OpenVPN – Bridging two net

**UPDATE**

You will need bridge-tools … `yum install bridge-utils tunctl`

So, I have finally conquered the bridging of two networks. Well, I should refine that. I have managed to get an OpenVPN server configured correctly to have my VPN client be on my VPN server’s network – not some vpn-only network. Here’s what it looks like:

Internet
|
(dhcp address from Cable)
DD-Wrt router
192.168.0.1
|
[ all of the 192.168.0.x network ]
|
192.168.0.10
Server (with OpenVPN)

On the client side I have:

Internet
|
(dhcp address from generic ISP)
Gateway
192.168.1.1
|
Client device
192.168.1.100

So what I did was – I created a tap0 device on the server and built a bridge device that bridges the eth device with the virtual device.

For the OpenVPN server, I am running Fedora 9 running kernel 2.6.25-14.fc9.i686
There are a number of places out there that help you get the stupid package installed. However, there aren’t that many that help you actually get something working when it comes to the configurations. I found that the bridge-start and bridge-stop scripts were PAINFULLY undocumented. However, their role is extremely critical when doing this in bridged mode. I will leave it to you for installing openvpn in a non-bridged fashion. Once you get that working, come back here and use my scripts to help you get it working in a bridged manner.

Here’s what my /etc/openvpn/server.conf file looks like:

port 1194
proto udp
dev tap0
;dev-node MyTap
ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret
dh keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.0.10 255.255.255.0 192.168.0.21 192.168.0.29
;push "route 192.168.0.0 255.255.255.0"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;learn-address ./script
;push "redirect-gateway"
push "dhcp-option DNS 192.168.0.1"
push "dhcp-option WINS 192.168.0.1"
client-to-client
;duplicate-cn
keepalive 10 120
;tls-auth ta.key 0 # This file is secret
;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES
comp-lzo
max-clients 5
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 3
;mute 20

Here’s an example of a client.conf

client
dev tap
;dev-node MyTap
proto udp
remote my-server 1194
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
ca keys/ca.crt
cert keys/client6.crt
key keys/client6.key
ns-cert-type server
;tls-auth keys/ta.key 1
;cipher x
comp-lzo
verb 3
;mute 20

I found that the originial bridge-start script did not include the default gateway. Since I only use a single network card on my server, this is a necessary addition. Also, my one eth interface is eth1. I normally have it just pull DHCP from my router. On my router, I have it set to always give it 192.168.0.10 based on its MAC address ( I <3 dd-wrt and host-specific dhcpd services)
Here’s my bridge-start script:

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.0.10"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.10.255"
eth_gateway="192.168.0.1"

for t in $tap; do
 openvpn --mktun --dev $t
 sleep 1
done

brctl addbr $br
sleep 1
brctl addif $br $eth
sleep 1

for t in $tap; do
 brctl addif $br $t
 sleep 1
done

ifconfig $eth 0.0.0.0 promisc up
sleep 1

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
sleep 1
route add default gw $eth_gateway

Again, since eth1 is typically dhcp – I had to add the following to make sure that when the bridge gets turned off – it still pulls dhcp. (I do not use NetworkManager – instead, I have the setting files maintained in /etc/sysconfig/network-scripts/ifcfg-eth1)
Here’s my bridge-stop script:

#!/bin/bash

####################################
# Tear Down Ethernet bridge on Linux
####################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged together
tap="tap0"

ifconfig $br down
brctl delbr $br

for t in $tap; do
 openvpn --rmtun --dev $t
done

ifdown eth1
ifup eth1

I wanted to automatically generate a new client certificate. I also wanted to tarball up all of the necessary files that a client would need. So I came up with this file. For now -it resides in /root/bin So does bridge-start and bridge-stop
Here’s my addvpnclient.sh script

client=$1
tar=$2

if [ ! -d /etc/openvpn/dist/$client ]; then
        mkdir -p /etc/openvpn/dist/$client/keys
fi

if [ "$tar" != "no" ]; then
        cd /etc/openvpn/easy-rsa/2.0
        source ./vars
        ./pkitool $client
fi

cp /etc/openvpn/keys/ca.crt /etc/openvpn/dist/$client/keys
cp /etc/openvpn/keys/$client.key /etc/openvpn/dist/$client/keys
cp /etc/openvpn/keys/$client.crt /etc/openvpn/dist/$client/keys
cp /etc/openvpn/README /etc/openvpn/dist/$client

/etc/openvpn/client.sh $client > /etc/openvpn/dist/$client/$client.conf
cd /etc/openvpn/dist/$client
tar czvf $client-vpn.tgz *

I wanted to dynamically generate the client config file – so I also have /etc/openvpn/client.sh

client=$1
echo "
client
dev tap
;dev-node MyTap
proto udp
remote my-server 1194
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
ca keys/ca.crt
cert keys/$client.crt
key keys/$client.key
ns-cert-type server
;tls-auth keys/ta.key 1
;cipher x
comp-lzo
verb 3
;mute 20
"

Finally, when you do a “service openvpn start” or “service openvpn stop” it automatically finds *.conf in your /etc/openvpn folder. Also, it automatically runs scripts named “openvpn-startup” and “openvpn-shutdown” respectively. So I did the following:

ln -s /root/bin/bridge-stop /etc/openvpn/openvpn-shutdown
ln -s /root/bin/bridge-start /etc/openvpn/openvpn-startup

So now – all I have to do is hand a tgz file to a buddy and they can connect to my network and be ON THE network – not some funky vpn network that is only on the vpn devices. Sweet if you ask me … sweet. Now I’m off to apply this knowledge to my pfSense device. It is currently grabbing my neighbors open wifi on one radio and broadcasting it on a different radio. My broadcast radio is bridged to the LAN. The wifi is also encrypted – so as to protect my network. The thing that started this whole need for the VPN was the fact that I can’t set port-forwarding on the neighbor’s router. They were smart enough to change the default password, but not add encryption?!?! … anyhow, now with the pfSense box, I will have a permanent VPN tunnel back to my server which will allow me to access the network behind the pfSense box from anywhere in the world – via my server’s network. Muahaha… evil.

I forgot to mention … I added open ports to my firewall.
Here’s my current /etc/sysconfig/iptables file:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tap0 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 1194 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 904 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -i tap0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Also – my router that is between my openvpn server and the internet – I have port 1194 port forwarded to 192.168.0.10 (my server’s IP address).

---

Possibly related posts: (automatically generated)

• OpenWRT + OpenVPN + Routed LANs
• Bringing together .NET and Java
• OpenVPN 2.0 HOWTO-Ways and network planning articles