag appropriately. Bridge interface need not to be in promisc mode.

I got the same setup running, but on OpenSUSE, TAP interfaces are created during startup and OpenVPN just opens them - no start/stop script in OpenVPN.

share|improve this answer
    
net.ipv4.ip_forward=1 is already set –  Selivanov Pavel Aug 19 '12 at 20:41
    
'server-bridge 172.20.200.2 255.255.255.0 172.20.200.100 172.20.200.200' is just equivalent to 'mode server; tls-server; ifconfig-pool 172.20.200.100 172.20.200.200 255.255.255.0; push "route-gateway 172.20.200.2"' –  Selivanov Pavel Aug 19 '12 at 20:45
    
Yes, it was forwarding problem. iptables FORWARD chain had default policy DROP, so clearing iptables didn't help. But why? Bridging is made on L2, iptables shouldn't even touch that frames! I don't understand –  Selivanov Pavel Aug 20 '12 at 17:29
    
@SelivanovPavel The bridge interface still passes through the kernel. IPtables can filter traffic on L2, and anything that is forwarded between interfaces is affected by IPtables, regardless of whether routing was involved. –  Jeff Ferland Aug 20 '12 at 18:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.