OpenVPN im Bridging-Modus auf OpenSUSE 10.2

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

/etc/init.d/network stop

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.0.2"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"

for t in $tap; do
    openvpn --mktun --dev $t
    done

    brctl addbr $br
    brctl addif $br $eth

    for t in $tap; do
        brctl addif $br $t
        done

        for t in $tap; do
            ifconfig $t 0.0.0.0 promisc up
            done

            ifconfig $eth 0.0.0.0 promisc up

            ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

route add default gw 192.168.0.1

#!/bin/bash

####################################
# Tear Down Ethernet bridge on Linux
####################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged together
tap="tap0"

ifconfig $br down
brctl delbr $br

for t in $tap; do
    openvpn --rmtun --dev $t
    done

ifconfig eth0 192.168.0.2 up
route add default gw 192.168.0.1

# Which local IP address should OpenVPN
# listen on? (optional)
local 192.168.0.2
port 1194
proto udp
dev tap0


# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret

# Diffie hellman parameters.
# Generate your own with:
#   openssl dhparam -out dh1024.pem 1024
# Substitute 2048 for 1024 if you are using
# 2048 bit keys.
dh /etc/openvpn/dh4096.pem
mode server
tls-server
push "route-gateway 192.168.0.1"
push "route-delay"
;push "redirect-gateway"
;push "dhcp-option DNS 192.168.0.2"
;push "dhcp-option WINS 192.168.0.2"

client-to-client
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
;duplicate-cn

# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 130
ping-timer-rem
push "ping 10"
push "ping-restart 90"
push "ping-timer-rem"
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
#   openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
tls-auth ta.key 0 # This file is secret
auth SHA1

# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES
cipher AES-256-CBC   # AES 256bit

# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
;comp-lzo

# The maximum number of concurrently connected
# clients we want to allow.
max-clients 5

user nobody
group nogroup

persist-key
persist-tun
float
#crl-verify /etc/openvpn/crls/crl.pem

status openvpn-status.log

log         /etc/openvpn/openvpn.log
log-append  /etc/openvpn/openvpn-append.log

# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4
mute 20

case "$1" in
    start)
        echo -n "Starte $DAEMON "
        /etc/openvpn/./bridge-start
        echo -n "Starte Netzwerkbrücke br0"
        sleep 5

        /sbin/modprobe tun &>/dev/null

        for conf in $confdir/*.conf; do
                pidfile=$(basename ${conf%%.conf}).pid
                $openvpn --daemon \
                        --writepid $piddir/$pidfile \
                        --config $conf \
                        --cd $confdir \
                        || ret=false
        done

        # Remember status and be verbose
        $ret
        rc_status -v
        ;;
    stop)
        echo -n "Stoppe $DAEMON "

        ## Stop daemon with killproc(8) and if this fails
        ## set echo the echo return value.

        for i in $piddir/*.pid; do
                killproc -p $i -TERM $openvpn || ret=false
        sleep 3
        /etc/openvpn/./bridge-stop
        echo -n "Stoppe Netzwerkbrücke br0"
        done

tls-auth ta.key 0 # This file is secret

Note: Cannot ioctl TUNSETIFF tap0: Device or resource busy (error=16)
Note: Attempting fallback to kernel 2.2 TUN/TAP interface
Cannot open TUN/TAP dev /dev/tap0: No such file or directory (error=2)
Exiting

  Depending on the type of device chosen the userspace program has to read/write
  IP packets (with tun) or ethernet frames (with tap). Which one is being used
  depends on the flags given with the ioctl().