Skip to main content

Tutorial (Legacy): Site-to-Site Layer 2 Bridging Using Access Server and a Linux Gateway Client

Abstract

Layer 2 bridging is no longer supported, but this tutorial shows how to use this deprecated feature.

Overview

Important word of caution:

This setup is deprecated, and we don't support it. We recommend using layer 3 routing mode but provide this documentation for legacy layer 2 bridging mode setups.

bridging-sitetosite.png

The diagram above depicts a typical site-to-site layer 2 bridging setup.

This tutorial guides you through setting up a site-to-site layer 2 bridging configuration using Access Server and a Linux gateway client. This setup allows you to bridge two sites transparently, making them appear as part of the same local network.

Important

This functionality is deprecated, and we recommend using site-to-site VPN routing for new implementations. This setup may still be useful in certain legacy environments.

Prerequisites

  • Two sites: each site connected to the internet with one hosting Access Server and the other hosting an OpenVPN client.

  • Access Server requirements:

    • Accessible from the internet with the necessary ports forwarded.

    • On a platform that supports bridging (not OpenVZ).

    • Doesn't use multi-daemon mode; set one TCP and one UDP daemon under Network Settings.

    • Admin Web UI and console access.

  • OpenVPN client requirements:

    • At least two ethernet interfaces (one for internet, one for private LAN).

    • IP forwarding enabled.

    • Installed with bridge-utils , net-tools, and openvpn.

    • Running a Linux operating system with administrative access.

    • Ability to upload files and SSH/SFTP access.

  • Private LAN isolation: The LAN segment should be isolated from other networks.

Step 1: Generate and download an autologin connection profile

  1. Sign in to the Admin Web UI.

  2. Click User Management > User Permissions.

  3. Enter a new username for the bridging client.

  4. Check the box Allow Auto-login.

    • Your new user is displayed in the list of users.

  6. Click User Profiles.

  7. Find your new user under Username and click New Profile.

    • Create Profile for [user] pops up.

  8. Select Autologin and click Create Profile.

    • The .ovpn connection profile downloads.

Step 2: Prepare the Linux OpenVPN client

  1. Download two scripts to your computer:

  2. Use an SFTP client like FileZilla or Cyberduck to upload the two scripts, plus the .ovpn connection profile download to the /etc/openvpn/client/ folder on the Linux OpenVPN client machine.

Step 3: Rename the connection profile

  1. Connect to your Linux OpenVPN client machine's console and get root privileges.

  2. Rename the profile to use a .conf extension:

    cd /etc/openvpn/client
mv profile.ovpn1 client.conf

    1

    Replace profile.ovpn with your connection profile's file name.

Step 4: Verify and install bridge utilities

  1. Ensure bridge-utils and net-tools are installed:

    brctl show
ifconfig -a

  2. If not installed, use the following command (for Debian/Ubuntu):

    apt install bridge-utils
apt install net-tools

Step 5: Identify the private interface

  1. Use ifconfig -a to list network interfaces and determine the private interface you want to bridge.

  2. Note the interface name (e.g., eth2).

Step 6: Edit the bridging script

  1. Edit bridge-up.sh using a text editor like nano:

    nano /etc/openvpn/bridge-up.sh

  2. Change eth="eth1" to your identified private interface, e.g., eth="eth2".

  3. Save and exit the file.

Step 7: Modify the connection profile

  1. Edit the connection profile to include bridging commands:

    nano /etc/openvpn/client/client.conf

  2. Add the following lines at the top:

    up "/bin/bash /etc/openvpn/bridge-up.sh"
down "/bin/bash /etc/openvpn/bridge-down.sh"
script-security 2
route-nopull

  3. Restart the OpenVPN service to apply changes and connect:

    systemctl restart openvpn-client@client

Step 8: Verify the bridge connection

  • Verify the bridge:

    ifconfig vpn0

    • The vpn0 interface should display the IP address configured in the bridge-up.sh file. If successful, clients on the bridged site should now obtain an IP address from the remote site via DHCP or manual configuration.

In this section: