# Bridging lagg0 wth tap0 (OpenVPN)



## jmj75 (Jul 23, 2012)

I am having a problem trying to bridge a lagg0 interface with a tap0 interface (for OpenVPN). The primary issue is that traffic on the server (and the LAN) can't see any of the openvpn hosts, e.g., I can't ping or connect to vpn clients.  However, clients can connect to the server and I can reach the server/LAN side from the client side.  

On the other hand if I don't use link aggregation then the server works as expected.  Bridging a NIC (vr0) interface with tap0 results in traffic correctly routed to the bridge to clients from the LAN.    

Any comments on what I may be missing in order to have a working lagg0 and tap0 bridge under FreeBSD?  

FYI, there are no pf rules on the server and in both cases I have:

net.link.tap.debug=0
net.link.tap.devfs_cloning=1
net.link.tap.up_on_open=1
net.link.tap.user_open=1
 

Here is my non-working bridged lagg0 rc.conf:


```
### NETWORK
########################################
gateway_enable="YES"
ipv6_activate_all_interfaces=YES
ipv6_gateway_enable=YES

### LAGG
########################################
ifconfig_vr0="up"
ifconfig_vr1="up"
ifconfig_lagg0="laggproto lacp laggport vr0 laggport vr1 10.0.1.250/24"
defaultrouter="10.0.1.254"

### OPENVPN
########################################
openvpn_if="tap bridge"
openvpn_enable="YES"
openvpn_dir="/etc/openvpn"
openvpn_configfile="/etc/openvpn/server.conf"
openvpn_flags="--script-security 2"


### BRIDGE
########################################
cloned_interfaces="lagg0 bridge0 tap0"
ifconfig_bridge0="addm lagg0 addm tap0"
```

Along with,
`# netstat -rn`

```
Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            10.0.1.254         UGS         0     1215  lagg0
10.0.1.0/24        link#10            U           0      732  lagg0
10.0.1.250         link#10            UHS         0        0    lo0
127.0.0.1          link#9             UH          0        0    lo0

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::/96                             ::1                           UGRS        lo0
::1                               ::1                           UH          lo0
::ffff:0.0.0.0/96                 ::1                           UGRS        lo0
fe80::/10                         ::1                           UGRS        lo0
fe80::%vr0/64                     link#1                        U           vr0
fe80::20d:b9ff:fe21:54e0%vr0      link#1                        UHS         lo0
fe80::%vr1/64                     link#2                        U           vr1
fe80::20d:b9ff:fe21:54e1%vr1      link#2                        UHS         lo0
fe80::%lo0/64                     link#9                        U           lo0
fe80::1%lo0                       link#9                        UHS         lo0
fe80::%lagg0/64                   link#10                       U         lagg0
fe80::20d:b9ff:fe21:54e0%lagg0    link#10                       UHS         lo0
ff01::%vr0/32                     fe80::20d:b9ff:fe21:54e0%vr0  U           vr0
ff01::%vr1/32                     fe80::20d:b9ff:fe21:54e1%vr1  U           vr1
ff01::%lo0/32                     ::1                           U           lo0
ff01::%lagg0/32                   fe80::20d:b9ff:fe21:54e0%lagg0 U         lagg0
ff02::/16                         ::1                           UGRS        lo0
ff02::%vr0/32                     fe80::20d:b9ff:fe21:54e0%vr0  U           vr0
ff02::%vr1/32                     fe80::20d:b9ff:fe21:54e1%vr1  U           vr1
ff02::%lo0/32                     ::1                           U           lo0
ff02::%lagg0/32                   fe80::20d:b9ff:fe21:54e0%lagg0 U         lagg0
```
Here is the working rc.conf:

```
### NETWORK
########################################
hostname=vpn
gateway_enable="YES"
ipv6_activate_all_interfaces=YES
ipv6_gateway_enable=YES

### LAGG 
########################################
ifconfig_vr0="inet 10.0.1.250 netmask 255.255.255.0 up"
defaultrouter="10.0.1.254"

### OPENVPN
########################################
openvpn_if="tap bridge"
openvpn_enable="YES"
openvpn_dir="/etc/openvpn"
openvpn_configfile="/etc/openvpn/server.conf"
openvpn_flags="--script-security 2" 


### BRIDGE
########################################
cloned_interfaces="bridge0 tap0"
ifconfig_bridge0="addm vr0 addm tap0"
```

`# netstat -rn`:


```
Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            10.0.1.254         UGS         0     2647    vr0
10.0.1.0/24        link#1             U           0      737    vr0
10.0.1.250         link#1             UHS         0        0    lo0
10.0.1.251         link#2             UHS         0        0    lo0
127.0.0.1          link#9             UH          0        0    lo0

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::/96                             ::1                           UGRS        lo0
::1                               ::1                           UH          lo0
::ffff:0.0.0.0/96                 ::1                           UGRS        lo0
fe80::/10                         ::1                           UGRS        lo0
fe80::%vr0/64                     link#1                        U           vr0
fe80::20d:b9ff:fe21:54e0%vr0      link#1                        UHS         lo0
fe80::%vr1/64                     link#2                        U           vr1
fe80::20d:b9ff:fe21:54e1%vr1      link#2                        UHS         lo0
fe80::%lo0/64                     link#9                        U           lo0
fe80::1%lo0                       link#9                        UHS         lo0
ff01::%vr0/32                     fe80::20d:b9ff:fe21:54e0%vr0  U           vr0
ff01::%vr1/32                     fe80::20d:b9ff:fe21:54e1%vr1  U           vr1
ff01::%lo0/32                     ::1                           U           lo0
ff02::/16                         ::1                           UGRS        lo0
ff02::%vr0/32                     fe80::20d:b9ff:fe21:54e0%vr0  U           vr0
ff02::%vr1/32                     fe80::20d:b9ff:fe21:54e1%vr1  U           vr1
ff02::%lo0/32                     ::1                           U           lo0
```


----------



## sol289 (Aug 22, 2012)

I think you have the same problem that i had with carp on bridge interface (link to topic), read my update there. Long story short, it's fixed in HEAD.


----------



## darkshadow (Aug 22, 2012)

*check this*

You should use NAT over tap so response from other PCs reach you local network (if tap have different  subnet) .

I have running OpenVPN over tun0 with bridge of two interfaces, Please try this script after Login(unless you have same sub net for tap device) :-



```
#!/bin/sh
natd -interface tap0
ipfw -f flush
ipfw add divert natd ip from any to any via tun0
ipfw add pass all from any to any
sysctl -w net.inet.ip.forwarding=1
```

*don't use nat on rc.conf, since it seem that NAT loaded before OpenVPN runs


----------



## darkshadow (Aug 22, 2012)

Please replace tun0 with tap0, this only works if you have different subnet for tap device


----------



## tsarya (Nov 4, 2016)

Hi,

this thread is quite old, but I decided to ask for help here instead of starting a new one.
The OS version is FreeBSD 11-RELEASE. The machine is a HP Microserver G8 with 2 Broadcom NICs -> bge0 and bge1, the switch is TP-LINK TL-SG108E
I want to have a failover lagg interface bridged with tap0 for OpenVPN.

The config I tested unsuccessfully is, only showing the relevant part from the files:
/boot/loader.conf

```
if_bridge_load="YES"
bridgestp_load="YES"
if_tap_load="YES"
if_lagg_load="YES"
```
/etc/rc.conf

```
# Network Configuration
ifconfig_bge0="up"
ifconfig_bge1="up"
ifconfig_lagg0="laggproto failover laggport bge0 laggport bge1 192.168.200.250/24"
defaultrouter="192.168.200.1"
cloned_interfaces="lagg0 bridge0 tap0"
ifconfig_bridge0="addm lagg0 addm tap0"
# OpenVPN
openvpn_enable="YES"
```
/etc/sysctl.conf

```
net.link.tap.up_on_open=1
```
I cannot ping anything but the IP address of the lagg0 (192.168.200.250) interface and lo0...

When I remove the tap0 and bridge0, lagg0 works perfectly.

Any suggestions please?

P.S. OpenVPN works ok when configured to use tap0 bridged with one of the cards, e.g. bge0.


----------

