Networking – Using ARP protocol with OpenVPN routed (TUN) tunnel

arphome-networkingopenvpntomatotunnel

I've configured network shown in the following diagram:

ROT1 is Tomato-based router. It has BR0 bridged network interface for all the clients within internal network with subnet 192.168.1.0/24. One of the clients is a NAS device (NAS01) which provides some basic services like ownCloud and SMB server. Both LAP01 and MOB01 clients are able to see NAS01 and use its services. ROT1 has also two VPNs configured: TAP0 is an OpenVPN bridged tunnel which is bridged with BR0, that's why client LAP04 receives IP address from DHCP server within subnet 192.168.1.0/24. This client is also able to ping NAS01 device within internal subnet. Router ROT01 is running arpwake program to automatically wake up NAS01 with Magic Packet when the host is requested by some other client in the network with ARP request (who-has). You can find the description of the application and links for its source code here. arpwake application is listening on BR0 for ARP request containing MAC address of NAS01 and automatically sends Magic Packet if one of the clients within the network asks for it.
The problem is that I'm trying to set up routed VPN tunnel also with OpenVPN that will allow me to use arpwake application in order to automatically wake NAS01 when one of the clients from TUN0 network will ask for it. If NAS01 is up I can ping it and use all the services, but if it's down I cannot wake it up with arpwake application, because there are no ARP requests on that interface (TUN0) – I've already checked that with tcpdump on the router. I've also tried to use Proxy ARP with command echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp but still it doesn't work.

Here's the configuration of the router:

Routes

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.200.2   *               255.255.255.255 UH    0      0        0 tun0
192.168.0.1     *               255.255.255.255 UH    0      0        0 vlan2
192.168.200.0   192.168.200.2   255.255.255.0   UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
192.168.0.0     *               255.255.255.0   U     0      0        0 vlan2
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         192.168.0.1     0.0.0.0         UG    0      0        0 vlan2

iptables (output of iptables-save concerning only TUN0)

# Generated by iptables-save v1.3.8 on Sun Aug 28 12:08:23 2016
*nat
:PREROUTING ACCEPT [50195:5904352]
:POSTROUTING ACCEPT [409:28145]
:OUTPUT ACCEPT [4413:306096]
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
# Completed on Sun Aug 28 12:08:23 2016
# Generated by iptables-save v1.3.8 on Sun Aug 28 12:08:23 2016
*mangle
:PREROUTING ACCEPT [1628436:1350223724]
:INPUT ACCEPT [43707:3160699]
:FORWARD ACCEPT [1563428:1344198921]
:OUTPUT ACCEPT [13790:1556262]
:POSTROUTING ACCEPT [1576178:1345632445]
COMMIT
# Completed on Sun Aug 28 12:08:23 2016
# Generated by iptables-save v1.3.8 on Sun Aug 28 12:08:23 2016
*filter
:INPUT DROP [10689:641141]
:FORWARD ACCEPT [19:1151]
:OUTPUT ACCEPT [13539:1531250]
-A INPUT -i tun0 -j ACCEPT
COMMIT
# Completed on Sun Aug 28 12:08:23 2016

TUN0 OpenVPN config (security related options removed)

local [IP_address]
port [PORT]
proto udp
dev tun
server 192.168.200.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
push "dhcp-option DNS 192.168.1.1"

ifconfig for TUN0 interface (by default OpenVPN brings this interface up with NOARP option, but even if I turn this back on with command ifconfig tun0 arp it does not solve my problem).

tun0       Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
           inet addr:192.168.200.1  P-t-P:192.168.200.2  Mask:255.255.255.255
           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
           RX packets:311 errors:0 dropped:0 overruns:0 frame:0
           TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:100
           RX bytes:21166 (20.6 KiB)  TX bytes:3486 (3.4 KiB)

My question is: how to make this TUN0 interface to start working with ARP?

Best Answer

Non-IP traffic is not forwarded over Layer-3 (tun) interfaces, that's the whole beauty of it: you save on broadcast traffic and on ethernet headers. You can read about all of this on the OpenVPN wiki.

I am not sure I understand how arpwake works, the Web page you linked to is more of a ramble than a wiki. But you may try adding this firewall rule,

 iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

This rewrites all source IP addresses, in the packet headers, with the router IP address. I do not know whether this will trigger arpwake, but you may try.

EDIT:

I have thought of a workaround, which does not use arpwake. Add the following iptables rule,

iptables -A INPUT -i tun0  -s xxx.xxx.xxx.xxx/24 -d 192.168.1.4/32 -m state --state NEW -m state ! --state ESTABLISHED -j LOG --log-prefix "NEW_CONN_ATTEMPT"

where xxx.xxx.xxx.xxx/24 is VPN tunnel's network. Now setup an executable script, running under sudo, with the following content:

tail -f /var/log/firewall.log | awk '/NEW_CONN_ATTEMPT/ {system("/usr/local/bin/myscript")}'

where /usr/local/bin/myscript is a script that sends the magic packet to the NAS. It should work.

Background

In my /var/log/daemon.log I found the following entry after enabling openvpn:

Jan 13 22:40:19 raspberrypi ifplugd(tun0)[28971]: Executing '/etc/ifplugd/ifplugd.action tun0 up'.

which was followd by

Jan 13 22:40:19 raspberrypi wpa_supplicant[3177]: wlan0: CTRL-EVENT-DISCONNECTED bssid=00:00:00:00:00:00 reason=0
...
Jan 13 22:40:20 raspberrypi ifplugd(wlan0)[3108]: Link beat lost.
...
Jan 13 22:40:30 raspberrypi ifplugd(wlan0)[3108]: Executing '/etc/ifplugd/ifplugd.action wlan0 down'.
Jan 13 22:40:30 raspberrypi ifplugd(wlan0)[3108]: client: /sbin/ifdown: interface wlan0 not configured
Jan 13 22:40:30 raspberrypi ifplugd(wlan0)[3108]: Program executed successfully.

So it had to be somewhat related to the creation of the new network device.
Analyzing /etc/ifplugd/ifplugd.action tun0 up returned, that /etc/ifplugd/action.d/action_wpa is executed.

/etc/ifplugd/action.d/action_wpa

#!/bin/sh

# Action script to enable/disable wpa-roam interfaces in reaction to
# ifplugd events.
#
# Copyright: Copyright (c) 2008-2010, Kel Modderman <kel@otaku42.de>
# License:   GPL-2
#

PATH=/sbin:/usr/sbin:/bin:/usr/bin

if [ ! -x /sbin/wpa_action ]; then
    exit 0
fi

# ifplugd(8) - <iface> <action>
#
# If an ifplugd managed interface is brought up, disconnect any
# wpa-roam managed interfaces so that only one "roaming" interface
# remains active on the system.

IFPLUGD_IFACE="${1}"

case "${2}" in
    up)
        COMMAND=disconnect
        ;;
    down)
        COMMAND=reconnect
        ;;
    *)
        echo "$0: unknown arguments: ${@}" >&2
        exit 1
        ;;
esac

for CTRL in /var/run/wpa_supplicant/*; do
    [ -S "${CTRL}" ] || continue

    IFACE="${CTRL#/var/run/wpa_supplicant/}"

    # skip if ifplugd is managing this interface
    if [ "${IFPLUGD_IFACE}" = "${IFACE}" ]; then
        continue
    fi

    if wpa_action "${IFACE}" check; then
        wpa_cli -i "${IFACE}" "${COMMAND}"
    fi
done

So in order to save maybe roaming-costs all roaming devices are deactivated, if an other network device is available. May it be a real device or just virtual.

I only had access to the pi over ssh over wifi. Killed remotely and had to wait to come back home for hard reboot ;-)

Possible other way

An other way could be, to configure the tun0 device in /etc/network/interfaces so that it doesn't call /etc/ifplugd/action.d/action_wpa. That way roaming would still work.

Ubuntu – How to fix certificates verification creating a VPN (OpenVPN)

In your error message:

error=unable to get local issuer certificate:

This message means these lines in your client configuration are pointing to the wrong files:

cert client1.crt
key client1.key

In your building the client keys, you said:

/etc/openvpn/easy-rsa/keys/cliente.crt

You need to update the client configuration to match the names of the .crt and .key file actually generated

Best Answer

Related Solutions

Debian eth0 to wlan0 forwarding, with openvpn

Background

Possible other way

Ubuntu – How to fix certificates verification creating a VPN (OpenVPN)

Related Question