Questions[tap](server)

I'm trying to create a bridge whose interface is a tap, both with static IPs, and have them persist across reboots.

In Ubuntu 14.04.6 LTS, this could be accomplished by editing /etc/network/interfaces as such:

auto br0
iface br0 inet static
    address 0.0.0.0
    bridge_ports tap0

auto tap0
iface tap0 inet static
    address 0.0.0.0
    pre-up /usr/sbin/tunctl -t tap0

and running

brctl addbr br0
tunctl -t tap0
brctl addif br0 tap0

on the command line.

Then, when you run bridge link you get the following output:

4: tap0 state UP : <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 master br0 state
forwarding priority 32 cost 100 

But since Ubuntu 20.04 has deprecated the use of /etc/network/interfaces in favor of netplan, I don't know how to set it up.

I've tried setting /etc/netplan/00-installer-config.yml to the following:

...
bridges:
  br0:
    addresses: [0.0.0.0/24]
    gateway4: 10.0.2.15
    nameservers:
      addresses: [8.8.8.8]

and running netplan apply followed by

ip tuntap add mode tap tap0
ip link tap0 master br0

I've tried running

ip link add name br0 type bridge
ip link set dev br0 up
ip tuntap add mode tpa tap0
ip link set tap0 master br0

I've even tried adding tap0 as an ethernet interface in /etc/netplan/00-installer-config.yaml, but no matter what I do, when I run bridge link

I get

4: tap0: <BROADCAST,MULTICAST> mtu 1500 master br0 state disabled priority 32 cost 100 

How can I get this configured correctly? I've tried everything I've seen online, and no matter what I do I can't get the tap to go from state disabled to state forwarding. I'm open to any ideas someone might have. I don't have experience with this type of thing so I'm really at a loss for what the issue even is. Please help

Edit:

I believe the tap is to setup OpenVPN with TAP bridging. OpenVPN uses a tap called tap0 when setup in TAP mode. I'm new to this codebase, and to working with servers/networking in general, and am only working on setting up the server, so to be completely honest don't know exactly if there's something else going on.

I did a tunnel system with OpenVPN to let a distant client act like a private network client to access private resources. It uses a client on the private network as a gateway.

DistantClient <-> OpenVPN server <-> PrivateNetworkClient

It works with a TAP tunnel, but TAP doesn't work with Android, is there a way to get the same thing with TUN ?

Actual configurations:

Distant client

OpenVPN client configuration file

client
dev tap
proto udp
remote XX.XX.XX.XX 1234

cipher AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256

resolv-retry infinite
compress lz4
nobind
persist-key
persist-tun
mute-replay-warnings
verb 3
<ca>[...]</ca>
<key>[...]</key>
<cert>[...]</cert>

# private networks resolutions, 10.11.0.3 is the gateway-client IP on OpenVPN server
route 20.42.0.0 255.255.255.0 10.11.0.3
route 21.16.10.0 255.255.255.0 10.11.0.3

Gateway client

net.ipv4.ip_forward=1 enabled

IPTables rules

-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.11.0.0/24 -d 21.16.10.0/24 -i tap0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.11.0.0/24 -d 20.42.0.0/24 -i tap0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
*nat
-A POSTROUTING -o eth0 -j MASQUERADE

OpenVPN client configuration file

client
dev tap
proto udp
remote XX.XX.XX.XX 1234

cipher AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
resolv-retry infinite
compress lz4
nobind
persist-key
persist-tun
mute-replay-warnings
verb 3
<ca>[...]</ca>
<key>[...]</key>
<cert>[...]</cert>

# Private forward
route 21.16.10.0 255.255.255.0 20.42.0.1

Server

net.ipv4.ip_forward=1 enabled

IPTables rules

*filter
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-track-forward -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 1234 -j ACCEPT
*nat
-A POSTROUTING -s 10.0.0.0/8 -o enp1s0 -j MASQUERADE

OpenVPN server configuration file

port 1234
proto udp
dev tap

ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/work-server.crt
key /etc/openvpn/server/work-server.key
dh /etc/openvpn/server/dh.pem
crl-verify /etc/openvpn/server/crl.pem

server 10.11.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"

cipher AES-256-CBC
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
auth SHA512
auth-nocache
keepalive 20 60
persist-key
persist-tun
compress lz4
daemon
user nobody
group nogroup
explicit-exit-notify 1
push "explicit-exit-notify 1"
log-append /var/log/openvpn.log
verb 3

ifconfig-pool-persist /etc/openvpn/ipp.txt
client-to-client

I have setup a linux box (on an esxi5) which acts as an OpenVPN server. the server is configured to use bridging for the clients, which essentially works, with one exception.

If the client pings some machine on the network which is not the server itself it does not work. I ruled out everything I know of (iptables, etc) and running tcpdump boiled it down to the following things:

• I see ARP requests on tap0 and br0
• I see the ARP replies on br0
• I do NOT see the ARP replies on tap0

Question: why does the br0 device not forward ARP replies to the tap0 device?

I have a program which writes packets (destination address 10.3.0.2) to the TUN/TAP interface.

Network:

host1|tun0----eth1(10.3.0.1)|-------------------host2|eth1(10.3.0.2)|

Wireshark captures these packets from interface tun0 but they are not forwarded to interface eth1.

Commands:

sysctl -w net.ipv4.ip_forward=1
sysctl -p

iptables -A INPUT -i tun+ -j ACCEPT

iptables -A FORWARD -i tun+ -j ACCEPT

iptables -A INPUT -i tap+ -j ACCEPT

iptables -A FORWARD -i tap+ -j ACCEPT

/etc/init.d/networking restart

/etc/init.d/openvpn restart

I've managed to setup OpenVPN for full IPv4 connectivity using tap0. Now I want to do the same for IPv6.

Addresses and network setup (note that my real prefix is replaced by 2001:db8):

2001:db8::100:0:0/96    my assigned IPv6 range
2001:db8::100:abc:0/112 OpenVPN IPv6 range
2001:db8::100:abc:1     tap0 (on server) (set as gateway on client)
2001:db8::100:abc:2     tap0 (on client)
2001:db8::1:2:3:4       gateway for server

 Home laptop   (tap0: 2001:db8::100:abc:2/112 gateway 2001:db8::100:abc:1/112)
  |      | |      (running Kubuntu 10.10; OpenVPN 2.1.0-3ubuntu1)
  | wifi | |
   router  |
      |   OpenVPN
  INTERNET |
eth0  |   /tap0
     VPS        (eth0:2001:db8::1:2:3:4/64    gateway 2001:db8::1)
               (tap0: 2001:db8::100:abc:1/112)
                  (running Debian 6; OpenVPN 2.1.3-2)

The server has both native IPv4 and IPv6 connectivity, the client has only IPv4.

I can ping6 to and from my server over OpenVPN, but not to other machines (for example, ipv6.google.com).

net.ipv6.conf.all.forwarding is set to 1, I've tried disabling net.ipv6.conf.all.accept_ra as well, without luck.

Using tcpdump on both the server and client, I can see that packets are actually transferred over tap0 to eth0. The router (2001:db8::1) send a neighbor solicitation for the client (2001:db8::100:abc:2) to eth0 after it receives the ICMP6 echo-request. The server does not respond to that solicitation, which causes the ICMP6 echo-request not be routed to the destination.

How can I make this IPv6 connection work?