OPNsense Forum

English Forums => Tutorials and FAQs => Topic started by: epoch on August 11, 2017, 12:23:20 pm

Title: How-to: OpenVPN in bridged mode - OPNsense 17.1, 17.7
Post by: epoch on August 11, 2017, 12:23:20 pm
(original thread) (https://forum.opnsense.org/index.php?topic=5575.0)
With 17.7, here is how to setup OpenVPN in bridged mode. In this case this is for a "server", but this works for peer-to-peer mode as well.
I've run it lightly for a few days, I see no issue related to the bridge. As you'd expect DHCP comes across.

First, how not to: make a backup, and have an optional interface active so that you can keep control of the firewall at all times. I managed to lock myself out, and if it wasn't for the awesome backup restore option on the console, I would have had to factory reset my install...

Ok, start:

I would advise rebooting, and then you should have OpenVPN running in bridged mode. The DHCP server operating on the "LAN" interface will take care of connecting clients.
You can override that and have OpenVPN serve DHCP leases himself. I don't like this faux-DHCP featureset much, and I don't think it is faster than the DHCP server built in OPNsense.
If the tunnel is too slow for clients to negotiate a DHCP lease, I'd consider a secondary DHCP server on the remote side, or simply a manual IP config for clients tap interfaces (opnvpn can also "push" these, YMMV according to the OpenVPN client type you're using.)

In the firewall rules you will now have an empty "OPENVPN" tab. If you look at the end of the thread I linked at the top of this post, you'll see admin Franco says the tab is useful. I think it is useless in this case, I just leave it alone empty.

HTH
Title: Re: How-to: OpenVPN in bridged mode - OPNsense 17.1, 17.7
Post by: epoch on April 25, 2018, 02:40:31 pm
FYI, still ok on 18.1.
Title: And now site-to-site static key bridged mode - OPNsense 17.7, 18.1
Post by: epoch on April 25, 2018, 05:09:43 pm
A quick follow-up, here is the recipe for a site-to-site bridged config.
The idea is to let the router on site A manage site B completely, esp. via its DHCP server. This is why none of the special OpenVPN options related to client management are used (IP pool, Bridge settings...)

The motions you'll have to go through will be more accurately described in the FP, but basically this is the workflow for both sites:

Make sure your IP setup does not conflict across sites, you're on a single network.
In this example you just need to configure the DHCP server on site A, but in general using a 172.16/12 or 10/8 network for your sites can make management easier.

Now the OVPN settings for a site-to-site static key setup.
The following setup should work as-is with net.link.bridge.pfil_member=0 and net.link.bridge.pfil_bridge=1 set in System>Settings>Tunables
If you don't set these, you'll need to define filtering rules per bridge member interface. This was not tested, you're on your own.