OpenVPN server integrated in DLink DSR-250N

Thiesy

I bought a DSR-250N from DLink to be able to remotely access my home Network.
I have previously used a PC as an OpenVPN server, it is outdated and needs a lot of energy. So I want to retire it. I ran into problems to get the VPN access running with the new setup and finally started with the basics by following the example (German instructions) from
ftp://ftp.dlink.de/dsr/dsr-250n/documentation/DSR-250N_HowTo_Einrichtung_OpenVPN.zip
using the certificates supplied in the documentation.

After spending several days I have made on last attempt.

Reset the router to defaults
configure internet access
configure ntp
configure dynDNS
configure OpenVPN according to documentation
use OpenVPN with OpenVPN-GUI on client PC (WIN32 XP SP 3)

my client config:
--------
client
remote thiesemann-bihn.homeip.net
auth SHA1
cipher BF-CBC
dev-node openvpn ; I have given the TAP-Win32 Adapter V9 a more descriptive name
ip-win32 adaptive
dev tun1
proto udp
port 1194
ca ca.crt
cert client.crt
key client.key
----------

the client log:
--------
Sat Aug 18 14:24:08 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sat Aug 18 14:24:08 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sat Aug 18 14:24:08 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Aug 18 14:24:08 2012 UDPv4 link local (bound): [undef]:1194
Sat Aug 18 14:24:08 2012 UDPv4 link remote: 80.128.73.121:1194
Sat Aug 18 14:24:08 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sat Aug 18 14:24:10 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sat Aug 18 14:24:14 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sat Aug 18 14:24:22 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sat Aug 18 14:24:38 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sat Aug 18 14:25:08 2012 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Aug 18 14:25:08 2012 TLS Error: TLS handshake failed
Sat Aug 18 14:25:08 2012 SIGUSR1[soft,tls-error] received, process restarting
Sat Aug 18 14:25:10 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sat Aug 18 14:25:10 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Aug 18 14:25:10 2012 UDPv4 link local (bound): [undef]:1194
Sat Aug 18 14:25:10 2012 UDPv4 link remote: 80.128.73.121:1194
Sat Aug 18 14:25:10 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

on and on....
------------------------

The remote ip is checked. To me it just looks like the openVPN server in the router is dead or UDP port 1194 is closed.

Does anybody have any suggestion?
Thank you
Jörg

maikcat

hi there,

To me it just looks like the openVPN server in the router is dead or UDP port 1194 is closed.

i totally agree with you... 🙂

do yuo have access via ssh or telnet to your router?
can you check that openvpn is running and configured to use the correct port/proto?
also are there any firewall rules on openvpn server to block incoming traffic?

Michael.

Thiesy

Michael, thank you for your reply.

I do have access to the router
a) via the browser front end, this is how I configure the router
b) via telnet. I have accessed it but I am unfamiliar with the command line interface. I will get into this more and will post any findings.

No firewall, the DSR is my access router to the internet via DSL. I have sent my config to DLink and they explained that my config was OK and that the router opens the necessary port automatically when enabling the integrated openVNP server. No need to configure any port forwarding. I would not know the target to forward to anyway.

Jörg

novy

I'am having the same problem!!?
Have you found a solution?

Do you have 64bit win7?

This realy is the only thing that is different from the "instuctions" (or the only thing I can not verify)... I know that the tap adapter is 32bit.

I'am (have been) planning to by at least 5 more routers but without VPN I can (will) return this one to the seller and buy something much cheaper 😉 and try it with dd-wrt :p

Thiesy

Meanwhile I have received FW 1.05B73 and just have given it another try.

This is what I am trying to do:
Run an OpenVPN server on the router at home.
Run an OpenVPN client on my laptop while enroute.
Access my network at home.

With the new router FW I am able to connect my laptop using OpenVPN.

I am using 'full tunnel' option and the laptop is assigned proper address and default gateway. The router is showing expected routing table but I am not able to access anything on the LAN.

I am getting closer. I will keep at it.

Jörg

Thiesy

I finally found the last bug. The DSR does not use compression unlike my openVPN Server running on an old PC.

So here are all settings I am using:
On the DSR-250N (FW 1.05B73)
------------
OPENVPN CONFIGURATION
Enable Openvpn: enabled
Mode: Server
Server IP:
Vpn Network: 192.168.201.0
Vpn Netmask: 255.255.255.0
Port: (Default:1194) 1194
Tunnel Protocol: UDP
Encryption Algorithm: BF-CBC
Hash Algorithm: SHA1
Tunnel Type: full tunnel
Enable Client to Client Communication:

OPENVPN AUTHENTIFICATION
I used the certificates and keys and dh generated with the SSL scripts from openvpn.net
the server key was rejected by the DSR-250N, so I used the program xca Ver. 0.9.3 from http://xca.hohnstaedt.de/
to convert the key into *.pem format with the PKCS#8 Option

-----------------
my client config:

client
dev tun

# I do not need the following because I use only one TAP-adapter
;dev-node MyTap

proto udp

# The following line needs to be adjusted to your needs
remote my.lan.net 1194

resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca Ca.crt
cert client.crt
key client.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server

cipher BF-CBC
# Set log file verbosity.
verb 1
log openvpn.log

pikman

Hi!

You wrote about FW 1.05B73 - I see it's original D-Link firmware. Did you try OpenWRT firmware from wiki.openwrt.org ?

I have D-Link DSR-250N and I want use OpenWRT with OpenVPN, but I can't install OpenWRT firmware.
When I load to device image "DSR-250N_A1_FW1.08B39_WW_root_access" ( loaded from http://koti.mbnet.fi/racer123/DSR-250N_A1_FW1.08B39_WW_root_access, see http://wiki.openwrt.org/toh/d-link/dsr-250n ), my router reboots after ( estimated ) 50% of firmware loading, and no OpenWRT firmware on device, router starts again with unchanged manufacturer's firmware.

Any help will be appreciated.

SY, Victor Pikman

Thiesy

I have given up using the DSR-250n as a router and openVPN server.
The current FW didn't support openVPN anymore and I use the DSR-250n as a switch with an Access Point.
Now I run the openVPN server without a glitch on a raspberrypi. I get up to 150kByte/s Bandwidth. That is sufficient for my use.