| 1 | = I want to set up an ethernet bridge on the 192.168.1.0/24 subnet. existing DHCP. = |
| 2 | |
| 3 | {{{ |
| 4 | #!html |
| 5 | <div>Q: I want to set up an ethernet bridge on the 192.168.1.0/24 subnet. How do I configure OpenVPN so that it will cooperate with the existing DHCP server on the LAN?</div> |
| 6 | <div></div> |
| 7 | <div>There are two ways to do this.</div> |
| 8 | <div></div> |
| 9 | <div>Using the server-bridge directive is the easiest. First, set aside an address pool in your 192.168.1.0/24 subnet for use by OpenVPN clients. This range must be separate from the DHCP server range used on the subnet. Suppose you want OpenVPN to use192.168.1.200 to 192.168.1.254 for allocation to connecting clients, and that the gateway for the LAN is 192.168.1.1. Then the appropriateserver-bridge directive would be:</div> |
| 10 | <div></div> |
| 11 | <div>server-bridge 192.168.1.1 255.255.255.0 192.168.1.200 192.168.1.254</div> |
| 12 | <div></div> |
| 13 | <div></div> |
| 14 | <div></div> |
| 15 | <div>In the second method, the OpenVPN clients get their IP address lease from the DHCP server which is serving the LAN. For this configuration, you don't need a server-bridge directive, just something like:</div> |
| 16 | <div></div> |
| 17 | <div>mode server</div> |
| 18 | <div>dev tap0 # must be bridged with LAN ethernet interface</div> |
| 19 | <div>[SSL/TLS parms]</div> |
| 20 | <div>[keepalive parms]</div> |
| 21 | <div></div> |
| 22 | <div></div> |
| 23 | <div></div> |
| 24 | <div></div> |
| 25 | <div>The clients will negotiate a DHCP lease through the tunnel, meaning that both VPN clients and local machines will receive their IP addresses from the DHCP server address pool. The one complexity about this configuration is that you need to modify your DHCP server configuration to differentiate between local clients and VPN clients. The reason for this is that you must not pass out a default gateway to VPN clients. See the Win32 install notes for an example.</div> |
| 26 | }}} |
| 27 | |
| 28 | [wiki:FAQ Return to FAQ] |