openvpn + bridge utils in CentOS 6
 

27.09.2011, 09:52, "�建伟" <myhnet@gmail.com>:
> Hi all,
>
> I just intalled openvpn + bridge in CentOS 6, but i get strange problems:
>
> the remote PCs cannot get the local PCs' Â*MACs and also, the local PCs
> cannot get the remote PCs' MACs
>
> but when i run "brctl showmacs br0" Â*it will list all the MACs and also "
> brctl show" will show that all the correct adapters are in br0
>
> SELinux disabled
>
> any ideas?
>

First of all you should check routing table of remote hosts. If everything is correct, try to monitor br0, and other devises(ethX) by "tcpdump -n -i [device name]".
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

Hi

the routing table in the remote hosts are OK. "tcpdump -n -i [device name]"
cannot capture any packages from remote. no mater br0 nor tap0.

Best Regards
Tang Jianwei

On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:

>
>
> 27.09.2011, 09:52, "�建伟" <myhnet@gmail.com>:
> > Hi all,
> >
> > I just intalled openvpn + bridge in CentOS 6, but i get strange problems:
> >
> > the remote PCs cannot get the local PCs' MACs and also, the local PCs
> > cannot get the remote PCs' MACs
> >
> > but when i run "brctl showmacs br0" it will list all the MACs and also "
> > brctl show" will show that all the correct adapters are in br0
> >
> > SELinux disabled
> >
> > any ideas?
> >
>
> First of all you should check routing table of remote hosts. If everything
> is correct, try to monitor br0, and other devises(ethX) by "tcpdump -n -i
> [device name]".
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



--
Tang Jianwei
System Administrator
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

So, something stop packets from remote hosts. May be firewall on remote PC...? and can you run tcpdump on same remote host, to check that it's tap0 device.

27.09.2011, 11:06, "�建伟" <myhnet@gmail.com>:
> Hi
>
> the routing table in the remote hosts are OK. "tcpdump -n -i [device name]"
> cannot capture any packages from remote. no mater br0 nor tap0.
>
> Best Regards
> Tang Jianwei
>
> On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:
>
>> Â*27.09.2011, 09:52, "å”�建伟" <myhnet@gmail.com>:
>>> Â*Hi all,
>>>
>>> Â*I just intalled openvpn + bridge in CentOS 6, but i get strange problems:
>>>
>>> Â*the remote PCs cannot get the local PCs' Â*MACs and also, the local PCs
>>> Â*cannot get the remote PCs' MACs
>>>
>>> Â*but when i run "brctl showmacs br0" Â*it will list all the MACs and also "
>>> Â*brctl show" will show that all the correct adapters are in br0
>>>
>>> Â*SELinux disabled
>>>
>>> Â*any ideas?
>> Â*First of all you should check routing table of remote hosts. If Â*everything
>> Â*is correct, try to monitor br0, and other devises(ethX) by "tcpdump -n -i
>> Â*[device name]".
>> Â*_______________________________________________
>> Â*CentOS mailing list
>> Â*CentOS@centos.org
>> Â*http://lists.centos.org/mailman/listinfo/centos
> --
> Tang Jianwei
> System Administrator
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

Hi

no, i don't think so. anyway, i can and only can the vpn server from the
remote hosts.

Best Regards
Tang Jianwei

On Tue, Sep 27, 2011 at 3:59 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:

>
> So, something stop packets from remote hosts. May be firewall on remote
> PC...? and can you run tcpdump on same remote host, to check that it's tap0
> device.
>
> 27.09.2011, 11:06, "�建伟" <myhnet@gmail.com>:
> > Hi
> >
> > the routing table in the remote hosts are OK. "tcpdump -n -i [device
> name]"
> > cannot capture any packages from remote. no mater br0 nor tap0.
> >
> > Best Regards
> > Tang Jianwei
> >
> > On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <mikxalich@yandex.ru
> >wrote:
> >
> >> 27.09.2011, 09:52, "�建伟" <myhnet@gmail.com>:
> >>> Hi all,
> >>>
> >>> I just intalled openvpn + bridge in CentOS 6, but i get strange
> problems:
> >>>
> >>> the remote PCs cannot get the local PCs' MACs and also, the local PCs
> >>> cannot get the remote PCs' MACs
> >>>
> >>> but when i run "brctl showmacs br0" it will list all the MACs and
> also "
> >>> brctl show" will show that all the correct adapters are in br0
> >>>
> >>> SELinux disabled
> >>>
> >>> any ideas?
> >> First of all you should check routing table of remote hosts. If
> everything
> >> is correct, try to monitor br0, and other devises(ethX) by "tcpdump -n
> -i
> >> [device name]".
> >> _______________________________________________
> >> CentOS mailing list
> >> CentOS@centos.org
> >> http://lists.centos.org/mailman/listinfo/centos
> > --
> > Tang Jianwei
> > System Administrator
> > _______________________________________________
> > CentOS mailing list
> > CentOS@centos.org
> > http://lists.centos.org/mailman/listinfo/centos
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



--
Tang Jianwei
System Administrator
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

Hm... It's very hard to guess without config files. Can you post your server and client openvpn configs... and also can your show a br0 creation commands?

27.09.2011, 12:01, "�建伟" <myhnet@gmail.com>:
> Hi
>
> no, i don't think so. anyway, i can and only can the vpn server from the
> remote hosts.
>
> Best Regards
> Tang Jianwei
>
> On Tue, Sep 27, 2011 at 3:59 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:
>
>> Â*So, something stop packets from remote hosts. May be firewall on remote
>> Â*PC...? and can you run tcpdump on same remote host, to check that it's tap0
>> Â*device.
>>
>> Â*27.09.2011, 11:06, "å”�建伟" <myhnet@gmail.com>:
>>> Â*Hi
>>>
>>> Â*the routing table in the remote hosts are OK. "tcpdump -n -i [device
>> Â*name]"
>>> Â*cannot capture any packages from remote. no mater br0 nor tap0.
>>>
>>> Â*Best Regards
>>> Â*Tang Jianwei
>>>
>>> Â*On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <mikxalich@yandex.ru
>>> wrote:
>>>> Â*Â*27.09.2011, 09:52, "å”�建伟" <myhnet@gmail.com>:
>>>>> Â*Â*Hi all,
>>>>>
>>>>> Â*Â*I just intalled openvpn + bridge in CentOS 6, but i get strange
>> Â*problems:
>>>>> Â*Â*the remote PCs cannot get the local PCs' Â*MACs and also, the local PCs
>>>>> Â*Â*cannot get the remote PCs' MACs
>>>>>
>>>>> Â*Â*but when i run "brctl showmacs br0" Â*it will list all the MACs and
>> Â*also "
>>>>> Â*Â*brctl show" will show that all the correct adapters are in br0
>>>>>
>>>>> Â*Â*SELinux disabled
>>>>>
>>>>> Â*Â*any ideas?
>>>> Â*Â*First of all you should check routing table of remote hosts. If
>> Â*Â*everything
>>>> Â*Â*is correct, try to monitor br0, and other devises(ethX) by "tcpdump -n
>> Â*-i
>>>> Â*Â*[device name]".
>>>> Â*Â*______________________________________________ _
>>>> Â*Â*CentOS mailing list
>>>> Â*Â*CentOS@centos.org
>>>> Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>> Â*--
>>> Â*Tang Jianwei
>>> Â*System Administrator
>>> Â*_______________________________________________
>>> Â*CentOS mailing list
>>> Â*CentOS@centos.org
>>> Â*http://lists.centos.org/mailman/listinfo/centos
>> Â*_______________________________________________
>> Â*CentOS mailing list
>> Â*CentOS@centos.org
>> Â*http://lists.centos.org/mailman/listinfo/centos
> --
> Tang Jianwei
> System Administrator
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

openvpn configure file

*port 1194
proto udp
dev tap0
ca ca.crt
cert VPN_Server.crt
key VPN_Server.key # This file should be kept secret
dh dh1024.pem
server-bridge 192.168.119.1 255.255.255.0 192.168.119.221 192.168.119.225
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
mute 20
*

the script for bring up the bridge
*# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.119.1"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.119.255"

for t in $tap; do
openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
brctl addif $br $t
done

for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast*


On Tue, Sep 27, 2011 at 5:20 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:

> Hm... It's very hard to guess without config files. Can you post your
> server and client openvpn configs... and also can your show a br0 creation
> commands?
>
> 27.09.2011, 12:01, "�建伟" <myhnet@gmail.com>:
> > Hi
> >
> > no, i don't think so. anyway, i can and only can the vpn server from the
> > remote hosts.
> >
> > Best Regards
> > Tang Jianwei
> >
> > On Tue, Sep 27, 2011 at 3:59 PM, Минтаиров Михаил <mikxalich@yandex.ru
> >wrote:
> >
> >> So, something stop packets from remote hosts. May be firewall on remote
> >> PC...? and can you run tcpdump on same remote host, to check that it's
> tap0
> >> device.
> >>
> >> 27.09.2011, 11:06, "�建伟" <myhnet@gmail.com>:
> >>> Hi
> >>>
> >>> the routing table in the remote hosts are OK. "tcpdump -n -i [device
> >> name]"
> >>> cannot capture any packages from remote. no mater br0 nor tap0.
> >>>
> >>> Best Regards
> >>> Tang Jianwei
> >>>
> >>> On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <
> mikxalich@yandex.ru
> >>> wrote:
> >>>> 27.09.2011, 09:52, "�建伟" <myhnet@gmail.com>:
> >>>>> Hi all,
> >>>>>
> >>>>> I just intalled openvpn + bridge in CentOS 6, but i get strange
> >> problems:
> >>>>> the remote PCs cannot get the local PCs' MACs and also, the local
> PCs
> >>>>> cannot get the remote PCs' MACs
> >>>>>
> >>>>> but when i run "brctl showmacs br0" it will list all the MACs and
> >> also "
> >>>>> brctl show" will show that all the correct adapters are in br0
> >>>>>
> >>>>> SELinux disabled
> >>>>>
> >>>>> any ideas?
> >>>> First of all you should check routing table of remote hosts. If
> >> everything
> >>>> is correct, try to monitor br0, and other devises(ethX) by "tcpdump
> -n
> >> -i
> >>>> [device name]".
> >>>> _______________________________________________
> >>>> CentOS mailing list
> >>>> CentOS@centos.org
> >>>> http://lists.centos.org/mailman/listinfo/centos
> >>> --
> >>> Tang Jianwei
> >>> System Administrator
> >>> _______________________________________________
> >>> CentOS mailing list
> >>> CentOS@centos.org
> >>> http://lists.centos.org/mailman/listinfo/centos
> >> _______________________________________________
> >> CentOS mailing list
> >> CentOS@centos.org
> >> http://lists.centos.org/mailman/listinfo/centos
> > --
> > Tang Jianwei
> > System Administrator
> > _______________________________________________
> > CentOS mailing list
> > CentOS@centos.org
> > http://lists.centos.org/mailman/listinfo/centos
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



--
Tang Jianwei
System Administrator
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

I can't remember a reason, but at one moment I stop to use "openvpn --mktun --dev [dev name]" command. May be it's becouse openvpn create tap0 by it self. So try to comment this lines:

for t in $tap; do
openvpn --mktun --dev $t
done

then restart a network, after then start openvpn and after it start bridge script


> openvpn configure file
>
> *port 1194
> proto udp
> dev tap0
> ca ca.crt
> cert VPN_Server.crt
> key VPN_Server.key Â*# This file should be kept secret
> dh dh1024.pem
> server-bridge 192.168.119.1 255.255.255.0 192.168.119.221 192.168.119.225
> keepalive 10 120
> comp-lzo
> user nobody
> group nobody
> persist-key
> persist-tun
> status openvpn-status.log
> log-append Â*/var/log/openvpn.log
> verb 3
> mute 20
> *
>
> the script for bring up the bridge
> *# Define Bridge Interface
> br="br0"
>
> # Define list of TAP interfaces to be bridged,
> # for example tap="tap0 tap1 tap2".
> tap="tap0"
>
> # Define physical ethernet interface to be bridged
> # with TAP interface(s) above.
> eth="eth1"
> eth_ip="192.168.119.1"
> eth_netmask="255.255.255.0"
> eth_broadcast="192.168.119.255"
>
> for t in $tap; do
> Â*Â*Â*Â*openvpn --mktun --dev $t
> done
>
> brctl addbr $br
> brctl addif $br $eth
>
> for t in $tap; do
> Â*Â*Â*Â*brctl addif $br $t
> done
>
> for t in $tap; do
> Â*Â*Â*Â*ifconfig $t 0.0.0.0 promisc up
> done
>
> ifconfig $eth 0.0.0.0 promisc up
>
> ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast*
>
> On Tue, Sep 27, 2011 at 5:20 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:
>
>> Â*Hm... It's very hard to guess without config files. Can you post your
>> Â*server and client openvpn configs... and also can your show Â*a br0 creation
>> Â*commands?
>>
>> Â*27.09.2011, 12:01, "å”�建伟" <myhnet@gmail.com>:
>>> Â*Hi
>>>
>>> Â*no, i don't think so. anyway, i can and only can the vpn server from the
>>> Â*remote hosts.
>>>
>>> Â*Best Regards
>>> Â*Tang Jianwei
>>>
>>> Â*On Tue, Sep 27, 2011 at 3:59 PM, Минтаиров Михаил <mikxalich@yandex.ru
>>> wrote:
>>>> Â*Â*So, something stop packets from remote hosts. May be firewall on remote
>>>> Â*Â*PC...? and can you run tcpdump on same remote host, to check that it's
>> Â*tap0
>>>> Â*Â*device.
>>>>
>>>> Â*Â*27.09.2011, 11:06, "å”�建伟" <myhnet@gmail.com>:
>>>>> Â*Â*Hi
>>>>>
>>>>> Â*Â*the routing table in the remote hosts are OK. "tcpdump -n -i [device
>>>> Â*Â*name]"
>>>>> Â*Â*cannot capture any packages from remote. no mater br0 nor tap0.
>>>>>
>>>>> Â*Â*Best Regards
>>>>> Â*Â*Tang Jianwei
>>>>>
>>>>> Â*Â*On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <
>> Â*mikxalich@yandex.ru
>>>>> Â*wrote:
>>>>>> Â*Â*Â*27.09.2011, 09:52, "å”�建伟" <myhnet@gmail.com>:
>>>>>>> Â*Â*Â*Hi all,
>>>>>>>
>>>>>>> Â*Â*Â*I just intalled openvpn + bridge in CentOS 6, but i get strange
>>>> Â*Â*problems:
>>>>>>> Â*Â*Â*the remote PCs cannot get the local PCs' Â*MACs and also, the local
>> Â*PCs
>>>>>>> Â*Â*Â*cannot get the remote PCs' MACs
>>>>>>>
>>>>>>> Â*Â*Â*but when i run "brctl showmacs br0" Â*it will list all the MACs and
>>>> Â*Â*also "
>>>>>>> Â*Â*Â*brctl show" will show that all the correct adapters are in br0
>>>>>>>
>>>>>>> Â*Â*Â*SELinux disabled
>>>>>>>
>>>>>>> Â*Â*Â*any ideas?
>>>>>> Â*Â*Â*First of all you should check routing table of remote hosts. If
>>>> Â*Â*Â*everything
>>>>>> Â*Â*Â*is correct, try to monitor br0, and other devises(ethX) by "tcpdump
>> Â*-n
>>>> Â*Â*-i
>>>>>> Â*Â*Â*[device name]".
>>>>>> Â*Â*Â*____________________________________________ ___
>>>>>> Â*Â*Â*CentOS mailing list
>>>>>> Â*Â*Â*CentOS@centos.org
>>>>>> Â*Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>>>> Â*Â*--
>>>>> Â*Â*Tang Jianwei
>>>>> Â*Â*System Administrator
>>>>> Â*Â*______________________________________________ _
>>>>> Â*Â*CentOS mailing list
>>>>> Â*Â*CentOS@centos.org
>>>>> Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>>> Â*Â*______________________________________________ _
>>>> Â*Â*CentOS mailing list
>>>> Â*Â*CentOS@centos.org
>>>> Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>> Â*--
>>> Â*Tang Jianwei
>>> Â*System Administrator
>>> Â*_______________________________________________
>>> Â*CentOS mailing list
>>> Â*CentOS@centos.org
>>> Â*http://lists.centos.org/mailman/listinfo/centos
>> Â*_______________________________________________
>> Â*CentOS mailing list
>> Â*CentOS@centos.org
>> Â*http://lists.centos.org/mailman/listinfo/centos
> --
> Tang Jianwei
> System Administrator
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

no, i removed the commands you mentioned, but it still doesn't work.

Best Regards
Tang Jianwei

On Tue, Sep 27, 2011 at 6:01 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:

> I can't remember a reason, but at one moment I stop to use "openvpn
> --mktun --dev [dev name]" command. May be it's becouse openvpn create tap0
> by it self. So try to comment this lines:
>
> for t in $tap; do
> openvpn --mktun --dev $t
> done
>
> then restart a network, after then start openvpn and after it start bridge
> script
>
>
> > openvpn configure file
> >
> > *port 1194
> > proto udp
> > dev tap0
> > ca ca.crt
> > cert VPN_Server.crt
> > key VPN_Server.key # This file should be kept secret
> > dh dh1024.pem
> > server-bridge 192.168.119.1 255.255.255.0 192.168.119.221 192.168.119.225
> > keepalive 10 120
> > comp-lzo
> > user nobody
> > group nobody
> > persist-key
> > persist-tun
> > status openvpn-status.log
> > log-append /var/log/openvpn.log
> > verb 3
> > mute 20
> > *
> >
> > the script for bring up the bridge
> > *# Define Bridge Interface
> > br="br0"
> >
> > # Define list of TAP interfaces to be bridged,
> > # for example tap="tap0 tap1 tap2".
> > tap="tap0"
> >
> > # Define physical ethernet interface to be bridged
> > # with TAP interface(s) above.
> > eth="eth1"
> > eth_ip="192.168.119.1"
> > eth_netmask="255.255.255.0"
> > eth_broadcast="192.168.119.255"
> >
> > for t in $tap; do
> > openvpn --mktun --dev $t
> > done
> >
> > brctl addbr $br
> > brctl addif $br $eth
> >
> > for t in $tap; do
> > brctl addif $br $t
> > done
> >
> > for t in $tap; do
> > ifconfig $t 0.0.0.0 promisc up
> > done
> >
> > ifconfig $eth 0.0.0.0 promisc up
> >
> > ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast*
> >
> > On Tue, Sep 27, 2011 at 5:20 PM, Минтаиров Михаил <mikxalich@yandex.ru
> >wrote:
> >
> >> Hm... It's very hard to guess without config files. Can you post your
> >> server and client openvpn configs... and also can your show a br0
> creation
> >> commands?
> >>
> >> 27.09.2011, 12:01, "�建伟" <myhnet@gmail.com>:
> >>> Hi
> >>>
> >>> no, i don't think so. anyway, i can and only can the vpn server from
> the
> >>> remote hosts.
> >>>
> >>> Best Regards
> >>> Tang Jianwei
> >>>
> >>> On Tue, Sep 27, 2011 at 3:59 PM, Минтаиров Михаил <
> mikxalich@yandex.ru
> >>> wrote:
> >>>> So, something stop packets from remote hosts. May be firewall on
> remote
> >>>> PC...? and can you run tcpdump on same remote host, to check that
> it's
> >> tap0
> >>>> device.
> >>>>
> >>>> 27.09.2011, 11:06, "�建伟" <myhnet@gmail.com>:
> >>>>> Hi
> >>>>>
> >>>>> the routing table in the remote hosts are OK. "tcpdump -n -i
> [device
> >>>> name]"
> >>>>> cannot capture any packages from remote. no mater br0 nor tap0.
> >>>>>
> >>>>> Best Regards
> >>>>> Tang Jianwei
> >>>>>
> >>>>> On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <
> >> mikxalich@yandex.ru
> >>>>> wrote:
> >>>>>> 27.09.2011, 09:52, "�建伟" <myhnet@gmail.com>:
> >>>>>>> Hi all,
> >>>>>>>
> >>>>>>> I just intalled openvpn + bridge in CentOS 6, but i get strange
> >>>> problems:
> >>>>>>> the remote PCs cannot get the local PCs' MACs and also, the
> local
> >> PCs
> >>>>>>> cannot get the remote PCs' MACs
> >>>>>>>
> >>>>>>> but when i run "brctl showmacs br0" it will list all the MACs
> and
> >>>> also "
> >>>>>>> brctl show" will show that all the correct adapters are in br0
> >>>>>>>
> >>>>>>> SELinux disabled
> >>>>>>>
> >>>>>>> any ideas?
> >>>>>> First of all you should check routing table of remote hosts. If
> >>>> everything
> >>>>>> is correct, try to monitor br0, and other devises(ethX) by
> "tcpdump
> >> -n
> >>>> -i
> >>>>>> [device name]".
> >>>>>> _______________________________________________
> >>>>>> CentOS mailing list
> >>>>>> CentOS@centos.org
> >>>>>> http://lists.centos.org/mailman/listinfo/centos
> >>>>> --
> >>>>> Tang Jianwei
> >>>>> System Administrator
> >>>>> _______________________________________________
> >>>>> CentOS mailing list
> >>>>> CentOS@centos.org
> >>>>> http://lists.centos.org/mailman/listinfo/centos
> >>>> _______________________________________________
> >>>> CentOS mailing list
> >>>> CentOS@centos.org
> >>>> http://lists.centos.org/mailman/listinfo/centos
> >>> --
> >>> Tang Jianwei
> >>> System Administrator
> >>> _______________________________________________
> >>> CentOS mailing list
> >>> CentOS@centos.org
> >>> http://lists.centos.org/mailman/listinfo/centos
> >> _______________________________________________
> >> CentOS mailing list
> >> CentOS@centos.org
> >> http://lists.centos.org/mailman/listinfo/centos
> > --
> > Tang Jianwei
> > System Administrator
> > _______________________________________________
> > CentOS mailing list
> > CentOS@centos.org
> > http://lists.centos.org/mailman/listinfo/centos
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



--
Tang Jianwei
System Administrator
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

28.09.2011, 04:58, "�建伟" <myhnet@gmail.com>:
Hello, I didn't find what to answer to you mounth ago. But now I also have an installation of centos 6 (at past I used centos 5.7) , and I have the same problems as you. First of all, did you find any solutions?

I only found that the problem is in br0 device. I can't guess why but it not recive ARP REPLY packets.

tcpdump on all devices (tap0, eth1, br0) give me the same:

20:12:22.012270 ARP, Request who-has 192.168.11.3 tell 192.168.11.33, length 28
20:12:23.027897 ARP, Request who-has 192.168.11.3 tell 192.168.11.33, length 28
20:12:24.027951 ARP, Request who-has 192.168.11.3 tell 192.168.11.33, length 28
//192.158.11.33 is remoute PC ip-address, and 192.168.11.3 is one of my local hosts//

and no APR REPLY.

Intresting that on other hand I have the same configs files on Centos 5.7. and everything work perfectly.


> no, i removed the commands you mentioned, but it still doesn't work.
>
> Best Regards
> Tang Jianwei
>
> On Tue, Sep 27, 2011 at 6:01 PM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:
>
>> Â*I can't remember a reason, but at one moment I stop to use Â*"openvpn
>> Â*--mktun --dev [dev name]" command. May be it's becouse openvpn create tap0
>> Â*by it self. So try to comment this lines:
>>
>> Â*Â*for t in $tap; do
>> Â*Â*Â*Â*Â*openvpn --mktun --dev $t
>> Â*Â*done
>>
>> Â*then restart a network, after then start openvpn and after it start bridge
>> Â*script
>>> Â*openvpn configure file
>>>
>>> Â**port 1194
>>> Â*proto udp
>>> Â*dev tap0
>>> Â*ca ca.crt
>>> Â*cert VPN_Server.crt
>>> Â*key VPN_Server.key Â*# This file should be kept secret
>>> Â*dh dh1024.pem
>>> Â*server-bridge 192.168.119.1 255.255.255.0 192.168.119.221 192.168.119.225
>>> Â*keepalive 10 120
>>> Â*comp-lzo
>>> Â*user nobody
>>> Â*group nobody
>>> Â*persist-key
>>> Â*persist-tun
>>> Â*status openvpn-status.log
>>> Â*log-append Â*/var/log/openvpn.log
>>> Â*verb 3
>>> Â*mute 20
>>> Â**
>>>
>>> Â*the script for bring up the bridge
>>> Â**# Define Bridge Interface
>>> Â*br="br0"
>>>
>>> Â*# Define list of TAP interfaces to be bridged,
>>> Â*# for example tap="tap0 tap1 tap2".
>>> Â*tap="tap0"
>>>
>>> Â*# Define physical ethernet interface to be bridged
>>> Â*# with TAP interface(s) above.
>>> Â*eth="eth1"
>>> Â*eth_ip="192.168.119.1"
>>> Â*eth_netmask="255.255.255.0"
>>> Â*eth_broadcast="192.168.119.255"
>>>
>>> Â*for t in $tap; do
>>> Â*Â*Â*Â*Â*openvpn --mktun --dev $t
>>> Â*done
>>>
>>> Â*brctl addbr $br
>>> Â*brctl addif $br $eth
>>>
>>> Â*for t in $tap; do
>>> Â*Â*Â*Â*Â*brctl addif $br $t
>>> Â*done
>>>
>>> Â*for t in $tap; do
>>> Â*Â*Â*Â*Â*ifconfig $t 0.0.0.0 promisc up
>>> Â*done
>>>
>>> Â*ifconfig $eth 0.0.0.0 promisc up
>>>
>>> Â*ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast*
>>>
>>> Â*On Tue, Sep 27, 2011 at 5:20 PM, Минтаиров Михаил <mikxalich@yandex.ru
>>> wrote:
>>>> Â*Â*Hm... It's very hard to guess without config files. Can you post your
>>>> Â*Â*server and client openvpn configs... and also can your show Â*a br0
>> Â*creation
>>>> Â*Â*commands?
>>>>
>>>> Â*Â*27.09.2011, 12:01, "å”�建伟" <myhnet@gmail.com>:
>>>>> Â*Â*Hi
>>>>>
>>>>> Â*Â*no, i don't think so. anyway, i can and only can the vpn server from
>> Â*the
>>>>> Â*Â*remote hosts.
>>>>>
>>>>> Â*Â*Best Regards
>>>>> Â*Â*Tang Jianwei
>>>>>
>>>>> Â*Â*On Tue, Sep 27, 2011 at 3:59 PM, Минтаиров Михаил <
>> Â*mikxalich@yandex.ru
>>>>> Â*wrote:
>>>>>> Â*Â*Â*So, something stop packets from remote hosts. May be firewall on
>> Â*remote
>>>>>> Â*Â*Â*PC...? and can you run tcpdump on same remote host, to check that
>> Â*it's
>>>> Â*Â*tap0
>>>>>> Â*Â*Â*device.
>>>>>>
>>>>>> Â*Â*Â*27.09.2011, 11:06, "å”�建伟" <myhnet@gmail.com>:
>>>>>>> Â*Â*Â*Hi
>>>>>>>
>>>>>>> Â*Â*Â*the routing table in the remote hosts are OK. "tcpdump -n -i
>> Â*[device
>>>>>> Â*Â*Â*name]"
>>>>>>> Â*Â*Â*cannot capture any packages from remote. no mater br0 nor tap0.
>>>>>>>
>>>>>>> Â*Â*Â*Best Regards
>>>>>>> Â*Â*Â*Tang Jianwei
>>>>>>>
>>>>>>> Â*Â*Â*On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <
>>>> Â*Â*mikxalich@yandex.ru
>>>>>>> Â*Â*wrote:
>>>>>>>> Â*Â*Â*Â*27.09.2011, 09:52, "å”�建伟" <myhnet@gmail.com>:
>>>>>>>>> Â*Â*Â*Â*Hi all,
>>>>>>>>>
>>>>>>>>> Â*Â*Â*Â*I just intalled openvpn + bridge in CentOS 6, but i get strange
>>>>>> Â*Â*Â*problems:
>>>>>>>>> Â*Â*Â*Â*the remote PCs cannot get the local PCs' Â*MACs and also, the
>> Â*local
>>>> Â*Â*PCs
>>>>>>>>> Â*Â*Â*Â*cannot get the remote PCs' MACs
>>>>>>>>>
>>>>>>>>> Â*Â*Â*Â*but when i run "brctl showmacs br0" Â*it will list all the MACs
>> Â*and
>>>>>> Â*Â*Â*also "
>>>>>>>>> Â*Â*Â*Â*brctl show" will show that all the correct adapters are in br0
>>>>>>>>>
>>>>>>>>> Â*Â*Â*Â*SELinux disabled
>>>>>>>>>
>>>>>>>>> Â*Â*Â*Â*any ideas?
>>>>>>>> Â*Â*Â*Â*First of all you should check routing table of remote hosts. If
>>>>>> Â*Â*Â*Â*everything
>>>>>>>> Â*Â*Â*Â*is correct, try to monitor br0, and other devises(ethX) by
>> Â*"tcpdump
>>>> Â*Â*-n
>>>>>> Â*Â*Â*-i
>>>>>>>> Â*Â*Â*Â*[device name]".
>>>>>>>> Â*Â*Â*Â*__________________________________________ _____
>>>>>>>> Â*Â*Â*Â*CentOS mailing list
>>>>>>>> Â*Â*Â*Â*CentOS@centos.org
>>>>>>>> Â*Â*Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>>>>>> Â*Â*Â*--
>>>>>>> Â*Â*Â*Tang Jianwei
>>>>>>> Â*Â*Â*System Administrator
>>>>>>> Â*Â*Â*____________________________________________ ___
>>>>>>> Â*Â*Â*CentOS mailing list
>>>>>>> Â*Â*Â*CentOS@centos.org
>>>>>>> Â*Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>>>>> Â*Â*Â*____________________________________________ ___
>>>>>> Â*Â*Â*CentOS mailing list
>>>>>> Â*Â*Â*CentOS@centos.org
>>>>>> Â*Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>>>> Â*Â*--
>>>>> Â*Â*Tang Jianwei
>>>>> Â*Â*System Administrator
>>>>> Â*Â*______________________________________________ _
>>>>> Â*Â*CentOS mailing list
>>>>> Â*Â*CentOS@centos.org
>>>>> Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>>> Â*Â*______________________________________________ _
>>>> Â*Â*CentOS mailing list
>>>> Â*Â*CentOS@centos.org
>>>> Â*Â*http://lists.centos.org/mailman/listinfo/centos
>>> Â*--
>>> Â*Tang Jianwei
>>> Â*System Administrator
>>> Â*_______________________________________________
>>> Â*CentOS mailing list
>>> Â*CentOS@centos.org
>>> Â*http://lists.centos.org/mailman/listinfo/centos
>> Â*_______________________________________________
>> Â*CentOS mailing list
>> Â*CentOS@centos.org
>> Â*http://lists.centos.org/mailman/listinfo/centos
> --
> Tang Jianwei
> System Administrator
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos

openvpn + bridge utils in CentOS 6
 

thank you very much for your follow up. wish to get good news from you soon.

On Sat, Nov 5, 2011 at 12:26 AM, Минтаиров Михаил <mikxalich@yandex.ru>wrote:

>
>
> 28.09.2011, 04:58, "�建伟" <myhnet@gmail.com>:
> Hello, I didn't find what to answer to you mounth ago. But now I also have
> an installation of centos 6 (at past I used centos 5.7) , and I have the
> same problems as you. First of all, did you find any solutions?
>
> I only found that the problem is in br0 device. I can't guess why but it
> not recive ARP REPLY packets.
>
> tcpdump on all devices (tap0, eth1, br0) give me the same:
>
> 20:12:22.012270 ARP, Request who-has 192.168.11.3 tell 192.168.11.33,
> length 28
> 20:12:23.027897 ARP, Request who-has 192.168.11.3 tell 192.168.11.33,
> length 28
> 20:12:24.027951 ARP, Request who-has 192.168.11.3 tell 192.168.11.33,
> length 28
> //192.158.11.33 is remoute PC ip-address, and 192.168.11.3 is one of my
> local hosts//
>
> and no APR REPLY.
>
> Intresting that on other hand I have the same configs files on Centos 5.7.
> and everything work perfectly.
>
>
> > no, i removed the commands you mentioned, but it still doesn't work.
> >
> > Best Regards
> > Tang Jianwei
> >
> > On Tue, Sep 27, 2011 at 6:01 PM, Минтаиров Михаил <mikxalich@yandex.ru
> >wrote:
> >
> >> I can't remember a reason, but at one moment I stop to use "openvpn
> >> --mktun --dev [dev name]" command. May be it's becouse openvpn create
> tap0
> >> by it self. So try to comment this lines:
> >>
> >> for t in $tap; do
> >> openvpn --mktun --dev $t
> >> done
> >>
> >> then restart a network, after then start openvpn and after it start
> bridge
> >> script
> >>> openvpn configure file
> >>>
> >>> *port 1194
> >>> proto udp
> >>> dev tap0
> >>> ca ca.crt
> >>> cert VPN_Server.crt
> >>> key VPN_Server.key # This file should be kept secret
> >>> dh dh1024.pem
> >>> server-bridge 192.168.119.1 255.255.255.0 192.168.119.221
> 192.168.119.225
> >>> keepalive 10 120
> >>> comp-lzo
> >>> user nobody
> >>> group nobody
> >>> persist-key
> >>> persist-tun
> >>> status openvpn-status.log
> >>> log-append /var/log/openvpn.log
> >>> verb 3
> >>> mute 20
> >>> *
> >>>
> >>> the script for bring up the bridge
> >>> *# Define Bridge Interface
> >>> br="br0"
> >>>
> >>> # Define list of TAP interfaces to be bridged,
> >>> # for example tap="tap0 tap1 tap2".
> >>> tap="tap0"
> >>>
> >>> # Define physical ethernet interface to be bridged
> >>> # with TAP interface(s) above.
> >>> eth="eth1"
> >>> eth_ip="192.168.119.1"
> >>> eth_netmask="255.255.255.0"
> >>> eth_broadcast="192.168.119.255"
> >>>
> >>> for t in $tap; do
> >>> openvpn --mktun --dev $t
> >>> done
> >>>
> >>> brctl addbr $br
> >>> brctl addif $br $eth
> >>>
> >>> for t in $tap; do
> >>> brctl addif $br $t
> >>> done
> >>>
> >>> for t in $tap; do
> >>> ifconfig $t 0.0.0.0 promisc up
> >>> done
> >>>
> >>> ifconfig $eth 0.0.0.0 promisc up
> >>>
> >>> ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast*
> >>>
> >>> On Tue, Sep 27, 2011 at 5:20 PM, Минтаиров Михаил <
> mikxalich@yandex.ru
> >>> wrote:
> >>>> Hm... It's very hard to guess without config files. Can you post
> your
> >>>> server and client openvpn configs... and also can your show a br0
> >> creation
> >>>> commands?
> >>>>
> >>>> 27.09.2011, 12:01, "�建伟" <myhnet@gmail.com>:
> >>>>> Hi
> >>>>>
> >>>>> no, i don't think so. anyway, i can and only can the vpn server
> from
> >> the
> >>>>> remote hosts.
> >>>>>
> >>>>> Best Regards
> >>>>> Tang Jianwei
> >>>>>
> >>>>> On Tue, Sep 27, 2011 at 3:59 PM, Минтаиров Михаил <
> >> mikxalich@yandex.ru
> >>>>> wrote:
> >>>>>> So, something stop packets from remote hosts. May be firewall on
> >> remote
> >>>>>> PC...? and can you run tcpdump on same remote host, to check that
> >> it's
> >>>> tap0
> >>>>>> device.
> >>>>>>
> >>>>>> 27.09.2011, 11:06, "�建伟" <myhnet@gmail.com>:
> >>>>>>> Hi
> >>>>>>>
> >>>>>>> the routing table in the remote hosts are OK. "tcpdump -n -i
> >> [device
> >>>>>> name]"
> >>>>>>> cannot capture any packages from remote. no mater br0 nor tap0.
> >>>>>>>
> >>>>>>> Best Regards
> >>>>>>> Tang Jianwei
> >>>>>>>
> >>>>>>> On Tue, Sep 27, 2011 at 2:44 PM, Минтаиров Михаил <
> >>>> mikxalich@yandex.ru
> >>>>>>> wrote:
> >>>>>>>> 27.09.2011, 09:52, "�建伟" <myhnet@gmail.com>:
> >>>>>>>>> Hi all,
> >>>>>>>>>
> >>>>>>>>> I just intalled openvpn + bridge in CentOS 6, but i get
> strange
> >>>>>> problems:
> >>>>>>>>> the remote PCs cannot get the local PCs' MACs and also, the
> >> local
> >>>> PCs
> >>>>>>>>> cannot get the remote PCs' MACs
> >>>>>>>>>
> >>>>>>>>> but when i run "brctl showmacs br0" it will list all the
> MACs
> >> and
> >>>>>> also "
> >>>>>>>>> brctl show" will show that all the correct adapters are in
> br0
> >>>>>>>>>
> >>>>>>>>> SELinux disabled
> >>>>>>>>>
> >>>>>>>>> any ideas?
> >>>>>>>> First of all you should check routing table of remote hosts.
> If
> >>>>>> everything
> >>>>>>>> is correct, try to monitor br0, and other devises(ethX) by
> >> "tcpdump
> >>>> -n
> >>>>>> -i
> >>>>>>>> [device name]".
> >>>>>>>> _______________________________________________
> >>>>>>>> CentOS mailing list
> >>>>>>>> CentOS@centos.org
> >>>>>>>> http://lists.centos.org/mailman/listinfo/centos
> >>>>>>> --
> >>>>>>> Tang Jianwei
> >>>>>>> System Administrator
> >>>>>>> _______________________________________________
> >>>>>>> CentOS mailing list
> >>>>>>> CentOS@centos.org
> >>>>>>> http://lists.centos.org/mailman/listinfo/centos
> >>>>>> _______________________________________________
> >>>>>> CentOS mailing list
> >>>>>> CentOS@centos.org
> >>>>>> http://lists.centos.org/mailman/listinfo/centos
> >>>>> --
> >>>>> Tang Jianwei
> >>>>> System Administrator
> >>>>> _______________________________________________
> >>>>> CentOS mailing list
> >>>>> CentOS@centos.org
> >>>>> http://lists.centos.org/mailman/listinfo/centos
> >>>> _______________________________________________
> >>>> CentOS mailing list
> >>>> CentOS@centos.org
> >>>> http://lists.centos.org/mailman/listinfo/centos
> >>> --
> >>> Tang Jianwei
> >>> System Administrator
> >>> _______________________________________________
> >>> CentOS mailing list
> >>> CentOS@centos.org
> >>> http://lists.centos.org/mailman/listinfo/centos
> >> _______________________________________________
> >> CentOS mailing list
> >> CentOS@centos.org
> >> http://lists.centos.org/mailman/listinfo/centos
> > --
> > Tang Jianwei
> > System Administrator
> > _______________________________________________
> > CentOS mailing list
> > CentOS@centos.org
> > http://lists.centos.org/mailman/listinfo/centos
> _______________________________________________
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



--
Tang Jianwei
System Administrator
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos