Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to setup openvpn in bridge mode. I've done this before on a openbsd router. Now I have an internal machine that is running openbsd. the client is a windows 7 laptop.

The setups is as follows.

My local lan at home is 10.0.10.0 255.255.255.0 with a gateway of 10.0.10.1 The vpn server is 10.0.10.15

I am forwarding port 9999 udp public to 10.0.10.15.

on the server: /etc/hostname.tun0

link0 up

/etc/bridgename.bridge0

add pcn0
add tun0
up

/etc/openvpn.conf

dev-type tap
dev tun0
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
user nobody
group nobody
daemon openvpn
chroot /var/empty
port 9999
proto udp
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
management 127.0.0.1 9998 /etc/openvpn/mgmt.pwd
server-bridge 10.0.10.1 255.255.255.0 10.0.10.240 10.0.10.244
push "route 10.0.10.0 255.255.255.0"
ifconfig-pool-persist ipp.txt
client-to-client
tls-auth /etc/openvpn/keys/ta.key 0
cipher AES-256-CBC
max-clients 5
status openvpn-status.log
log-append openvpn.log
verb 4
mute 20

on the client: openvpn.conf:

client
remote xxx.xxx.xxx.xxx 9999 #my ip is really here
proto udp
dev tap
dev-node VPN
nobind
comp-lzo
link-mtu 1590
persist-key
persist-tun
keepalive 10 120
management 127.0.0.1 9090 "mgmt.pwd"
ns-cert-type server
ca "ca.crt"
cert "tim-work-laptop.crt"
key "tim-work-laptop.key"
tls-client
tls-auth "ta.key" 1
cipher AES-256-CBC
pull
verb 2

when I run an ifconfig -a on the server:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33204
        priority: 0
        groups: lo
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
pcn0: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
        lladdr 08:00:27:04:df:8c
        priority: 0
        groups: egress
        media: Ethernet none
        status: active
        inet6 fe80::a00:27ff:fe04:df8c%pcn0 prefixlen 64 scopeid 0x1
        inet 10.0.10.15 netmask 0xffffff00 broadcast 10.0.10.255
enc0: flags=0<> mtu 1536
        priority: 0
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        priority: 0
        groups: tun
bridge0: flags=0<> mtu 1500
        priority: 0
        groups: bridge
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33204
        priority: 0
        groups: pflog

my firewall config is open since it is an internal box:

int_if="pcn0"
vpn_if="tun0"
br_if="bridge0"
vpn="9999"
ntp="123"
dns="53"

#set require-order no
set skip on lo
scrub in

pass in proto udp from any to any port $ntp
pass in proto {tcp,udp} from any to any port $dns
pass in         # to establish keep-state

#vpn/bridge info
pass in quick on $int_if proto udp from any to $int_if port $vpn
pass in quick on {$vpn_if,$br_if} proto {tcp,udp,icmp} from any to any
pass out quick on {$vpn_if,$br_if} proto {tcp,udp,icmp} from any to any

The windows client connects, gives me an ip of 10.0.10.240 as expected, and the openvpn gui icon is green. However, I am unable to ping anything on my local lan at home, include 10.0.10.15.

Any ideas?

I'm using the following guides: http://blog.innerewut.de/2005/07/04/openvpn-2-0-on-openbsd http://openvpn.net/index.php/open-source/documentation/howto.html http://www.kernel-panic.it/openbsd/vpn/vpn4.html

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

really silly thing...

there needs to be a carriage return at the end of the hostname.tun0 and bridgename.bridge0 files.

share|improve this answer
    
Tim, Can you describe the "carriage return" ? –  will Jan 29 '10 at 17:42
    
it's needs a newline character at the end, like \n or \r. In other words, go the end of the line and press [enter] –  Tim Hoolihan Feb 1 '10 at 21:22
    
"Carriage return" (CR) and "line feed" (LF) are ASCII characters for marking end of the line. –  grawity Dec 8 '10 at 10:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.