Debian - SE 4.x/5.x Bridge DHCP Issues - ALMOST THERE
Posted: Fri May 30, 2025 5:36 pm
Hi, long time lurker, first time poster. We've been using SE 4.x (OpenVPN clone) for a few years now in SecureNAT mode on a Hyper-V VM. Recently, I've decided to de-couple SE from Hyper-V and running on a standalone Debian Linux machine (bare metal.) Moving the configuration over was super easy via the VPN Manager. So far so good.
One issue we've had is that we cannot see who's accessing the VPN unless accessing the VPN manager. So, a decision was made to utilize the local bridging option of SE and have clients acquire an IP address from on-premises DHCP server and we're ALMOST there. The problem we're running into is that the client is not receiving an IP address from the DHCP server but from SecureNAT which is disabled.
I've read dozens of posts on this forum thinking I could find the answer, but nothing has gained any traction and I'm aware of my limitations and know when to ask for help.
Here's what I've done:
- installed Debian 12.11 x64
- installed SE 5.x via apt, migrated configuration via VPN Manager running on another machine (I also manually compiled 4.x and tried it as well, same results)
- created a separate VLAN for the VPN connection, in this case, VLAN id=99 with accompanying DHCP server servicing it. This works fine when plugged into a switch port designated for that VLAN, I get an IP address. When a client connects, it gets assigned a 192.168.30.x address from SE even though Virtual NAT and Virtual DHCP is disabled.
- IP forwarding is enabled via systctl (net.ipv4.ip_forward = 1)
My config:
My test workstation: 10.220.40.146 (VLAN id=40)
Server: 10.220.20.127 (enp1s0) - fully configured; IP, DNS, GW, etc via DHCP. Switch port is VLAN id=20 (Servers)
Bridge Interface: No IP settings (enp4s0) and administratively up. Not a TAP device but physical NIC. Switch port is VLAN id=99 (VPN)
DHCP is not coming from Windows DHCP server in VLAN20 but rather the router itself (which uses a relay for all VLANs, except 99 which it handles itself for simplicity's sake in testing.)
Here's what's in the server log when a client connects:
When a client connects, I see the following from the DHCP server:
Some useful information:
ca:15:f2:ca:34:be is my test workstation MAC address via OpenVPN/SE (it's assigned, not physical address)
5E-AD-A8-E7-79-1B is the MAC address in the Virtual DHCP/NAT settings, even though both are disabled (unticked) which can be verified in the vpn_server.config (below) -- I even tried changing the Virtual DHCP addressing to ensure that 192.168.30.x was not present in the config in any way so I mirrored my DHCP range/config from the ROUTER (made no difference.)
I can also see the DHCP server on the ROUTER attempting to assign the following MAC address an IP which is not connected to the VLAN in any way. Since it appears to be a random MAC address, not sure where it's coming from as it appears neither on my ROUTER or the SE linux machine and there are no other clients connected to this VLAN:
I also tried disabling SecureNAT kernel and Raw IP mode (saw in another post) but that didn't change anything. Also, when I go into the VPN HUB->Manage Sessions->MAC Address Table, I can see various MACs and their associated VLANs which tells me that I must have the bridge interface connected and configured correctly. However, when I look at VPN HUB->Manage Sessions->IP Address Table, I see 10.220.99.1 (my VLAN 99 gateway, which I'd expect to see) AND 192.168.30.1 which was the stock Virtual DHCP gateway setting, again, which is disabled.
I feel I'm almost there but just missing something. If there's any more information I can provide, please let me know!
Appreciate any help in advance.
One issue we've had is that we cannot see who's accessing the VPN unless accessing the VPN manager. So, a decision was made to utilize the local bridging option of SE and have clients acquire an IP address from on-premises DHCP server and we're ALMOST there. The problem we're running into is that the client is not receiving an IP address from the DHCP server but from SecureNAT which is disabled.
I've read dozens of posts on this forum thinking I could find the answer, but nothing has gained any traction and I'm aware of my limitations and know when to ask for help.
Here's what I've done:
- installed Debian 12.11 x64
- installed SE 5.x via apt, migrated configuration via VPN Manager running on another machine (I also manually compiled 4.x and tried it as well, same results)
- created a separate VLAN for the VPN connection, in this case, VLAN id=99 with accompanying DHCP server servicing it. This works fine when plugged into a switch port designated for that VLAN, I get an IP address. When a client connects, it gets assigned a 192.168.30.x address from SE even though Virtual NAT and Virtual DHCP is disabled.
- IP forwarding is enabled via systctl (net.ipv4.ip_forward = 1)
My config:
My test workstation: 10.220.40.146 (VLAN id=40)
Server: 10.220.20.127 (enp1s0) - fully configured; IP, DNS, GW, etc via DHCP. Switch port is VLAN id=20 (Servers)
Bridge Interface: No IP settings (enp4s0) and administratively up. Not a TAP device but physical NIC. Switch port is VLAN id=99 (VPN)
DHCP is not coming from Windows DHCP server in VLAN20 but rather the router itself (which uses a relay for all VLANs, except 99 which it handles itself for simplicity's sake in testing.)
Code: Select all
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 40:62:31:0a:0a:d7 brd ff:ff:ff:ff:ff:ff
inet 10.220.20.127/24 brd 10.220.20.255 scope global dynamic enp1s0
valid_lft 2923sec preferred_lft 2923sec
inet6 fe80::4262:31ff:fe0a:ad7/64 scope link
valid_lft forever preferred_lft forever
5: enp4s0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 40:62:31:0a:0a:da brd ff:ff:ff:ff:ff:ff
inet6 fe80::4262:31ff:fe0a:ada/64 scope link
valid_lft forever preferred_lft forever
Code: Select all
2025-05-30 11:07:37.418 OpenVPN Session 4 (10.220.40.156:53987 -> 10.220.20.127:1195) Channel 0: Option Strings Received: "V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client"
2025-05-30 11:07:37.418 OpenVPN Session 4 (10.220.40.156:53987 -> 10.220.20.127:1195) Channel 0: Client certificate received (subject: CN="vpn229525752.softether.net"), will use certificate authentication.
2025-05-30 11:07:37.418 OpenVPN Session 4 (10.220.40.156:53987 -> 10.220.20.127:1195) Channel 0: Option Strings to Send: "V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server"
2025-05-30 11:07:37.428 On the TCP Listener (Port 0), a Client (IP address 10.220.40.156, Host name "DESKTOP-SEVFLVJ.hostname.com", Port number 53987) has connected.
2025-05-30 11:07:37.428 For the client (IP address: 10.220.40.156, host name: "DESKTOP-SEVFLVJ.hostname.com", port number: 53987), connection "CID-6" has been created.
2025-05-30 11:07:37.428 SSL communication for connection "CID-6" has been started. The encryption algorithm name is "(null)".
2025-05-30 11:07:37.428 [HUB "VPN"] The connection "CID-6" (IP address: 10.220.40.156, Host name: DESKTOP-SEVFLVJ.hostname.com, Port number: 53987, Client name: "OpenVPN Client", Version: 4.44, Build: 9807) is attempting to connect to the Virtual Hub. The auth type provided is "External server authentication" and the user name is "vpnusername".
2025-05-30 11:07:37.449 [HUB "VPN"] Connection "CID-6": Successfully authenticated as user "vpnusername".
2025-05-30 11:07:37.449 [HUB "VPN"] Connection "CID-6": The new session "SID-vpnusername-[OPENVPN_L3]-3" has been created. (IP address: 10.220.40.156, Port number: 53987, Physical underlying protocol: "Legacy VPN - OPENVPN_L3")
2025-05-30 11:07:37.449 [HUB "VPN"] Session "SID-vpnusername-[OPENVPN_L3]-3": The parameter has been set. Max number of TCP connections: 1, Use of encryption: Yes, Use of compression: No, Use of Half duplex communication: No, Timeout: 20 seconds.
2025-05-30 11:07:37.449 [HUB "VPN"] Session "SID-vpnusername-[OPENVPN_L3]-3": VPN Client details: (Client product name: "OpenVPN Client", Client version: 444, Client build number: 9807, Server product name: "SoftEther VPN Server (64 bit)", Server version: 444, Server build number: 9807, Client OS name: "OpenVPN Client", Client OS version: "-", Client product ID: "-", Client host name: "", Client IP address: "10.220.40.156", Client port number: 53987, Server host name: "10.220.20.127", Server IP address: "10.220.20.127", Server port number: 1195, Proxy host name: "", Proxy IP address: "0.0.0.0", Proxy port number: 0, Virtual Hub name: "VPN", Client unique ID: "17113951FB618098CFFE48A71BAF7D75")
2025-05-30 11:07:37.499 [HUB "VPN"] Session "SID-LOCALBRIDGE-1": The DHCP server of host "5E-AD-A8-E7-79-1B" (192.168.30.1) on this session allocated, for host "SID-vpnusername-[OPENVPN_L3]-3" on another session "CA-15-F2-CA-34-BE", the new IP address 192.168.30.109.
2025-05-30 11:07:37.499 OpenVPN Session 4 (10.220.40.156:53987 -> 10.220.20.127:1195) Channel 0: The channel becomes the established state.
2025-05-30 11:07:37.499 OpenVPN Session 4 (10.220.40.156:53987 -> 10.220.20.127:1195) Channel 0: The IP address and other network information parameters are set successfully. IP Address of Client: 192.168.30.109, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.30.1, DNS Server 1: 10.220.50.165, DNS Server 2: 10.220.50.174, WINS Server 1: , WINS Server 2:
2025-05-30 11:07:37.499 OpenVPN Session 4 (10.220.40.156:53987 -> 10.220.20.127:1195) Channel 0: The full strings replied: "PUSH_REPLY,ping 3,ping-restart 10,ifconfig 192.168.30.109 192.168.30.110,dhcp-option DOMAIN hostname.com,dhcp-option DNS 10.220.50.165,dhcp-option DNS 10.220.50.174,route-gateway 192.168.30.110,redirect-gateway def1"
2025-05-30 11:07:54.708 [HUB "VPN"] Session "SID-vpnusername-[OPENVPN_L3]-3": The session has been terminated. The statistical information is as follows: Total outgoing data size: 22921 bytes, Total incoming data size: 4650 bytes.
2025-05-30 11:07:54.739 Connection "CID-6" terminated by the cause "The VPN session has been deleted. It is possible that either the administrator disconnected the session or the connection from the client to the VPN Server has been disconnected." (code 11).
2025-05-30 11:07:54.739 Connection "CID-6" has been terminated.
2025-05-30 11:07:54.739 The connection with the client (IP address 10.220.40.156, Port number 53987) has been disconnected.
Code: Select all
2025-05-30T10:32:40-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPDISCOVER(br99) 192.168.30.109 ca:15:f2:ca:34:be
2025-05-30T10:32:40-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPOFFER(br99) 10.220.99.126 ca:15:f2:ca:34:be
2025-05-30T10:32:40-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPREQUEST(br99) 192.168.30.109 ca:15:f2:ca:34:be
2025-05-30T10:32:40-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPNAK(br99) 192.168.30.109 ca:15:f2:ca:34:be wrong server-ID
ca:15:f2:ca:34:be is my test workstation MAC address via OpenVPN/SE (it's assigned, not physical address)
5E-AD-A8-E7-79-1B is the MAC address in the Virtual DHCP/NAT settings, even though both are disabled (unticked) which can be verified in the vpn_server.config (below) -- I even tried changing the Virtual DHCP addressing to ensure that 192.168.30.x was not present in the config in any way so I mirrored my DHCP range/config from the ROUTER (made no difference.)
Code: Select all
declare SecureNAT
{
bool Disabled true
bool SaveLog true
declare VirtualDhcpServer
{
string DhcpDnsServerAddress 10.220.50.165
string DhcpDnsServerAddress2 10.220.50.174
string DhcpDomainName hostname.com
bool DhcpEnabled false
uint DhcpExpireTimeSpan 7200
string DhcpGatewayAddress 10.220.99.1
string DhcpLeaseIPEnd 10.220.99.200
string DhcpLeaseIPStart 10.220.99.100
string DhcpPushRoutes $
string DhcpSubnetMask 255.255.255.0
}
declare VirtualHost
{
string VirtualHostIp 10.220.99.254
string VirtualHostIpSubnetMask 255.255.255.0
string VirtualHostMacAddress 5E-AD-A8-E7-79-1B
}
declare VirtualRouter
{
bool NatEnabled false
uint NatMtu 1500
uint NatTcpTimeout 1800
uint NatUdpTimeout 60
}
}
Code: Select all
2025-05-30T11:18:55-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPDISCOVER(br99) da:12:5e:36:a6:35
2025-05-30T11:18:55-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPOFFER(br99) 10.220.99.109 da:12:5e:36:a6:35
2025-05-30T11:18:57-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPDISCOVER(br99) da:12:5e:36:a6:35
2025-05-30T11:18:57-06:00 ROUTER dnsmasq-dhcp[1928187]: DHCPOFFER(br99) 10.220.99.109 da:12:5e:36:a6:35
I feel I'm almost there but just missing something. If there's any more information I can provide, please let me know!
Appreciate any help in advance.