Hi everyone I have a (basic) working Open VPN setup using my tp-link wr1043nd with DD-WRT firmware as server, but I also have one problem which have been bothering me since day one: [b]Once connected to my VPN server I cannot access local resources (for example administer my router via it's webinterface) and since my router is also my DNS server my name resolution goes right out the window.[/b] Please find my serverconfig (from my DD WRT router) and client config (openvpn+openvpn gui) below. Some more information / discussion: My local LAN: 10.13.37.0 / 255.255.255.0 Remote LAN: 10.0.1.0 / 255.255.255.0 VPN server: 10.0.60.0 / 255.255.255.0 [b]When _not_ connected to VPN:[/b] From my local lan (with an ip of say 10.13.37.112) [list=1] [*] I can access my local router via ip 10.13.37.1 and I can ping it [*] I can resolve names (i.e. asking the browser to open google.dk actually gives me the danish version of Google's search engine) [*] I can _not_ access 10.0.1.1 (which is the remote router / vpn server) via a webbrowser (for administration purposes) and I can _not_ ping it [*] I can _not_ use RDP to connect to computer 10.0.1.147 and I can _not_ ping it (ICMP enabled in firewall) [*] I can (still) use RDP to connect to computer 10.13.37.139 (which is the same computer as 10.0.1.147, just using a secondary nic) but I can _not_ ping it [*] I can use RDP to connect to computer 10.13.37.104 (which is a laptop, only connected to the local LAN)[/list] [b]When connected to VPN:[/b] From my local lan (with an ip of say 10.13.37.112) [list=1] [*] I can _not_ access my local router via ip 10.13.37.1 and I can _not_ ping it [*] I can _not_ resolve names (i.e. asking the browser to open google.dk fails during the look up stage), but I can still access remote services (e.g. a website) using it's ip address. So Google's search engine can now be found at 74.125.143.94. [*] I can access 10.0.1.1 (which is the remote router / vpn server) via a webbrowser (for administration purposes) and I can ping it [*] I can use RDP to connect to computer 10.0.1.147 but I can _not_ ping it (ICMP enabled in firewall) [*] I can use RDP to connect to computer 10.13.37.139 (which is the same computer as 10.0.1.147, just using a secondary nic) but I can _not_ ping it [*] I can _not_ use RDP to connect to computer 10.13.37.104 (which is a laptop, only connected to the local LAN)[/list] I think the above experiences are do to the fact that all traffic is going through the VPN tunnel. This fits the above because: 1) EDIT: ping (ICMP) works on layer 3, so ping should work over routed vpn. Why it does not work I do not know. See bottom of post for original 1). 2) RDP to the local-LAN-only laptop stops working because the traffic goes through the VPN to the remote lan and it does not go back again 3) RDP to 10.13.37.139 (which is also available via VPN on ip 10.0.1.147, remember it has two nics, one for each LAN) somehow still works due to the two NICs (for reasons unknown to me) 4) Name resolution (which is the same as access to my local router 10.13.37.1) stops working for the same reson as 2). The traffic goes over the VPN and does not come back. I how ever have NO idea WHAT SO EVER as how to fix it. I read a little about split-tunneling which should allow local traffic to go out on the local network (i.e. dns, http request for browsing etc) and only traffic for remote services to go over the VPN, but I have not succeeded in configuring it. Any advice is much appreciated! Best regards Wuhtzu [b]Server config[/b] [code]dh /tmp/openvpn/dh.pem ca /tmp/openvpn/ca.crt cert /tmp/openvpn/cert.pem key /tmp/openvpn/key.pem keepalive 10 120 verb 4 mute 5 log-append /var/log/openvpn writepid /var/log/openvpnd.pid management 127.0.0.1 5002 management-log-cache 50 mtu-disc yes topology subnet client-config-dir /tmp/openvpn/ccd script-security 2 port 1194 proto udp cipher bf-cbc auth sha256 tls-server ifconfig-pool-persist /tmp/openvpn/ip-pool 86400 client-to-client fast-io tun-mtu 1500 server 10.0.60.0 255.255.255.0 dev tun0 push "route 10.0.1.0 255.255.255.0" push "route 10.13.37.0 255.255.255.0" push "route 192.168.1.0 255.255.255.0" push "route 192.168.0.0 255.255.255.0"[/code] [b]Client config[/b] [code]client dev tun proto udp remote xxx.yyy.dk 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert jonas.crt key jonas.key ns-cert-type server cipher BF-CBC verb 3 auth SHA256[/code] [b]Edit: Original 1)[/b] ping requests (which works on layer 2) are not forwarded over routed vpn (which works on layer 3) so that's why pinging is not working

No access to local resources when connected to VPN

wuhtzu

Hi everyone

I have a (basic) working Open VPN setup using my tp-link wr1043nd with DD-WRT firmware as server, but I also have one problem which have been bothering me since day one:

Once connected to my VPN server I cannot access local resources (for example administer my router via it's webinterface) and since my router is also my DNS server my name resolution goes right out the window.

Please find my serverconfig (from my DD WRT router) and client config (openvpn+openvpn gui) below.

Some more information / discussion:

My local LAN: 10.13.37.0 / 255.255.255.0
Remote LAN: 10.0.1.0 / 255.255.255.0
VPN server: 10.0.60.0 / 255.255.255.0

When _not_ connected to VPN:
From my local lan (with an ip of say 10.13.37.112)

I can access my local router via ip 10.13.37.1 and I can ping it
I can resolve names (i.e. asking the browser to open google.dk actually gives me the danish version of Google's search engine)
I can _not_ access 10.0.1.1 (which is the remote router / vpn server) via a webbrowser (for administration purposes) and I can _not_ ping it
I can _not_ use RDP to connect to computer 10.0.1.147 and I can _not_ ping it (ICMP enabled in firewall)
I can (still) use RDP to connect to computer 10.13.37.139 (which is the same computer as 10.0.1.147, just using a secondary nic) but I can _not_ ping it
I can use RDP to connect to computer 10.13.37.104 (which is a laptop, only connected to the local LAN)

When connected to VPN:
From my local lan (with an ip of say 10.13.37.112)

I can _not_ access my local router via ip 10.13.37.1 and I can _not_ ping it
I can _not_ resolve names (i.e. asking the browser to open google.dk fails during the look up stage), but I can still access remote services (e.g. a website) using it's ip address. So Google's search engine can now be found at 74.125.143.94.
I can access 10.0.1.1 (which is the remote router / vpn server) via a webbrowser (for administration purposes) and I can ping it
I can use RDP to connect to computer 10.0.1.147 but I can _not_ ping it (ICMP enabled in firewall)
I can use RDP to connect to computer 10.13.37.139 (which is the same computer as 10.0.1.147, just using a secondary nic) but I can _not_ ping it
I can _not_ use RDP to connect to computer 10.13.37.104 (which is a laptop, only connected to the local LAN)

I think the above experiences are do to the fact that all traffic is going through the VPN tunnel. This fits the above because:
1) EDIT: ping (ICMP) works on layer 3, so ping should work over routed vpn. Why it does not work I do not know. See bottom of post for original 1).
2) RDP to the local-LAN-only laptop stops working because the traffic goes through the VPN to the remote lan and it does not go back again
3) RDP to 10.13.37.139 (which is also available via VPN on ip 10.0.1.147, remember it has two nics, one for each LAN) somehow still works due to the two NICs (for reasons unknown to me)
4) Name resolution (which is the same as access to my local router 10.13.37.1) stops working for the same reson as 2). The traffic goes over the VPN and does not come back.

I how ever have NO idea WHAT SO EVER as how to fix it. I read a little about split-tunneling which should allow local traffic to go out on the local network (i.e. dns, http request for browsing etc) and only traffic for remote services to go over the VPN, but I have not succeeded in configuring it.

Any advice is much appreciated!

Best regards
Wuhtzu

Server config

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 4
mute 5
log-append /var/log/openvpn
writepid /var/log/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
mtu-disc yes
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
port 1194
proto udp
cipher bf-cbc
auth sha256
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
server 10.0.60.0 255.255.255.0
dev tun0
push "route 10.0.1.0 255.255.255.0"
push "route 10.13.37.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.0.0 255.255.255.0"

Client config

client
dev tun
proto udp
remote xxx.yyy.dk 1194
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert jonas.crt
key jonas.key

ns-cert-type server
cipher BF-CBC
verb 3
auth SHA256

Edit: Original 1)
ping requests (which works on layer 2) are not forwarded over routed vpn (which works on layer 3) so that's why pinging is not working

wuhtzu

Okay, so I got some new information regarding this issue.

When I am actually on a 3rd party network (neither the 10.13.37.0 nor the 10.0.1.0 which are both in my apartment) I can connect to my VPN server (located on the 10.0.1.0 network) and still access local resources (the dns server for example).

So to be concrete I was at my parents house (a 10.0.0.0/255.255.255.0 network behind an ADSL connection with a public IP) and when I connect to my VPN server (my tap device gets ip 10.0.60.2, and my normal nic have ip 10.0.0.x) I can access both my 10.0.1.1 network and local resources on my parents 10.0.0.0 network. This inclucdes the DNS server (10.0.0.1) and other computers on their network.

Does this give any more hints as to what my problem might be?

Best regards
Wuhtzu

wuhtzu

I solved my problem.

See my thread at the dd-wrt forums for solution and the discussion leading up to it:

http://www.dd-wrt.com/phpBB2/viewtopic.php?p=706562#706562

I gave up using this forum due to the fact that my posts had to be approved by a moderator before being displayed. I can vaguely understand having the initial topic approved by a moderator, but no way the replies. It grinds everything to a hold. It took around 2 days to get my topic approved, 2 days for an edit and 2 days for a reply with additional information. What should have happened in one night took 6 days 🙁 Maybe this is because I am a new member (fewer than x posts), I don't know.