Laptop integration with ddwrt-wrt router

swifty99

I want to integrate a Win7 laptop via internet completely into my homenetwork, tunneling all traffic an my homeshares through vpn.

After two days search, try and error and try again, I managed quite something but not all. The first attempt was to use an Windows Home Server 2003 as VPN server. However bridging and ICS as is not supported on WHS so a complete integration does not seem possible.
Next attempt ist using an dd-wrt router with integrated OpenVPN support. The dd-wrt router is configered as Wireless AP and vpn server, but is located behind the original network router. I would like to use port 443 which is forwarded to the dd-wrt AP, to avoid VPN blocking by 3G carriers. I followed the instructions here: http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B

What is working:
stable VPN Link over Internet
access to shares of one computer in homenetwork

What is not working:
access to all computers in homenetwork especially home server
ping (no ping at all, no reply from localhost? "target host 10.22.0.50 not reachable" but this is the local vpn IP)
acces to internt over homenet

What is confusing:
lots of isatap tunneldiveces on Win7 client

Any help is welcome.

server config:

mode server
proto udp 
port 443
dev tap0 
server-bridge 10.22.0.1 255.255.0.0 10.22.0.50 10.22.0.100 
 # Gateway (VPN Server)   Subnetmask   Start-IP   End-IP 
keepalive 10 120 
daemon 
comp-lzo
verb 5 
client-to-client 
dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.pem 
key /tmp/openvpn/key.pem

Startup in dd-wrt router

openvpn --mktun --dev tap0 
brctl addif br0 tap0 
ifconfig tap0 0.0.0.0 promisc up

Firewall config of dd-wrt

iptables -A INPUT -i tap0 -j ACCEPT 
iptables -I INPUT 1 -p udp --dport 443 -j ACCEPT

server log:

Sep  2 20:18:38 Freds_spot daemon.notice openvpn[429]: 88.64.131.65:64287 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep  2 20:18:38 Freds_spot daemon.notice openvpn[429]: 88.64.131.65:64287 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep  2 20:18:38 Freds_spot daemon.notice openvpn[429]: 88.64.131.65:64287 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep  2 20:18:38 Freds_spot daemon.notice openvpn[429]: 88.64.131.65:64287 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sep  2 20:18:38 Freds_spot daemon.notice openvpn[429]: 88.64.131.65:64287 [asuszen] Peer Connection Initiated with 88.64.131.65:64287
Sep  2 20:18:38 Freds_spot daemon.notice openvpn[429]: MULTI: new connection by client 'asuszen' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same ce
tificate or username to
Sep  2 20:18:40 Freds_spot daemon.notice openvpn[429]: asuszen/88.64.131.65:64287 PUSH: Received control message: 'PUSH_REQUEST'
Sep  2 20:18:40 Freds_spot daemon.notice openvpn[429]: asuszen/88.64.131.65:64287 SENT CONTROL [asuszen]: 'PUSH_REPLY,route-gateway 10.22.0.1,ping 10,ping-restart 120,ifconfig 10.22.0.50 255.255.0.0' (status=1)
Sep  2 20:18:40 Freds_spot daemon.notice openvpn[429]: asuszen/88.64.131.65:64287 MULTI: Learn: 00:ff:ee:61:34:14 -> asuszen/88.64.131.65:64287
Sep  2 20:20:00 Freds_spot user.info syslog: dhcpfwd : dhcp forwarder daemon successfully started

client config

remote server.dyndns.tv
client 
port 443
dev tap
proto udp
# resolve-retry infinite
nobind
persist-key
# persist-tap
float

ca ca.crt
cert asuszen.crt
key asuszen.key

comp-lzo

ns-cert-type server
route-gateway 192.168.178.1
redirect-gateway

route-method exe
route-delay 2

client log

Sun Sep 02 20:18:36 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sun Sep 02 20:18:36 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Sep 02 20:18:37 2012 LZO compression initialized
Sun Sep 02 20:18:37 2012 UDPv4 link local: [undef]
Sun Sep 02 20:18:37 2012 UDPv4 link remote: 88.64.131.65:443
Sun Sep 02 20:18:38 2012 [server] Peer Connection Initiated with 88.64.131.65:443
Sun Sep 02 20:18:40 2012 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{EE613414-3FC4-476E-9D51-E1F12A4E3793}.tap
Sun Sep 02 20:18:40 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.22.0.50/255.255.0.0 on interface {EE613414-3FC4-476E-9D51-E1F12A4E3793} [DHCP-serv: 10.22.0.0, lease-time: 31536000]
Sun Sep 02 20:18:40 2012 Successful ARP Flush on interface [35] {EE613414-3FC4-476E-9D51-E1F12A4E3793}
 OK!
 OK!
 OK!
Sun Sep 02 20:18:42 2012 Initialization Sequence Completed

krzee

why are you bridging for this goal?
if you would like to achieve this goal without bridging let me know and i'll be happy to help
i dont do bridging so i cant help with that

swifty99

Well,

I thought, to tunnel windows shares (broadcasts), bridging can't be avoided. Could it?

swifty

krzee

you can by running a wins server
broadcasts are only for netbios name resolution, which can be replaced with WINS which runs on IP layer

swifty99

ok, thanks so far.

I installed a wins server. Next step will be to reconfigure the connections to routing. I will post what will happen...

swifty99

Well,

not really better. I have a working connection via internet to the server (ping in OpenVPN networkd is OK). But no ping to the network the server is connected to.

The server config:

port 443
push "route 192.168.54.0 255.255.255.0"
push "dhcp-option DNS 192.168.66.1"
server 192.168.66.0 255.255.255.0

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem


# management parameter allows DD-WRT's OpenVPN Status web page to access the server's management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001


push "dhcp-option WINS 192.168.178.52"

The server firewall config:

iptables -I INPUT 1 -p udp --dport 443 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.178.0/24 -j ACCEPT

 # These next two lines may or may not be necessary.
 # I (dereks) did not need them, but bmatthewshea did.
 # Thus, we include them so that this works for more people:
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

The client config:

remote [].dyndns.tv
port 443

client 
remote-cert-tls server 
dev tun0 
proto udp 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
float 

#If the pushed routes appear not to be added on windows hosts, add the following:
route-delay 30

ca ca.crt 
cert asuszen.crt 
key asuszen.key 

# route-gateway 192.168.178.1
# redirect-gateway
route-method exe
route-delay 2

The client log:

Sat Oct 06 20:10:59 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sat Oct 06 20:10:59 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Oct 06 20:10:59 2012 UDPv4 link local: [undef]
Sat Oct 06 20:10:59 2012 UDPv4 link remote: 88.64.157.107:443
Sat Oct 06 20:11:01 2012 [server] Peer Connection Initiated with 88.64.157.107:443
Sat Oct 06 20:11:04 2012 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{EE613414-3FC4-476E-9D51-E1F12A4E3793}.tap
Sat Oct 06 20:11:04 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.66.6/255.255.255.252 on interface {EE613414-3FC4-476E-9D51-E1F12A4E3793} [DHCP-serv: 192.168.66.5, lease-time: 31536000]
Sat Oct 06 20:11:04 2012 Successful ARP Flush on interface [35] {EE613414-3FC4-476E-9D51-E1F12A4E3793}
 OK!
 OK!
Sat Oct 06 20:11:07 2012 Initialization Sequence Completed
 OK!
 OK!
Sat Oct 06 20:20:43 2012 SIGTERM[hard,] received, process exiting

Any help?