I have OpenVPN (but not luci-app-vpn) on my openwrt WNDR3700v1. Having followed several Howto's I have been unable to connect properly. I finally used the directions at
http://wiki.openwrt.org/inbox/vpn.howto and was able to connect (or so it says), but I can't browse my Samba shares or see any portions of my home network. The whole point of this is to allow access to my server's share
Here are my 'facts':
Home network is 192.168.40.x. Router is .1, a fileserver is .28 and is named server; under windows the share \\server\WorkFiles allows access with the proper username/password.
I am using a new Dell Windows 7 machine to connect via OpenVPN. If there are any Windows 7 'tricks' to enable the correct magic, I don't know about them.
I have a dynamic dns module running under openwrt and my client side point to it (remote mydynamicdns 1194). Obviously I have the real name in my actual remote line.
I know I'm close, but would love to get over the finish line so I can use the laptop over vacation (yeah, vacation = work in another location while kids are at beach with Mom <g>).
Thanks for any help which can be provided!
vpn configuration, along with all the settings in the link above, is:
mode server
tls-server
port 1194
proto udp
dev tun
ca /etc/easy-rsa/keys/ca.crt
cert /etc/easy-rsa/keys/server.crt
key /etc/easy-rsa/keys/server.key
dh /etc/easy-rsa/keys/dh1024.pem
server 10.0.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.40.1
client-to-client
comp-lzo
persist-key
persist-tun
verb 3
keepalive 10 120
log-append /var/log/openvpn/openvpn.log
client side is:
client
tls-client
dev tun
proto udp
remote mydynamicdns 1194 # obviously I have the correct dyndns.org location here
resolv-retry infinite
nobind
ca ca.crt
cert ASB.crt
key ASB.key
dh dh1024.pem
#comp-lzo
persist-tun
persist-key
verb 3
Here is the log file on the client side (I have removed personal info - I hope):
Note: option http-proxy-fallback ignored because no TCP-based connection profiles are defined
OpenVPNAS 2.1.1oOAS Win32-MSVC++ [SSL] [LZO2] built on Jul 29 2010
MANAGEMENT: Connected to management server at 127.0.0.1:65493
MANAGEMENT: CMD 'log on'
MANAGEMENT: CMD 'state on'
MANAGEMENT: CMD 'echo on'
MANAGEMENT: CMD 'bytecount 5'
MANAGEMENT: CMD 'hold off'
MANAGEMENT: CMD 'hold release'
WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
LZO compression initialized
Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
MANAGEMENT: >STATE:1344525541,RESOLVE,,,
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): '41690919'
Expected Remote Options hash (VER=V4): '530fdded'
UDPv4 link local: [undef]
UDPv4 link remote: 68.36.200.190:1194
MANAGEMENT: >STATE:1344525541,WAIT,,,
MANAGEMENT: >STATE:1344525541,AUTH,,,
TLS: Initial packet from 68.36.200.190:1194, sid=af4a0b0b bbcc13a9
VERIFY OK: depth=1, /C=US/ST=NJ/L=City/O=Blah/CN=blah/emailAddress=andrew@blah
VERIFY OK: depth=0, /C=US/ST=NJ/O=Blah/CN=Blah/emailAddress=andrew@blah
Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
[Life_Models_LLC] Peer Connection Initiated with 68.36.200.190:1194
MANAGEMENT: >STATE:1344525544,GET_CONFIG,,,
SENT CONTROL [Life_Models_LLC]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.40.1,route 10.0.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.0.0.6 10.0.0.5'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
ROUTE default_gateway=192.168.4.1
MANAGEMENT: >STATE:1344525545,ASSIGN_IP,,10.0.0.6,
TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{4E97FF5D-7AEF-4399-8212-55E45B4885FB}.tap
TAP-Win32 Driver Version 9.7
TAP-Win32 MTU=1500
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.0.6/255.255.255.252 on interface {4E97FF5D-7AEF-4399-8212-55E45B4885FB} [DHCP-serv: 10.0.0.5, lease-time: 31536000]
Successful ARP Flush on interface [18] {4E97FF5D-7AEF-4399-8212-55E45B4885FB}
TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
C:\Windows\system32\route.exe ADD 68.36.200.190 MASK 255.255.255.255 192.168.4.1
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.0.0.5
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.0.0.5
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
MANAGEMENT: >STATE:1344525550,ADD_ROUTES,,,
C:\Windows\system32\route.exe ADD 10.0.0.0 MASK 255.255.255.0 10.0.0.5
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
Initialization Sequence Completed
MANAGEMENT: >STATE:1344525550,CONNECTED,SUCCESS,10.0.0.6,68.36.200.190
MANAGEMENT: CMD 'exit'
MANAGEMENT: Client disconnected
MANAGEMENT: Triggering management exit
TCP/UDP: Closing socket
C:\Windows\system32\route.exe DELETE 10.0.0.0 MASK 255.255.255.0 10.0.0.5
Route deletion via IPAPI succeeded [adaptive]
C:\Windows\system32\route.exe DELETE 68.36.200.190 MASK 255.255.255.255 192.168.4.1
Route deletion via IPAPI succeeded [adaptive]
C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.0.0.5
Route deletion via IPAPI succeeded [adaptive]
C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.0.0.5
Route deletion via IPAPI succeeded [adaptive]
Closing TUN/TAP interface
SIGTERM[soft,management-exit] received, process exiting
MANAGEMENT: >STATE:1344525662,EXITING,management-exit,,
The disconnect and exit was trigger by me on the client and was neither an error nor unexpected
The server side log reads:
OpenVPN 2.1.4 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Oct 10 2011
NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Diffie-Hellman initialized with 1024 bit key
WARNING: file '/etc/openvpn/server.key' is group or others accessible
TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[114688->131072] S=[114688->131072]
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
/sbin/ifconfig tun0 10.0.0.1 pointopoint 10.0.0.2 mtu 1500
/sbin/route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.2
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
UDPv4 link local (bound): [undef]:1194
UDPv4 link remote: [undef]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.0.0.4 size=62
Initialization Sequence Completed
MULTI: multi_create_instance called
72.82.246.84:56079 Re-using SSL/TLS context
72.82.246.84:56079 LZO compression initialized
72.82.246.84:56079 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
72.82.246.84:56079 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
72.82.246.84:56079 TLS: Initial packet from 72.82.246.84:56079, sid=99ab6768 619b98bc
72.82.246.84:56079 VERIFY OK: depth=1, /C=US/ST=NJ/L=City/O=Blah/CN=Blah/emailAddress=andrew@blah
72.82.246.84:56079 VERIFY OK: depth=0, /C=US/ST=NJ/O=Blah/CN=ASB/emailAddress=andrew@blah
72.82.246.84:56079 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
72.82.246.84:56079 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
72.82.246.84:56079 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
72.82.246.84:56079 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
72.82.246.84:56079 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
72.82.246.84:56079 [ASB] Peer Connection Initiated with 72.82.246.84:56079
ASB/72.82.246.84:56079 MULTI: Learn: 10.0.0.6 -> ASB/72.82.246.84:56079
ASB/72.82.246.84:56079 MULTI: primary virtual IP for ASB/72.82.246.84:56079: 10.0.0.6
ASB/72.82.246.84:56079 PUSH: Received control message: 'PUSH_REQUEST'
ASB/72.82.246.84:56079 SENT CONTROL [ASB]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.40.1,route 10.0.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.0.0.6 10.0.0.5' (status=1)
MULTI: multi_create_instance called
72.82.246.84:58245 Re-using SSL/TLS context
72.82.246.84:58245 LZO compression initialized
72.82.246.84:58245 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
72.82.246.84:58245 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
72.82.246.84:58245 TLS: Initial packet from 72.82.246.84:58245, sid=0cfa1d0d f088cc94
72.82.246.84:58245 VERIFY OK: depth=1, /C=US/ST=NJ/L=Blah/O=Blah/CN=Blah/emailAddress=andrew@Blah
72.82.246.84:58245 VERIFY OK: depth=0, /C=US/ST=NJ/O=BLah/CN=ASB/emailAddress=andrew@Blah
72.82.246.84:58245 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
72.82.246.84:58245 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
72.82.246.84:58245 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
72.82.246.84:58245 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
72.82.246.84:58245 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
72.82.246.84:58245 [ASB] Peer Connection Initiated with 72.82.246.84:58245
MULTI: new connection by client 'ASB' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
MULTI: Learn: 10.0.0.6 -> ASB/72.82.246.84:58245
MULTI: primary virtual IP for ASB/72.82.246.84:58245: 10.0.0.6
ASB/72.82.246.84:58245 PUSH: Received control message: 'PUSH_REQUEST'
ASB/72.82.246.84:58245 SENT CONTROL [ASB]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.40.1,route 10.0.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.0.0.6 10.0.0.5' (status=1)
read UDPv4 [EHOSTUNREACH]: No route to host (code=148)
read UDPv4 [EHOSTUNREACH]: No route to host (code=148)
read UDPv4 [EHOSTUNREACH]: No route to host (code=148)
ASB/72.82.246.84:58245 [ASB] Inactivity timeout (--ping-restart), restarting
ASB/72.82.246.84:58245 SIGUSR1[soft,ping-restart] received, client-instance restarting
