OpenVPN客户端侧桥接配置问题：Client2无法获取DHCP

需求 #

通过OpenVPN VPS服务器，在Client1（Ubuntu Server）侧配置桥接，使Client2从R2获取DHCP。

当前配置 #

1. OpenVPN服务器配置（server.conf） #

mode server
verb 3
key /etc/openvpn/pki/private/key.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/crt.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
client-to-client
key-direction 0
persist-key
persist-tun
proto udp
port 1194
dev tap0
status /tmp/openvpn-status.log
tls-server
user nobody
group nogroup
comp-lzo
float
client-config-dir ccd
ping-timer-rem
ping-restart 60
ping 10

2. Client1配置 #

client
nobind
dev tap
remote-cert-tls server
remote [openvpn public ip] udp
script-security 2
up script/up.sh
resolv-retry infinite
persist-key
persist-tun
verify-x509-name server_H1DlsGlwFlG7k4OE name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
remote-cert-tls server
verb 3

#certificates
...

3. up脚本 #

#!/bin/sh
# the tap interface name is passed as first argument
bridge=br0
brctl addif "$bridge" "$1"
ip link set tap0 up 

4. Client1的Netplan桥接配置 #

network:
  version: 2
  renderer: networkd
  ethernets:
      enp0s3:
          dhcp4: no
  bridges:
      br0:
          dhcp4: yes
          interfaces:
              - enp0s3

5. Client1的iptables规则 #

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

遇到的问题 #

• Client1和Client2连接OpenVPN服务器后，tap接口始终处于down状态且无IP地址。
• 在server.conf中添加server-bridge 192.168.10.10 255.255.255.0 192.168.10.128 192.168.10.254后，Client1与Client2仍无法通信。

解决方案 #

1. 修正OpenVPN服务器配置 #

tap桥接模式下，mode server会和server-bridge冲突，需要移除该指令并调整server-bridge配置，让OpenVPN完全转发DHCP请求到后端R2：

# 移除原有 mode server 行
topology subnet
server-bridge 0.0.0.0 0.0.0.0  # 不启用OpenVPN内置DHCP，转发请求到桥接网络
# 保留其他原有配置项

2. 修复Client1的up脚本 #

不要硬编码tap0，改用传入的接口参数，调整操作顺序（先激活接口再加入桥接）：

#!/bin/sh
bridge=br0
# 激活当前tap接口（参数$1是OpenVPN传入的接口名）
ip link set "$1" up
# 将tap接口添加到桥接
brctl addif "$bridge" "$1"
# 确保桥接接口处于激活状态
ip link set "$bridge" up

给脚本添加执行权限：

chmod +x script/up.sh

3. 调整Client1的Netplan配置 #

开启桥接接口的混杂模式，因为DHCP请求是广播包，需要接口能接收非自身MAC的数据包：

network:
  version: 2
  renderer: networkd
  ethernets:
      enp0s3:
          dhcp4: no
  bridges:
      br0:
          dhcp4: yes
          interfaces:
              - enp0s3
          parameters:
              stp: true
              forward-delay: 4
              promisc: true  # 开启混杂模式

应用配置：

netplan generate
netplan apply

4. 完善网络转发规则 #

开启IP转发并补充iptables规则，确保DHCP包能正常转发：

# 临时开启IP转发
echo 1 > /proc/sys/net/ipv4/ip_forward
# 永久生效
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

# 调整iptables规则
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
# 允许DHCP请求/响应转发
iptables -A FORWARD -i tap0 -p udp --dport 67:68 -j ACCEPT
iptables -A FORWARD -i br0 -p udp --sport 67:68 -j ACCEPT
# 允许桥接与tap接口间的双向转发
iptables -A FORWARD -i br0 -o tap0 -j ACCEPT
iptables -A FORWARD -i tap0 -o br0 -j ACCEPT

5. Client2配置确认 #

确保Client2使用tap设备，不指定静态IP，完全依赖DHCP：

client
nobind
dev tap
remote-cert-tls server
remote [openvpn public ip] udp
script-security 2
resolv-retry infinite
persist-key
persist-tun
verify-x509-name server_H1DlsGlwFlG7k4OE name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
remote-cert-tls server
verb 3

#certificates
...

6. 验证步骤 #

1. 重启OpenVPN服务器：systemctl restart openvpn@server
2. 重启Client1的OpenVPN连接：systemctl restart openvpn@client1
3. 启动Client2的OpenVPN连接，检查tap接口状态：ip link show tap0
4. 查看Client2的IP地址：ip addr show tap0，确认是否从R2获取到DHCP地址
5. 在Client2上ping R2网关，验证连通性

内容的提问来源于stack exchange，提问作者jhoss