Steps to reproduce the issue:
#1 Forgot to mention the device-type as "tap" when configuring the openvpn server in bridge mode:
set interfaces bridge br268 member interface vtun268 set interfaces openvpn vtun268 encryption cipher 'aes128' set interfaces openvpn vtun268 local-port '2278' set interfaces openvpn vtun268 mode 'server' set interfaces openvpn vtun268 server subnet '192.168.1.0/24' set interfaces openvpn vtun268 tls ca-certificate 'root_ca' set interfaces openvpn vtun268 tls certificate 'server2' set interfaces openvpn vtun268 tls dh-params 'dh-pem'
Committing the above configuration gives the error, which is expected.
vyos@vyos# commit Error: Device does not allow enslaving to a bridge. [[interfaces openvpn vtun268]] failed Commit failed
#2 Even after adding the command, receive the commit error.
vyos@vyosb2# set interfaces openvpn vtun268 device-type 'tap'
[edit]
vyos@vyosb2# compare
[interfaces]
+ openvpn vtun268 {
+ device-type "tap"
+ encryption {
+ data-ciphers "aes128"
+ }
+ local-port "2278"
+ mode "server"
+ server {
+ subnet "192.168.1.0/24"
+ }
+ tls {
+ ca-certificate "root-ca"
+ certificate "server101"
+ dh-params "dh-pem"
+ }
+ }
vyos@vyosb2# commit
[ interfaces openvpn vtun268 ]
Error: Device does not allow enslaving to a bridge.
[[interfaces openvpn vtun268]] failed
Commit failed
[edit]#3 It does not seem to allow modification to the tunnel which was created in the first commit but it does not exist in the running configuration, deleting the bridge interface also does not help.
Interface status
vyos@vyosb2# sh int
bridge br268 {
member {
interface vtun268 {
}
}
}
dummy dum0 {
address 10.13.0.10/16
}
ethernet eth0 {
address dhcpv6
address 192.0.2.20/24
hw-id 50:0b:00:0b:00:00
}
ethernet eth1 {
hw-id 50:0b:00:0b:00:01
}
ethernet eth2 {
hw-id 50:0b:00:0b:00:02
}
ethernet eth3 {
hw-id 50:0b:00:0b:00:03
}
loopback lo {
}
8: br268: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN0
link/ether ea:4b:b5:3a:e5:1a brd ff:ff:ff:ff:ff:ff
inet6 fe80::e84b:b5ff:fe3a:e51a/64 scope link tentative
valid_lft forever preferred_lft forever
9: vtun268: <NO-CARRIER,POINTOPOINT,MULTICAST,NOARP,UP> mtu 1500 qdisc fq_codel0
link/noneRebooting the device or creating the tunnel interface with different number fixes the issue.