dmcdivitt
Hi! If someone can help I would be forever grateful. I am trying to run openvpn on a Buffalo WZR-600DHP router with dd-wrt. It connects but gives no gateway on the client. I want to connect to my home router from anywhere, see computers on my home LAN, and have internet through the VPN, only. No connection using the openvpn gui option so config file used instead. Verified by looking at /tmp/openvpn/openvpn.conf. The last three weekends were spent trying to make this work. I see notes in forum rules above that TCP is a bad way to go and TUN is better than TAP. I would change to WINS server for file sharing and remote desktop, if I can find a set of clear instructions. Have not pursued that yet. Thanks
bridge br0: 192.168.213.1/24
bridge br1: 192.168.5.1/24, this is for guest SSID
********************* server
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
mode server
proto tcp
port 443
dev tap0
server-bridge 192.168.213.1 255.255.255.0 192.168.213.230 192.168.213.254
keepalive 10 120
daemon
verb 5
client-to-client
comp-lzo
management localhost 5001
client-to-client
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
********************* client
client
dev tap
proto tcp
remote xxxxxxxxx 443
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ..\\easy-rsa\\keys\\ca.crt
cert ..\\easy-rsa\\keys\\client1.crt
key ..\\easy-rsa\\keys\\client1.key
ns-cert-type server
comp-lzo
verb 3
redirect-gateway local def1
dhcp-option DNS 192.168.213.1
********************* firewall
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE
iptables -I FORWARD -i tap0 -o br0 -j ACCEPT
iptables -I FORWARD -o tap0 -i br0 -j ACCEPT
dmcdivitt
What I gave for the firewall is wrong. I was playing with settings and copied the wrong file. What I gave will not connect. I am using the following to connect:
1) iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
2) iptables -I INPUT -p tcp --dport 443 -j ACCEPT
3) iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE
4) iptables -I FORWARD -i tap0 -j ACCEPT
5) iptables -I FORWARD -o tap0 -j ACCEPT
If I look at iptables -vnL it will show the effect of commands 4 and 5, but no vpn connection. If I add command 2 it will connect. I should not have to add command 2. This may be part of my problem. Stuff is being blocked for some reason.
dmcdivitt
I tried running openvpn in server mode on one of the PCs. Setup was very easy and it works excellent. All internet goes through the VPN and I can see my LAN as if plugged in to it directly.
For testing I have a guest SSID on the router. Going through that and neighbor's wifi work the same. Neighbor's wifi has a weak signal but I can use that to verify the WAN address is my router.
It's the first time I've seen openvpn work. When I do ipconfig /all on the client, no gateway value is put on the tap connector, but everything runs through the VPN. No firewall commands are needed on the router. I would like to get openvpn going on the router and will eventually, but at least I have something to look at to see what it should be doing. My server and client configurations are pasted below.
*************** server
port 443
proto tcp
dev tap
dh ..\\easy-rsa\\keys\\dh1024.pem
ca ..\\easy-rsa\\keys\\ca.crt
cert ..\\easy-rsa\\keys\\server.crt
key ..\\easy-rsa\\keys\\server.key
server-bridge
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.213.1"
client-to-client
keepalive 10 120
cipher AES-256-CBC
auth MD5
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20
*************** client
client
dev tap
proto tcp
remote xxxxxxxxxx 443
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ..\\config\\keys\\ca.crt
cert ..\\config\\keys\\client1.crt
key ..\\config\\keys\\client1.key
ns-cert-type server
comp-lzo
verb 3
cipher AES-256-CBC
auth MD5
