Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to setup openvpn in bridge mode. I've done this before on a openbsd router. Now I have an internal machine that is running openbsd. the client is a windows 7 laptop.

The setups is as follows.

My local lan at home is with a gateway of The vpn server is

I am forwarding port 9999 udp public to

on the server: /etc/hostname.tun0

link0 up


add pcn0
add tun0


dev-type tap
dev tun0
keepalive 10 60
user nobody
group nobody
daemon openvpn
chroot /var/empty
port 9999
proto udp
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
management 9998 /etc/openvpn/mgmt.pwd
push "route"
ifconfig-pool-persist ipp.txt
tls-auth /etc/openvpn/keys/ta.key 0
cipher AES-256-CBC
max-clients 5
status openvpn-status.log
log-append openvpn.log
verb 4
mute 20

on the client: openvpn.conf:

remote xxx.xxx.xxx.xxx 9999 #my ip is really here
proto udp
dev tap
dev-node VPN
link-mtu 1590
keepalive 10 120
management 9090 "mgmt.pwd"
ns-cert-type server
ca "ca.crt"
cert "tim-work-laptop.crt"
key "tim-work-laptop.key"
tls-auth "ta.key" 1
cipher AES-256-CBC
verb 2

when I run an ifconfig -a on the server:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33204
        priority: 0
        groups: lo
        inet netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
        lladdr 08:00:27:04:df:8c
        priority: 0
        groups: egress
        media: Ethernet none
        status: active
        inet6 fe80::a00:27ff:fe04:df8c%pcn0 prefixlen 64 scopeid 0x1
        inet netmask 0xffffff00 broadcast
enc0: flags=0<> mtu 1536
        priority: 0
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        priority: 0
        groups: tun
bridge0: flags=0<> mtu 1500
        priority: 0
        groups: bridge
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33204
        priority: 0
        groups: pflog

my firewall config is open since it is an internal box:


#set require-order no
set skip on lo
scrub in

pass in proto udp from any to any port $ntp
pass in proto {tcp,udp} from any to any port $dns
pass in         # to establish keep-state

#vpn/bridge info
pass in quick on $int_if proto udp from any to $int_if port $vpn
pass in quick on {$vpn_if,$br_if} proto {tcp,udp,icmp} from any to any
pass out quick on {$vpn_if,$br_if} proto {tcp,udp,icmp} from any to any

The windows client connects, gives me an ip of as expected, and the openvpn gui icon is green. However, I am unable to ping anything on my local lan at home, include

Any ideas?

I'm using the following guides: http://blog.innerewut.de/2005/07/04/openvpn-2-0-on-openbsd http://openvpn.net/index.php/open-source/documentation/howto.html http://www.kernel-panic.it/openbsd/vpn/vpn4.html

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

really silly thing...

there needs to be a carriage return at the end of the hostname.tun0 and bridgename.bridge0 files.

share|improve this answer
Tim, Can you describe the "carriage return" ? –  will Jan 29 '10 at 17:42
it's needs a newline character at the end, like \n or \r. In other words, go the end of the line and press [enter] –  Tim Hoolihan Feb 1 '10 at 21:22
"Carriage return" (CR) and "line feed" (LF) are ASCII characters for marking end of the line. –  grawity Dec 8 '10 at 10:59
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.