[Q] TAP/Bridge mode VPN in jellybean - Android Q&A, Help & Troubleshooting

Has anyone successfully established a bridge mode VPN connection (using TAP) in any version of Jellybean, stock or custom?
It seems that every vpn app in the play store suggests that this can't be done in JB. I'd really like to upgrade to JB, but I really don't feel like reconfiguring my whole VPN setup, just to log on to my home server every once in awhile.
Hoping I'm wrong about this...

---

ushlambad said:
Has anyone successfully established a bridge mode VPN connection (using TAP) in any version of Jellybean, stock or custom?
It seems that every vpn app in the play store suggests that this can't be done in JB. I'd really like to upgrade to JB, but I really don't feel like reconfiguring my whole VPN setup, just to log on to my home server every once in awhile.
Hoping I'm wrong about this...
Click to expand...
Click to collapse
Yes all you need to do is search Open VPN Tun [short for tunnel and the name OpenVPN gives the setting] in the Android Play Store to find the Open VPN Settings app created by: Friedrich Schäuffelhut
[Found Here: Open VPN Settings]
When you run it it will run some checks and may ask you to download the following to install the ifconfig binary and the Open VPN binaries in to the system [ifconfig is installed as part of busybox so you maybe good may not but app checks and runs well].
Installer Link [which can also be run on it's own and also checks things and will tell you if you are good to go or if it needs to install things for you.
Open VPN Settings Installer
IF UNSURE USE /system/xbin for install location [first question] and accept defaults or the rest.
THIS WILL REQUIRE A ROOTED ANDROID DEVICE [due to it being a tunnel and not a tap interface you need root to set the connection up and make it usable within android the android VPN client itself only accepts TAP style interfaces due to possible security risks "casual" or "non-technical" users may not understand and thus to protect you from yourself it doesn't do TUN interfaces.
You can use either blah.ovpn OR blah.cfg [Windows servers use .ovpn as extension whereas Linux favors .cfg but both are the same text based profile file]. if I remember right just create /sdcard/openvpn/<whatever> [whatever is whatever directory name [if you want one] I use the client name that way all the keys and profiles are organized and not all jumbled in one folder [or if files have same name or different content then you will be forced to do this for something like multiple OpenVPN server profiles]. THE OpenVPN app tells you this if you open it and there is no /sdcard/openvpn folder found it says to create it in the middle of the main window area]
Also, it is easiest to edit your profiles so there is no absolute directory structure pointing to the files [the ca.crt, client.crt and client.key files].
This is very easy just remove all directories so the line ONLY has the filenames [See example profile in code box below].
Here to make this easy here is an example profile file I use [your server and port as well as if you choose to have it persist the IP addresses of clients across multiple connections may be different, up to you].
Code:
.
# Specify that this is a client
client
# Bridge device setting
dev tun
# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
remote some.domain.or.IP.address.here <whatever port you use here>
# Client does not need to bind to a specific local port
nobind
# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
## You may need to comment it out.
## This MAY NOT be a good choice
## for most folks I use a private server
## without many clients so it doesn't
## affect me if they connect a bunch of times but any security systems
## may not like it if you connect too many times to quickly and you don't
## want your own server blocking your IP when you want to connect now do you :)
resolv-retry infinite
# Preserve state across restarts
persist-key
persist-tun
# SSL/TLS parameters - files created previously
ca ca.crt
cert client.crt
key client.key
# Specify same cipher as server
cipher <choose your cipher>
# [same as you set on your server don't make it different]
## Default here is usually BF-CBC if I remember right
# Use compression
## again make sure you enabled compression in the server profile or comment it out here
comp-lzo
# Log verbosity (to help if there are problems)
## I set it a little higher but not totally verbose
## I like a little info when there are problems
## to help fix them, up to you what you choose
## Can be different from server setting
verb 3
Hopefully this helps. I am unsure of your or anyone else who may like this posts technical skills so trying to be thorough. You could also use this profile to work backward filling in the same settings asked for in the server profile.
ONCE YOU GET THE profile on to the SDCARD and connect the first time the app will always bring it up and all you have to do is tap a checkbox to turn on the VPN Settings app and then once more to enable the profile you want [yes even if just one you have to check it, BUT, IF YOU uncheck the OpenVPN enable/disable checkbox at top the next time you enable it it will auto enable last used connection !
IT REALLY IS A VERY EASY TO USE AN NICE APP [AND ONLY ONE TO SUPPORT OPEN VPN TUN [TUNNEL] INTERFACE SETUPS!