1

I am not sure if this is a linux or windows issue. I have openvpn set up with a bridge interface that includes tap0 and eth0. I have my client machine (win10) getting its IP through my dhcp server. The config line server-bridge causes the dhcp gateway to be stripped out so the client doesn't receive it. When I change that line to server-bridge nogw the gateway address is given to the client, but I can't ping or connect to the gateway. What do I have wrong?

Client (win10) routing table

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.79     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
       172.16.0.0      255.255.0.0         On-link      172.16.1.205    257
     172.16.1.205  255.255.255.255         On-link      172.16.1.205    257
   172.16.255.255  255.255.255.255         On-link      172.16.1.205    257
      192.168.1.0    255.255.255.0         On-link      192.168.1.79    266
     192.168.1.79  255.255.255.255         On-link      192.168.1.79    266
    192.168.1.255  255.255.255.255         On-link      192.168.1.79    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.1.79    266
        224.0.0.0        240.0.0.0         On-link      172.16.1.205    257
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.1.79    266
  255.255.255.255  255.255.255.255         On-link      172.16.1.205    257
===========================================================================

When I have it working correctly, routing traffic through the VPN, the following lines are added to the routing table:

0.0.0.0     0.0.0.0       172.16.0.1  172.16.1.205 2
64.191.11.0 255.255.255.0 192.168.1.1 192.168.1.96 61

The second line allows the VPN traffic to use the original gateway.

OpenVPN Server conf file

port 1194
proto udp
dev tap
ca /etc/openvpn/ca.crt
cert /etc/openvpn/myservername.crt
key /etc/openvpn/myservername.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server-bridge
script-security 2
up "up br0 eth0"
down "down br0 eth0"
down-pre
push "dhcp-option DNS 172.16.0.1"
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
cipher BF-CBC        # Blowfish (default)
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Adding nogw to the server-bridge line allows the gateway to go through on dhcp but I can't reach the server anymore. the scripts up and down add the tap interface to the bridge or remove it.

OpenVPN client conf:

client
dev tap
remote jmerrill.us 1194
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client1.crt"
key "C:\\Program Files\\OpenVPN\\config\\client1.key"
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1
cipher BF-CBC
comp-lzo
verb 3
  • What does your routing table say? – user1794469 Jan 17 at 23:59
  • 1
    @roaima my thought was that the client isn't on the same network as the gateway. But that's a pretty specific guess on my part and you are right to just ask for the config – user1794469 Jan 18 at 0:06
  • @user1794469 The client vpn connection is on the same network as the server's LAN because of the bridge. – James Jan 18 at 1:59
  • @roaima I have added more info. Do you need anything else? – James Jan 18 at 2:00
  • @user1794469 I did figure out something. The reason it is cutting off communication is because the vpn traffic was trying to follow the route as well. When I set a route for the vpn server address to follow the normal gateway, I can use a gateway address without any trouble. Unfortunately, that means that I have to manually add the routes every time. – James Jan 20 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.