0

I'm trying to bridge wired devices on a remote network to wired devices on my local network. I've read through a handful of great tutorials by Ingo, specifially on VPNs, wired routing and general networking.

Ideally I would be able to link all wired and wireless devices on both sides (including everything on the external router); something like:

(dhcp remote network)
192.168.188.W 
    ╱           bridge                                     ┌──────────┐    192.168.46.X             bridge
wireless       ┌───────┐                                   │          │      wired                 ┌───────┐      192.168.188.Y  
device <~.~.~.>│(wlan1)│       vpn-tunnel                  │          │      device                │ (eth1)│<──────> wired
               │ (tap0)│════════════════════════╗  ╔═══════╪══════════╪═══════╗╱ ╔═════════════════│(tap0) │         device
wired    eth   │    br0│RPi(eth0)  <─────────> router <───>│ INTERNET │<───> router <─> (eth0) RPi │    br0│
device <──────>│(eth1) │         ╲     eth     ╱       wan │          │ wan  ╱           VPN server│(wlan1)│<.~.~.~.> wireless
    ╲          └───────┘ 192.168.95.X       192.168.95.1   │          │   <public-ip>              └───────┘           device
192.168.188.X            (dhcp local)                      ╰──────────╯  192.168.46.1            192.168.188.1    192.168.188.Z
(dhcp remote network)


[Layout adapted from Ingo's answer in another post]

However, I haven't seen anything indicating I can connect the RPi to an external router via ethernet, and then also use the RPi as a router to other wired devices. Furthermore, I don't necessarily need to connect wireless devices. I really only NEED just the wired devices connected on both ends. I believe something like this would suffice:

                bridge                                   ┌──────────┐                                bridge
               ┌───────┐                                 │          │                               ┌───────┐   192.168.188.Y
               │       │       vpn-tunnel                │          │                               │ (eth1)│<───> wired
               │ (tap0)│══════════════════════╗  ╔═══════╪══════════╪═══════╗  ╔════════════════════│(tap0) │      device
wired    eth   │    br0│RPi(wlan0) <.~.~.~.> router <───>│ INTERNET │<───> router <.~.~.~.> (wlan0) │    br0│
device <──────>│(eth1) │         ╲    wifi     ╱     wan │          │ wan  ╱         wifi     RPi   │       │
    ╲          └───────┘ 192.168.95.X     192.168.95.1   │          │   <public-ip>       VPN server└───────┘
192.168.188.X            (dhcp local)                    ╰──────────╯  192.168.46.1                192.168.188.1
(dhcp remote network)


[Layout adapted from Ingo's answer in another post]

I have two Raspberry Pi 4 devices, one 1GB and one 2GB I'm trying to connect. From the three links above, I cobbled together the following steps and tried to set the VPN server on the 2GB device, running DietPi:

# Install openvpn and helper to speed up getting random numbers for encryption
sudo -Es
apt install openvpn openvpn-systemd-resolved rng-tools

# disable classic networking
systemctl mask networking.service dhcpcd.service
mv /etc/network/interfaces /etc/network/interfaces~
#sed -i '1i resolvconf=NO' /etc/resolvconf.conf
sed -i '1i resolvconf=NO' /etc/resolv.conf

# enable systemd-networkd
systemctl enable systemd-networkd.service systemd-resolved.service
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

# Create static key for encryption
openvpn --genkey --secret /etc/openvpn/static.key

# Copy /etc/openvpn/static.key over to the openvpn device on the other end (client or server) to /etc/openvpn/static.key with same permission (sudo chmod 600 /etc/openvpn/static.key) so you have the same key available on the client and server.

# Set up the VPN-server
cat > /etc/openvpn/server.conf << EOF
dev tap0
mode p2p
secret static.key
cipher AES-256-CBC
EOF

# Create these files to setup the bridge:

# From VPN steps
cat > /etc/systemd/network/02-br0.netdev <<EOF
[NetDev]
Name=br0
Kind=bridge
EOF

# From Wired Router steps
cat > /etc/systemd/network/04-br0_add-eth0.network <<EOF
[Match]
Name=eth0
[Network]
Bridge=br0
EOF

# From General Networking steps
cat > /etc/systemd/network/08-wifi.network <<EOF
[Match]
Name=wlan0
[Network]
## Uncomment only one option block
# Option: using a DHCP server and multicast DNS
#LLMNR=no
#LinkLocalAddressing=no
#MulticastDNS=yes
#DHCP=ipv4
# Option: using link-local ip addresses and multicast DNS
#LLMNR=no
#LinkLocalAddressing=yes
#MulticastDNS=yes
# Option: using static ip address and multicast DNS
# (example, use your settings)
Address=192.168.46.66/24
Gateway=192.168.46.1
DNS=84.200.69.80 1.1.1.1
MulticastDNS=yes
EOF

# From VPN steps
cat > /etc/systemd/network/12-br0_add-slaves.network <<EOF
[Match]
Name=tap0
[Network]
Bridge=br0
EOF

# From VPN steps
cat > /etc/systemd/network/16-br0_up.network <<EOF
[Match]
Name=br0
[Network]
Address=192.168.188.1
# Don't use the next lines if there is already a dhcp server running
DHCPServer=yes
[DHCPServer]
PoolOffset=129
DNS=84.200.69.80 84.200.70.40
EOF

# Configure wpa_supplicant
cat > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf <<EOF
country=US
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
network={
    ssid="ServerExternalRouter"
    psk="verySecretPassword"
}
EOF

chmod 600 /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
systemctl enable wpa_supplicant@wlan0.service

On the VPN client, I was going to try the following steps:

# Check connection to server
ping -c4 <public-ip>
nc -vz -u <public-ip> 1194

# Install openvpn and helper to speed up getting random numbers for encryption
sudo -Es
apt install openvpn openvpn-systemd-resolved rng-tools

# disable classic networking
systemctl mask networking.service dhcpcd.service
mv /etc/network/interfaces /etc/network/interfaces~
sed -i '1i resolvconf=NO' /etc/resolvconf.conf

# enable systemd-networkd
systemctl enable systemd-networkd.service systemd-resolved.service
ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

# Create client configuration file
cat > /etc/openvpn/client.conf <<EOF
dev tap0
mode p2p
remote <public-ip> 1194 udp
secret static.key
cipher AES-256-CBC
EOF

# From Wired Router steps 
cat > /etc/systemd/network/02-br0.netdev <<EOF
[NetDev]
Name=br0
Kind=bridge
EOF

# From Wired Router steps
cat > /etc/systemd/network/04-br0_add-eth0.network <<EOF
[Match]
Name=eth0
[Network]
Bridge=br0
EOF

# From VPN steps
cat > /etc/systemd/network/08-wlan0.network <<EOF
[Match]
Name=wlan0
[Network]
DHCP=yes
[DHCP]
UseRoutes=no
EOF

# From VPN steps
cat > /etc/systemd/network/12-tap0.network <<EOF
[Match]
Name=tap0
[Network]
DHCP=yes
#[DHCP]
#UseRoutes=no
EOF

# Comments above (DHCP and UseRoutes in 08 and 12) reflect routing internet traffic through the VPN

# Configure wpa_supplicant
cat > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf <<EOF
country=US
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
network={
    ssid="ClientExternalRouter"
    psk="verySecretPassword"
}
EOF

chmod 600 /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
systemctl enable wpa_supplicant@wlan0.service

# Reboot

# tap interface has an ip address from the subnet
ip -4 addr show dev tap0

# Bridge client access point to the VPN tunnel

cat > /etc/systemd/network/12-tap0.network <<EOF
[Match]
Name=tap0
[Network]
Bridge=br0
EOF

cat > /etc/systemd/network/16-br0_up.network <<EOF
[Match]
Name=br0
[Link]
MACAddress=22:6f:e8:92:70:04
[Network]
DHCP=yes
#[DHCP]
#UseRoutes=no
EOF

# Reboot

I'm able to ping the public-ip in the first step on the client side. When I try to check if openvpn is reachable on its default UDP port 1194, I do not get a success message. Yes, I also have port forwarding set up to the VPN server.

Any help with this project would be greatly appreciated!

1
  • Not pi specific, you may get better (i.e. accurate) results in unix/linux stack exchange Jun 7 '21 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.