I'm trying to set up OpenVPN in bridged mode on Ubuntu Server 12.04. It generally works; I can connect, I get an IP and can ping the OpenVPN server and the default GW, but I can't ping anything else in server's LAN.
Previously I did successfully set up the tunneling with TUN adapter and after adding some iptables entries it worked. I could reach other servers as well. But for various reasons I need TAP.
The OpenVPN server is a standalone machine behind a NAT(router), so it's not the default GW at the same time. It has an IP of 192.168.1.108.
Once I connect with a client I get an IP from the specified range, e.g. 192.168.1.50 and try to ping, e.g. 192.168.1.141 which is another server in that lan, it says host unreachable. The confusing part is, that I CAN ping the OpenVPN server itself at 192.168.1.108 and the GW 192.168.1.1.
When running
tcpdump -nnel -i ethX icmp
On a server while pinging it from the client there is no activity.
Just to mention, when connected to VPN I can browse the internet. When trying to reach the connected client 192.168.1.50 from another server, they can't see it either. Only OpenVPN server can ping clients.
As it is the bridge setup I assume it has nothing to do with routing or iptables or Masquerading. Anyways I tried to enter the usual commands like
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
OR
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE
with changing the eth1 to br0, and tap0 as well, but with no effect. Actually this iptables and route part is difficult to understand for me.
In bridged mode, do I need to have any routing or iptables active to achieve access to all of my servers? Do I need to manually add something like route add default gw 192.168.1.1 dev br0 or anything in that kind to declare a specific route?
How to tell my LAN where to "see" VPN clients?
I quess the problem is, that the openvpn server is not the GW, but I can't put openvpn to my dd-wrt hacked router, it's not supported for my model. How can I set up the openvpn server to work around this problem?
