tinc-vpn.org Git - wiki/blob - examples/simple-bridging-with-dhcp-server-side.mdwn

   1         [[!meta title="simple-bridging-with-dhcp-server-side"]]
   2
   3         # Company:  PowerCraft Technology
   4         # Author:   Copyright Jelle de Jong <jelledejong@powercraft.nl>
   5         # Note:     Please send me an email if you enhanced the document
   6         # Date:     2010-05-24 / 2010-07-04
   7         # License:  CC-BY-SA
   8
   9         # This document is free documentation; you can redistribute it and/or
  10         # modify it under the terms of the Creative Commons Attribution Share
  11         # Alike as published by the Creative Commons Foundation; either version
  12         # 3.0 of the License, or (at your option) any later version.
  13         #
  14         # This document is distributed in the hope that it will be useful,
  15         # but WITHOUT ANY WARRANTY; without even the implied warranty of
  16         # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17         # Creative Commons BY-SA License for more details.
  18         #
  19         # https://creativecommons.org/licenses/by-sa/
  20
  21         #-----------------------------------------------------------------------
  22
  23         # for commercial support contact me, part of the revenue go back to tinc
  24
  25         #-----------------------------------------------------------------------
  26
  27         # https://www.tinc-vpn.org/
  28         # https://www.tinc-vpn.org/examples/bridging
  29         # https://www.tinc-vpn.org/documentation/tinc_toc
  30
  31         #-----------------------------------------------------------------------
  32
  33         # <@guus> Well all the tinc daemons together act like a single switcch
  34         # <@guus> And each node in the VPN is connected to a port of that switch
  35         # <@guus> And if you bridge the VPN interface with eth0, then it's like you plug a cable in a port of your eth0 LAN and the other end of that cable into the tinc switch
  36
  37         #-----------------------------------------------------------------------
  38
  39         unset LANG LANGUAGE LC_ALL
  40         apt-get update; apt-get dist-upgrade
  41
  42         apt-cache show tinc
  43         apt-get install tinc
  44         apt-get install bridge-utils
  45
  46         #-----------------------------------------------------------------------
  47
  48         /etc/init.d/tinc stop
  49
  50         #-----------------------------------------------------------------------
  51
  52         # ls -hal /dev/net/tun
  53         crw-rw-rw- 1 root root 10, 200 May 20 20:07 /dev/net/tun
  54
  55         # grep tinc /etc/services
  56         tinc        655/tcp             # tinc control port
  57         tinc        655/udp
  58
  59         cat /usr/share/doc/tinc/README.Debian
  60         zcat /usr/share/doc/tinc/README.gz | less
  61         zcat /usr/share/doc/tinc/NEWS.gz | less
  62         cat /usr/share/doc/tinc/examples/tinc-up
  63         w3m /usr/share/doc/tinc/tinc_0.html
  64
  65         cat /etc/default/tinc
  66         less /etc/init.d/tinc
  67
  68         #-----------------------------------------------------------------------
  69
  70         vim /etc/default/tinc
  71         EXTRA="-d"
  72         cat /etc/default/tinc
  73
  74         #-----------------------------------------------------------------------
  75
  76         cat /etc/tinc/nets.boot
  77         echo 'powercraft01' | tee --append /etc/tinc/nets.boot
  78         cat /etc/tinc/nets.boot
  79
  80         #-----------------------------------------------------------------------
  81
  82         ls -hal /etc/tinc/scallab01/
  83         mkdir --verbose /etc/tinc/powercraft01/
  84         mkdir --verbose /etc/tinc/powercraft01/hosts/
  85         touch /etc/tinc/powercraft01/tinc.conf
  86
  87         #-----------------------------------------------------------------------
  88
  89         vim /etc/network/interfaces
  90
  91         # tinc-vpn: dhcp bridge
  92         auto br0
  93           iface br0 inet static
  94           address 192.168.3.1
  95           netmask 255.255.255.0
  96         # pre-up /sbin/ifconfig eth2 hw ether 00:1b:21:61:af:d7
  97         # pre-up /sbin/ifconfig eth2 0.0.0.0
  98         # bridge_ports eth2
  99           bridge_ports tun1
 100           bridge_maxwait 1
 101           bridge_fd 2.5
 102           post-up /bin/echo 1 > /proc/sys/net/ipv4/conf/br0/proxy_arp # optional
 103
 104         cat /etc/network/interfaces
 105
 106         #-----------------------------------------------------------------------
 107
 108         echo 'interface "br0" {
 109           request subnet-mask, broadcast-address, time-offset,
 110             host-name, netbios-scope, interface-mtu, ntp-servers;
 111         }' | tee --append /etc/dhcp3/dhclient.conf
 112
 113         cat /etc/dhcp3/dhclient.conf
 114
 115         #-----------------------------------------------------------------------
 116
 117         vim /etc/dhcp3/dhcpd.conf
 118
 119         subnet 192.168.3.0 netmask 255.255.255.0 {
 120             range 192.168.3.200 192.168.3.240;
 121             option routers 192.168.3.1;
 122             option domain-name-servers 192.168.3.1;
 123         }
 124
 125         #-----------------------------------------------------------------------
 126
 127         ifdown br0
 128         ifup br0
 129
 130         #-----------------------------------------------------------------------
 131
 132         vim /etc/default/dhcp3-server
 133             INTERFACES="vlan2 eth0 br0" # add the br0 to the correct location
 134
 135         /etc/init.d/dhcp3-server restart
 136         ps aux | grep dhcp
 137         tail -n 400 -f /var/log/syslog
 138
 139         #-----------------------------------------------------------------------
 140
 141         ifconfig br0
 142         route -n
 143         brctl show
 144
 145         #-----------------------------------------------------------------------
 146
 147         # ifconfig br0
 148         br0       Link encap:Ethernet  HWaddr 00:00:00:00:00:00
 149                   inet addr:192.168.3.1  Bcast:192.168.3.255  Mask:255.255.255.0
 150                   inet6 addr: fe80::dc56:d3ff:fe1a:31df/64 Scope:Link
 151                   UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
 152                   RX packets:12 errors:0 dropped:0 overruns:0 frame:0
 153                   TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
 154                   collisions:0 txqueuelen:0
 155                   RX bytes:2568 (2.5 KB)  TX bytes:1536 (1.5 KB)
 156
 157         # route -n
 158         Kernel IP routing table
 159         Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
 160         192.168.3.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
 161         192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 vlan2
 162         192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
 163         84.245.3.0      0.0.0.0         255.255.255.0   U     0      0        0 eth1
 164         0.0.0.0         84.245.3.1      0.0.0.0         UG    100    0        0 eth1
 165
 166         # brctl show
 167         bridge name bridge id       STP enabled interfaces
 168         br0     8000.000000000000   no
 169
 170         #-----------------------------------------------------------------------
 171
 172         echo 'AddressFamily = ipv4
 173         Device = /dev/net/tun
 174         Interface = tun1
 175         Mode = switch
 176         Name = server01' | tee /etc/tinc/powercraft01/tinc.conf
 177
 178         cat /etc/tinc/powercraft01/tinc.conf
 179         chmod 640 /etc/tinc/powercraft01/tinc.conf
 180         ls -hal /etc/tinc/powercraft01/tinc.conf
 181
 182         echo '#!/bin/sh
 183         ifconfig $INTERFACE 0.0.0.0
 184         route add -net 192.168.30.0 netmask 255.255.255.0 br0 # optional subnet
 185         brctl addif br0 $INTERFACE' | tee /etc/tinc/powercraft01/tinc-up
 186
 187         cat /etc/tinc/powercraft01/tinc-up
 188         chmod 750 /etc/tinc/powercraft01/tinc-up
 189         ls -hal /etc/tinc/powercraft01/tinc-up
 190
 191         echo '#!/bin/sh
 192         brctl delif br0 $INTERFACE
 193         route del -net 192.168.30.0 netmask 255.255.255.0 br0 # optional subnet
 194         ifconfig $INTERFACE down' | tee /etc/tinc/powercraft01/tinc-down
 195
 196         cat /etc/tinc/powercraft01/tinc-down
 197         chmod 750 /etc/tinc/powercraft01/tinc-down
 198         ls -hal /etc/tinc/powercraft01/tinc-down
 199
 200         #-----------------------------------------------------------------------
 201
 202         rm /etc/tinc/powercraft01/rsa_key.priv
 203         rm /etc/tinc/powercraft01/hosts/server01
 204         tincd -n powercraft01 -K
 205
 206         #-----------------------------------------------------------------------
 207
 208         getent services | grep 656
 209
 210         #-----------------------------------------------------------------------
 211
 212         vim /etc/tinc/powercraft01/hosts/server01
 213
 214         # add on head of file
 215         Compression = 9
 216         PMTU = 1492
 217         PMTUDiscovery = yes
 218         Port = 656
 219
 220         cat /etc/tinc/powercraft01/hosts/server01
 221
 222         #-----------------------------------------------------------------------
 223
 224         /etc/init.d/tinc stop
 225         fg
 226         /usr/sbin/tincd --net powercraft01 --no-detach --debug=5
 227
 228         #-----------------------------------------------------------------------
 229
 230         /etc/init.d/tinc restart
 231         tail --line=500 --follow /var/log/syslog
 232
 233         #-----------------------------------------------------------------------
 234
 235         ifconfig br0
 236         ifconfig tun1
 237         route -n
 238         brctl show br0
 239         brctl showmacs br0
 240
 241         #-----------------------------------------------------------------------
 242
 243         # ifconfig br0
 244         br0       Link encap:Ethernet  HWaddr 1e:eb:95:c3:04:d8
 245                   inet addr:192.168.3.1  Bcast:192.168.3.255  Mask:255.255.255.0
 246                   inet6 addr: fe80::dc56:d3ff:fe1a:31df/64 Scope:Link
 247                   UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
 248                   RX packets:17 errors:0 dropped:0 overruns:0 frame:0
 249                   TX packets:20 errors:0 dropped:0 overruns:0 carrier:0
 250                   collisions:0 txqueuelen:0
 251                   RX bytes:3328 (3.3 KB)  TX bytes:2408 (2.4 KB)
 252
 253         # ifconfig tun1
 254         tun1      Link encap:Ethernet  HWaddr 1e:eb:95:c3:04:d8
 255                   inet6 addr: fe80::1ceb:95ff:fec3:4d8/64 Scope:Link
 256                   UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
 257                   RX packets:8 errors:0 dropped:0 overruns:0 frame:0
 258                   TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
 259                   collisions:0 txqueuelen:500
 260                   RX bytes:2627 (2.6 KB)  TX bytes:1340 (1.3 KB)
 261
 262         # route -n
 263         Kernel IP routing table
 264         Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
 265         192.168.3.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
 266         192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 vlan2
 267         192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
 268         84.245.3.0      0.0.0.0         255.255.255.0   U     0      0        0 eth1
 269         0.0.0.0         84.245.3.1      0.0.0.0         UG    100    0        0 eth1
 270
 271         # brctl show br0
 272         bridge name bridge id       STP enabled interfaces
 273         br0     8000.1eeb95c304d8   no      tun1
 274
 275         # brctl showmacs br0
 276         port no mac addr        is local?   ageing timer
 277           1 1e:eb:95:c3:04:d8   yes        0.00
 278           1 86:03:27:21:2e:60   no        44.19
 279
 280         #-----------------------------------------------------------------------
 281
 282         ps aux | grep tincd
 283         tincd -n powercraft01 -kUSR2
 284         tail -n 100 /var/log/syslog
 285
 286         #-----------------------------------------------------------------------
 287
 288         May 24 17:29:31 ashley tinc.powercraft01[11557]: Statistics for Linux tun/tap device (tap mode) /dev/net/tun:
 289         May 24 17:29:31 ashley tinc.powercraft01[11557]:  total bytes in:         468
 290         May 24 17:29:31 ashley tinc.powercraft01[11557]:  total bytes out:          0
 291         May 24 17:29:31 ashley tinc.powercraft01[11557]: Nodes:
 292         May 24 17:29:31 ashley tinc.powercraft01[11557]:  server01 at MYSELF cipher 0 digest 0 maclength 0 compression 0 options 4 status 0018 nexthop server01 via server01 pmtu 1518 (min 0 max 1518)
 293         May 24 17:29:31 ashley tinc.powercraft01[11557]: End of nodes.
 294         May 24 17:29:31 ashley tinc.powercraft01[11557]: Edges:
 295         May 24 17:29:31 ashley tinc.powercraft01[11557]: End of edges.
 296         May 24 17:29:31 ashley tinc.powercraft01[11557]: Subnet list:
 297         May 24 17:29:31 ashley tinc.powercraft01[11557]:  a2:63:0:96:a:c8#10 owner server01
 298         May 24 17:29:31 ashley tinc.powercraft01[11557]: End of subnet list.
 299
 300         #-----------------------------------------------------------------------
 301
 302         tcpdump -n -i br0 broadcast
 303         tcpdump -n -i tun0 broadcast
 304
 305         #-----------------------------------------------------------------------
 306
 307         tcpdump -n -e -i br0 icmp
 308         tcpdump -A -p -n -i br0 port 80
 309         tcpdump -A -p -n -i br0
 310
 311         tcpdump -i br0 host 84.245.3.195 -l
 312
 313         #-----------------------------------------------------------------------
 314
 315         cat /var/lib/dhcp3/dhcpd.leases
 316
 317         #-----------------------------------------------------------------------
 318
 319         # optional
 320         export LAN01=vlan2
 321         export VPN02=br0
 322         # /sbin/iptables --append FORWARD --in-interface br0 --out-interface vlan2 --jump ACCEPT
 323         /sbin/iptables --append FORWARD --in-interface ${VPN02} --source 192.168.3.150 --destination 192.168.2.206 --out-interface ${LAN01} --jump ACCEPT
 324
 325         #-----------------------------------------------------------------------