---
title: 'Tutorial (Legacy): Site-to-Site Layer 2 Bridging Using Access Server and a Linux Gateway Client'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--layer-2-site-to-site/
product: Access Server Docs
description: Layer 2 bridging is no longer supported, but this tutorial shows how to use this deprecated feature.
---

# Tutorial (Legacy): Site-to-Site Layer 2 Bridging Using Access Server and a Linux Gateway Client

## Overview

> **Caution**
>
> **Important word of caution:**
>
> This setup is **deprecated**, and we don't support it. We recommend using **layer 3 routing mode** but provide this documentation for legacy layer 2 bridging mode setups.

The diagram above depicts a typical site-to-site layer 2 bridging setup.

This tutorial guides you through setting up a site-to-site [layer 2 bridging](https://openvpn.net/as-docs/osi-model.md) configuration using Access Server and a Linux gateway client. This setup allows you to bridge two sites transparently, making them appear as part of the same local network.

> **Important**
>
> This functionality is deprecated, and we recommend using [site-to-site VPN routing](https://openvpn.net/as-docs/tutorials/tutorial--site-to-site-network.md) for new implementations. This setup may still be useful in certain legacy environments.

## Prerequisites

- **Two sites:** each site connected to the internet with one hosting Access Server and the other hosting an OpenVPN client.
- **Access Server requirements:**
  - Accessible from the internet with the necessary ports forwarded.
  - Configured in [Layer 2 Ethernet Bridging Mode](https://openvpn.net/as-docs/tutorials/tutorial--layer-2-ethernet-bridging.md).
  - Admin Web UI and console access.
- **OpenVPN client requirements:**
  - At least two ethernet interfaces (one for internet, one for private LAN).
  - IP forwarding enabled.
  - Installed with `bridge-utils` , `net-tools`, and `openvpn`.
  - Running a Linux operating system with administrative access.
  - Ability to upload files and SSH/SFTP access.
- **Private LAN isolation:** The LAN segment should be isolated from other networks.

## Step 1: Generate and download an autologin connection profile

1. Sign in to the Admin Web UI.
2. Click **User Management \> User Permissions**.
3. Enter a new username for the bridging client.
4. Check the box **Allow Auto-login**.
5. Select **Save Settings** and **Update Running Server**.
   - Your new user is displayed in the list of users.
6. Click **User Profiles**.
7. Find your new user under **Username** and click **New Profile**.
   - **Create Profile for \[user\]** pops up.
8. Select **Autologin** and click **Create Profile**.
   - The **.ovpn** connection profile downloads.

## Step 2: Prepare the Linux OpenVPN client

1. Download two scripts to your computer:
   - [bridge-up.sh](https://packages.openvpn.net/as/scripts/bridge-up.sh)
   - [bridge-down.sh](https://packages.openvpn.net/as/scripts/bridge-down.sh)
2. Use an SFTP client like FileZilla or Cyberduck to upload the two scripts, plus the **.ovpn** connection profile download to the **/etc/openvpn/client/** folder on the Linux OpenVPN client machine.

## Step 3: Rename the connection profile

1. Connect to your Linux OpenVPN client machine's console and get root privileges.
2. Rename the profile to use a `.conf` extension:

   ```
   cd /etc/openvpn/client
   mv profile.ovpn client.conf
   ```

   Replace **profile.ovpn** with your connection profile's file name.

## Step 4: Verify and install bridge utilities

1. Ensure `bridge-utils` and `net-tools` are installed:

   ```
   brctl show
   ifconfig -a
   ```
2. If not installed, use the following command (for Debian/Ubuntu):

   ```
   apt install bridge-utils
   apt install net-tools
   ```

## Step 5: Identify the private interface

1. Use `ifconfig -a` to list network interfaces and determine the private interface you want to bridge.
2. Note the interface name (e.g., `eth2`).

## Step 6: Edit the bridging script

1. Edit `bridge-up.sh` using a text editor like `nano`:

   ```
   nano /etc/openvpn/bridge-up.sh
   ```
2. Change `eth="eth1"` to your identified private interface, e.g., `eth="eth2"`.
3. Save and exit the file.

## Step 7: Modify the connection profile

1. Edit the connection profile to include bridging commands:

   ```
   nano /etc/openvpn/client/client.conf
   ```
2. Add the following lines at the top:

   ```
   up "/bin/bash /etc/openvpn/bridge-up.sh"
   down "/bin/bash /etc/openvpn/bridge-down.sh"
   script-security 2
   route-nopull
   ```
3. Restart the OpenVPN service to apply changes and connect:

   ```
   systemctl restart openvpn-client@client
   ```

## Step 8: Verify the bridge connection

1. Verify the bridge:

   ```
   ifconfig vpn0
   ```

   - The `vpn0` interface should display the IP address configured in the `bridge-up.sh` file. If successful, clients on the bridged site should now obtain an IP address from the remote site via DHCP or manual configuration.

---

Prev: [Tutorial (Legacy): Switching Between Layer 3 Routing and Layer 2 Bridging](https://openvpn.net/as-docs/tutorials/tutorial--layer-2-ethernet-bridging.md)
Next: [Tutorial (Legacy): Configure Access Server for a Privately Bridged Network](https://openvpn.net/as-docs/tutorials/tutorial--private-bridged-network.md)
Index: https://openvpn.net/as-docs/llms.txt