Intro
Openvpn’s ethernet bridging howto comes with simple setup scripts that you can use to bridge internal interface (e.g. eth0) with virtual one (e.g. tap0). Since standard system tools in PLD do not let you create tap interfaces, you have to care about creating one on your own. Hopefully you can use openvpn’s –mktun command line switch or handy little tool called tunctl to create one.
This has one drawback — you can’t easily use it with standard PLD interface config files (/etc/sysconfig/interfaces/ifcfg-foo). Of course you could set up the interface from rc.local, but things are getting more complicated if you are using vserver on the same machine that is supposed to act as a openvpn server.
The problem is – after you start your vserver guest systems, they have their virtual networking set up and bound to ethX (or whatever device you set them up to). If you’d try to set bridge at this time, you’d run into trouble. Not only this could cause problems with services on host system, but what’s worse – your vserver guest systems would loose network connectivity.
You could try to write your own init script and run it somewhere between networking and vserver. Slightly better, but still not perfect. Luckily, there’s a better approach.
Obiously the scenario I described above only matters if one of your vservers uses ethernet card that you plan to be a part of bridge interface. In case of ethernet bridging, this means at least one of your vserver (as it was in my case) vservers provides service to LAN.
Ethernet bridging with OpenVPN on vserver-enabled host – PLD way
In my configuration, I needed to connect two networks over Internet. I need to bridge them becase of various proprietary stuff that cannot be reconfigured. For the sake of this howto, we will name the gw machines in both locations hq and branch, each of them having two NICs, eth0 (external – internet), and eth1 (internal — lan).
hq eth0: <irrelevant>
hq eth1: 10.0.0.1/8
branch office eth0: <irrelevant>
branch office eth1: 10.0.10.1/8
There are also a few other ip addresses assigned on both hq’s interfaces — these are used by vserver guest systems.
Before we begin, make sure you have all necessary tools:
# poldek -Qiv  bridge-utils openvpn easy-rsa umlinux-tools
What we need is to prepare /etc/sysconfig/interfaces/ifcfg-br0 with slightly modified content:
# ifcfg-br0
TAP=$(tunctl -b -t tap0)
DEVICE=br0
IPADDR1=10.0.0.1/8
ONBOOT=yes
BRIDGE_DEVS="eth1 $TAP"
SPANNING_TREE=no
# eof
Alternatively you could use openvpn binary to set up tap device: „openvpn –mktun –dev tap0″ – it’s up to you. Note that if you choose to use openvpn binary, you will need to
What’s next
Once it is done, you can follow the official ethernet bridging howto – just skip the bridge-start / bridge-stop scripts. Here’s a sample configuration for hq machine (openvpn server):
# hq's openvpn config
local 1.2.3.4 # hq public ip address
port 1194
proto tcp
dev tap0
ca /etc/easy-rsa/keys/ca.crt
cert /etc/easy-rsa/keys/hq.crt
key /etc/easy-rsa/keys/hq.key # This file should be kept secret
dh /etc/easy-rsa/keys/dh1024.pem
server-bridge 10.0.0.1 255.0.0.0 10.0.10.3 10.0.10.100
push "route 10.0.0.0 255.0.0.0"
ifconfig-pool-persist /etc/openvpn/ipp-hq.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-hq-status.log
log /var/log/openvpn-hq-log
verb 5
# eof
You will also need to reconfigure vserver to bind to bridge interface (e.g. br0) — just edit /etc/vservers/$vserver/interface/$num/dev file.