tun interfaces cannot be put in a bridge because they do not use an Ethernet-like L2 link-layer header (or any L2 header at all, really; they're purely L3 interfaces).
You need to use a 'tap' interface instead.
On Tue, Jan 31, 2023 at 1:05 PM Thomas Köller <thomas@xxxxxxxxxxxxxxxxxx> wrote:
I am trying to build a VPN tunnel through a tun interface created by
sshd. The tun interface is to be added to an existing bridge interface.
For this purpose I created a .network file (see below). However, the
operation fails, without systemd-networkd giving a useful error message
beyond 'Invalid argument', not even if logging is set do debug:
Jan 31 11:04:59 sarkovy systemd-networkd[1294]: Setting log level to debug.
Jan 31 11:04:59 sarkovy systemd-networkd[1294]: Sent message
type=method_return sender=n/a destination=:1.213 path=n/a interface=n/a
member=n/a cookie=44 reply_cookie=3 signature=n/a error-name=n/a
error-message=n/a
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Saved new link:
ifindex=6, iftype=NONE(65534), kind=tun
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Saved original MTU
1500 (min: 68, max: 65535)
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Saved IPv6
link-local address generation mode: eui64
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Flags change:
+MULTICAST +POINTOPOINT +NOARP
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Sent message type=signal
sender=n/a destination=n/a path=/org/freedesktop/network1/link/_36
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
cookie=45 reply_cookie=0 signature=sa{sv}as error-name=n/a error-message=n/a
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: link pending udev
initialization...
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: udev initialized link
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: State changed:
pending -> initialized
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Sent message type=signal
sender=n/a destination=n/a path=/org/freedesktop/network1/link/_36
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
cookie=46 reply_cookie=0 signature=sa{sv}as error-name=n/a error-message=n/a
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Found driver: tun
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Link state is
up-to-date
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Unmanaging interface.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: State changed:
initialized -> unmanaged
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Sent message type=signal
sender=n/a destination=n/a path=/org/freedesktop/network1/link/_36
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
cookie=47 reply_cookie=0 signature=sa{sv}as error-name=n/a error-message=n/a
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: tun0: Interface name
change detected, renamed to vpn_rpi400.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: udev
initialized link
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: State
changed: unmanaged -> initialized
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Sent message type=signal
sender=n/a destination=n/a path=/org/freedesktop/network1/link/_36
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
cookie=48 reply_cookie=0 signature=sa{sv}as error-name=n/a error-message=n/a
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Link state
is up-to-date
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: found
matching network '/etc/systemd/network/50-vpn.network'.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Configuring
with /etc/systemd/network/50-vpn.network.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: State
changed: initialized -> configuring
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Sent message type=signal
sender=n/a destination=n/a path=/org/freedesktop/network1/link/_36
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
cookie=49 reply_cookie=0 signature=sa{sv}as error-name=n/a error-message=n/a
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link is not activated.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link is not activated.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Setting
'/proc/sys/net/ipv6/conf/vpn_rpi400/use_tempaddr' to '0'
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Setting
'/proc/sys/net/ipv6/conf/vpn_rpi400/accept_ra' to '0'
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Setting
'/proc/sys/net/ipv6/conf/vpn_rpi400/proxy_ndp' to '0'
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: No change in value '0',
suppressing write
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Setting
'/proc/sys/net/ipv4/conf/vpn_rpi400/promote_secondaries' to '1'
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: No change in value '1',
suppressing write
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Requested to
set link flags
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Requested to
set IPv6LL address generation mode
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Requested to
set master interface
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Requested to
set bridge configurations
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Requested to
activate link
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400:
link_check_ready(): link layer is configuring.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Setting link
flags
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Setting
IPv6LL address generation mode
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Setting
master interface
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: link flags set.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: IPv6LL
address generation mode set.
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Failed to
set master interface: Invalid argument
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: Failed
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: vpn_rpi400: State
changed: configuring -> failed
Jan 31 11:05:12 sarkovy systemd-networkd[1294]: Sent message type=signal
sender=n/a destination=n/a path=/org/freedesktop/network1/link/_36
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
cookie=50 reply_cookie=0 signature=sa{sv}as error-name=n/a error-message=n/a
Jan 31 11:05:26 sarkovy systemd-networkd[1294]: Got message
type=method_call sender=:1.215 destination=org.freedesktop.network1
path=/org/freedesktop/network1 interface=org.freedesktop.DBus.Properties
member=Get cookie=2 reply_cookie=0 signature=ss error-name=n/a
error-message=n/a
Jan 31 11:05:26 sarkovy systemd-networkd[1294]: Sent message
type=method_return sender=n/a destination=:1.215 path=n/a interface=n/a
member=n/a cookie=51 reply_cookie=2 signature=v error-name=n/a
error-message=n/a
Jan 31 11:06:35 sarkovy systemd-networkd[1294]: Got message
type=method_call sender=:1.216 destination=org.freedesktop.network1
path=/org/freedesktop/LogControl1
interface=org.freedesktop.DBus.Properties member=Set cookie=3
reply_cookie=0 signature=ssv error-name=n/a error-message=n/a
Jan 31 11:06:35 sarkovy systemd-networkd[1294]: Sent message
type=method_call sender=n/a destination=org.freedesktop.DBus
path=/org/freedesktop/DBus interface=org.freedesktop.DBus
member=GetConnectionUnixUser cookie=52 reply_cookie=0 signature=s
error-name=n/a error-message=n/a
Jan 31 11:06:35 sarkovy systemd-networkd[1294]: Got message
type=method_return sender=org.freedesktop.DBus destination=:1.12
path=n/a interface=n/a member=n/a cookie=4294967295 reply_cookie=52
signature=u error-name=n/a error-message=n/a
These are the contents of /etc/systemd/network/50-vpn.network:
[Match]
Name = vpn_*
[Link]
RequiredForOnline = no
ActivationPolicy = up
ARP = no
[Network]
Description = VPN interface
DHCP = no
DHCPServer = no
LinkLocalAddressing = no
DefaultRouteOnDevice = no
LLMNR = no
IPv6AcceptRA = no
Bridge = br_lan
--
Mantas Mikulėnas
