Howto/Setup Bridged OpenVPN server on Ubuntu 10.04

The desired setup requirements

I want users to be able to access my network remotely as if they were locally. Also, I want client side configuration steps kept to a minimum. Specifically, I want clients to use the "alternative OpenVPN authentication method". Also, I want clients to be able to see all machines on the server's side (this last bit was what cost me a LOT of time to figure out). Last but not least, I do NOT want all traffic being forwarded through the VPN.

My setup

• The following was tested on OpenVPN 2.1 but may work for other version
• I have a standard router that acts as my gateway, located at 192.168.8.1
• My OpenVPN server has one NIC on eth1 and its ip address is 192.168.8.141
• My router is setup to assign ip addresses upon requests via dhcp but my servers have static ips.

The Steps

Using the following as a guide,

https://help.ubuntu.com/10.04/serverguide/C/network-configuration.html#bridging

Step 1) Install openvpn

sudo apt-get install openvpn

Step 2) Install a virtual bridged adapter

Install the necessary package

sudo apt-get install bridge-utils

Modify /etc/network/interfaces

auto lo
iface lo inet loopback

auto br0
iface br0 inet static
        address 192.168.8.141
        network 192.168.8.0
        netmask 255.255.255.0
        broadcast 192.168.8.255
        gateway 192.168.8.1
        bridge_ports eth1
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off

Restart networking

sudo /etc/init.d/networking restart

Step 2: Create the server certificates Follow the directions on the link above.

Step 3: Configure the server Note: Do not create client certificates as we wish to only authenticate with a username and password as per the instructions at http://openvpn.net/index.php/open-source/documentation/howto.html#auth Specifically, start by getting a sample config file

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
sudo gzip -d /etc/openvpn/server.conf.gz

Then modify the server.conf

local 192.168.8.141
dev tap0
;dev tun
server-bridge 192.168.8.141 255.255.255.0 192.168.8.5 192.168.8.99
push "route 192.168.8.0 255.255.255.0"
push "dhcp-option DNS 192.168.8.1"
client-to-client
duplicate-cn
;tls-auth ta.key 0
user nobody
group nogroup
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
client-cert-not-required
username-as-common-name
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
push "ip-win32 dynamic 0 3600"