First time posting here, and so my thanks go out to all the great contributors who have gotten me as far as I have. [b]PURPOSE:[/b] I am in US. I am making an OpenVPN server in Japan so I can surf Japanese sites with a Japanese IP address. Many sites prevent foreign IP addresses and public VPNs are actively discovered and blocked. Therefore I need to create my own personal VPN. I also want to access network resources remotely so I like the idea of being attached to the remote network at will. [b] CONCEPT:[/b] Since I'm using a NTT rented fiber-optic modem in japan that I can't do away with (it also handles telephone traffic) and does not have VPN capability, I would like to use OpenVPN on a box behind the NTT firewall. This also allows minimal changes to the current structure (other than opening a port on the firewall). However, the DHCP server will continue to be the original NTT box. [b]PROPOSED STRUCTURE:[/b] [BUFFALLO w/ DD-WRT]-------[NTT Firewall/DHCP Server]------**INTERNET** [b]PROBLEM: [/b] I am able to establish a connection. The server assigns me an IP address within the DHCP pool, and I can ping to all local machines, and visit the firewall and openvpn server administraiton pages on my browser. I can resolve domain names. However, I cannot surf the internet. It looks like it can find my destination webpages, but data is not returned to my browser. It's as if[b] I can find the webpage, but the webpage doesn't know how to find me[/b]. The bottom of my screen perpetually says transferring data from... I suspect [b]something is wrong with the way the gateway or routing table is setup[/b]. This is where I need help [b]SERVER SIDE:[/b] [b]Firewall/Gateway/DHCP Server[/b] NTT RT-200NE (Fiber-optic internet modem) External IP address: 210.197.231.185 Internal IP address: 192.168.1.1 DHCP Address Pool: 192.168.1.2 – 192.168.1.199 (200 and greater are statically assigned) [b]OpenVPN Server[/b] Buffalo WZR-600DHP running DD-WRT v24-sp2 (04/11/13) std Static IP address: 192.168.1.253 WAN and DHCP disabled in firmware Also functions as wireless router for local network clients. Clients are assigned IP addresses from DHCP pool above. [b]OpenVPN Server (DD-WRT) Settings:[/b] [i]Administration-->Commands tab[/i] Startup Commands: [code]openvpn --mktun --dev tap0 --script-security 2 brctl addif br0 tap0 ifconfig tap0 0.0.0.0 promisc up [/code] Firewall Commands: [code]iptables -A INPUT -i tap0 -j ACCEPT iptables -I INPUT -p udp --dport 1194 -j ACCEPT iptables -I INPUT -p tcp --dport 1194 -j ACCEPT iptables -I FORWARD -s 192.168.1.0/24 -j ACCEPT iptables -I FORWARD -i br0 -o tap0 -j ACCEPT iptables -I FORWARD -i tap0 -o br0 -j ACCEPT iptables -A POSTROUTING -t nat -o tap0 -j MASQUERADE iptables -A POSTROUTING -t nat -s 192.168.1.0/24 -o eth0 -j MASQUERADE[/code] [i] Services-->OpenVPN tab [/i] (Keys have been excluded from pictures below. They seem to be working.) [img]http://postimg.org/image/u4d9epa29/[/img] [img]http://postimg.org/image/97edcjuhf/[/img] [url]http://postimg.org/image/u4d9epa29/[/url] [url]http://postimg.org/image/97edcjuhf/[/url] [b]Server Log:[/b] [i]Status-->OpenVPN tab[/i] [code]Serverlog 19700101 00:00:19 I OpenVPN 2.3.1 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 11 2013 19700101 00:00:19 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14 19700101 00:00:19 W NOTE: when bridging your LAN adapter with the TAP adapter note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to 19700101 00:00:19 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 20130810 06:53:05 Diffie-Hellman initialized with 1024 bit key 20130810 06:53:05 Socket Buffers: R=[172032->131072] S=[172032->131072] 20130810 06:53:05 I TUN/TAP device tap2 opened 20130810 06:53:05 TUN/TAP TX queue length set to 100 20130810 06:53:09 I UDPv4 link local (bound): [undef] 20130810 06:53:09 I UDPv4 link remote: [undef] 20130810 06:53:09 MULTI: multi_init called r=256 v=256 20130810 06:53:09 I Initialization Sequence Completed 20130810 06:53:17 76.169.39.137:62142 TLS: Initial packet from [AF_INET]76.169.39.137:62142 sid=31578fde 48a1d58e 20130810 06:53:20 76.169.39.137:62142 VERIFY OK: depth=1 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=changeme name=changeme emailAddress=mail@host.domain 20130810 06:53:20 76.169.39.137:62142 VERIFY OK: depth=0 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=client1 name=client1 emailAddress=mail@host.domain 20130810 06:53:22 76.169.39.137:62142 NOTE: --mute triggered... 20130810 06:53:22 76.169.39.137:62142 5 variation(s) on previous 3 message(s) suppressed by --mute 20130810 06:53:22 I 76.169.39.137:62142 [client1] Peer Connection Initiated with [AF_INET]76.169.39.137:62142 20130810 06:53:22 N client1/76.169.39.137:62142 MULTI: no dynamic or static remote --ifconfig address is available for client1/76.169.39.137:62142 20130810 06:53:25 client1/76.169.39.137:62142 PUSH: Received control message: 'PUSH_REQUEST' 20130810 06:53:25 I client1/76.169.39.137:62142 send_push_reply(): safe_cap=940 20130810 06:53:25 client1/76.169.39.137:62142 SENT CONTROL [client1]: 'PUSH_REPLY redirect-gateway def1 redirect-gateway def1 route-gateway dhcp ping 10 ping-restart 120' (status=1) 20130810 06:53:25 client1/76.169.39.137:62142 MULTI: Learn: 00:ff:1d:f9:f5:2c -> client1/76.169.39.137:62142 20130810 06:53:35 N client1/76.169.39.137:62142 write UDPv4: Message too long (code=97) 20130810 06:53:35 N client1/76.169.39.137:62142 write UDPv4: Message too long (code=97) 20130810 06:53:35 N client1/76.169.39.137:62142 write UDPv4: Message too long (code=97) 20130810 06:53:35 client1/76.169.39.137:62142 NOTE: --mute triggered... 20130810 07:08:00 client1/76.169.39.137:62142 63 variation(s) on previous 3 message(s) suppressed by --mute 20130810 07:08:00 client1/76.169.39.137:62142 SIGTERM[soft remote-exit] received client-instance exiting 20130810 07:11:44 76.169.39.137:57449 TLS: Initial packet from [AF_INET]76.169.39.137:57449 sid=aa968824 18bcd2e4 20130810 07:11:47 76.169.39.137:57449 VERIFY OK: depth=1 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=changeme name=changeme emailAddress=mail@host.domain 20130810 07:11:47 76.169.39.137:57449 VERIFY OK: depth=0 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=client1 name=client1 emailAddress=mail@host.domain 20130810 07:11:47 76.169.39.137:57449 NOTE: --mute triggered... 20130810 07:11:48 76.169.39.137:57449 5 variation(s) on previous 3 message(s) suppressed by --mute 20130810 07:11:48 I 76.169.39.137:57449 [client1] Peer Connection Initiated with [AF_INET]76.169.39.137:57449 20130810 07:11:48 N client1/76.169.39.137:57449 MULTI: no dynamic or static remote --ifconfig address is available for client1/76.169.39.137:57449 20130810 07:11:49 client1/76.169.39.137:57449 PUSH: Received control message: 'PUSH_REQUEST' 20130810 07:11:49 I client1/76.169.39.137:57449 send_push_reply(): safe_cap=940 20130810 07:11:49 client1/76.169.39.137:57449 SENT CONTROL [client1]: 'PUSH_REPLY redirect-gateway def1 redirect-gateway def1 route-gateway dhcp ping 10 ping-restart 120' (status=1) 20130810 07:11:49 client1/76.169.39.137:57449 MULTI: Learn: 00:ff:1d:f9:f5:2c -> client1/76.169.39.137:57449 20130810 07:11:58 N client1/76.169.39.137:57449 write UDPv4: Message too long (code=97) 20130810 07:11:58 N client1/76.169.39.137:57449 write UDPv4: Message too long (code=97) 20130810 07:11:58 N client1/76.169.39.137:57449 write UDPv4: Message too long (code=97) 20130810 07:11:59 client1/76.169.39.137:57449 NOTE: --mute triggered... 20130810 07:23:13 31 variation(s) on previous 3 message(s) suppressed by --mute 20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 20130810 07:23:13 D MANAGEMENT: CMD 'state' 20130810 07:23:13 MANAGEMENT: Client disconnected 20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 20130810 07:23:13 D MANAGEMENT: CMD 'state' 20130810 07:23:13 MANAGEMENT: Client disconnected 20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 20130810 07:23:13 D MANAGEMENT: CMD 'state' 20130810 07:23:13 MANAGEMENT: Client disconnected 20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 20130810 07:23:13 D MANAGEMENT: CMD 'status 2' 20130810 07:23:13 MANAGEMENT: Client disconnected 20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 20130810 07:23:13 D MANAGEMENT: CMD 'log 500' 19700101 00:00:00 Clientlog [/code] [b]CLIENT SIDE: [/b] [b]Firewall/DHCP Server (Netgear Cable Modem)[/b] External IP address: 76.169.39.137 Internal IP address: 192.168.0.1 DHCP Address Pool: 192.168.0.100 – 192.168.1.199 (99 and below are statically assigned) [b]Client PC[/b] IP Address: 192.168.0.103 (assigned by above DHCP server) [b]Client Settings (Using OpenVPN Client for Windows 7)[/b] [code]client proto udp dev tap remote sakuragi.no-ip.org 1194 resolv-retry infinite nobind persist-key persist-tun mute-replay-warnings ns-cert-type server comp-lzo verb 3 explicit-exit-notify 2 ping 10 ping-restart 60 tun-mtu 1500 #route-method exe #route-delay 2 ca "C:\\Users\\D420T\\Documents\\OpenVPN\\keys\\ca.crt" cert "C:\\Users\\D420T\\Documents\\OpenVPN\\keys\\client1.crt" key "C:\\Users\\D420T\\Documents\\OpenVPN\\keys\\client1.key"[/code] [b]Client Log[/b] [code]Sat Aug 10 00:11:56 2013 Note: option http-proxy-fallback ignored because no TCP-based connection profiles are defined Sat Aug 10 00:11:56 2013 OpenVPNAS 2.1.1oOAS Win32-MSVC++ [SSL] [LZO2] built on Jul 29 2010 Sat Aug 10 00:11:56 2013 MANAGEMENT: Connected to management server at 127.0.0.1:37971 Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'log on' Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'state on' Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'echo on' Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'bytecount 5' Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'hold off' Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'hold release' Sat Aug 10 00:11:56 2013 NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Sat Aug 10 00:11:57 2013 LZO compression initialized Sat Aug 10 00:11:57 2013 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ] Sat Aug 10 00:11:57 2013 Socket Buffers: R=[8192->8192] S=[64512->64512] Sat Aug 10 00:11:57 2013 MANAGEMENT: >STATE:1376118717,RESOLVE,,, Sat Aug 10 00:11:57 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ] Sat Aug 10 00:11:57 2013 Local Options hash (VER=V4): 'd79ca330' Sat Aug 10 00:11:57 2013 Expected Remote Options hash (VER=V4): 'f7df56b8' Sat Aug 10 00:11:57 2013 UDPv4 link local: [undef] Sat Aug 10 00:11:57 2013 UDPv4 link remote: 210.197.231.185:1194 Sat Aug 10 00:11:57 2013 MANAGEMENT: >STATE:1376118717,WAIT,,, Sat Aug 10 00:11:57 2013 MANAGEMENT: >STATE:1376118717,AUTH,,, Sat Aug 10 00:11:57 2013 TLS: Initial packet from 210.197.231.185:1194, sid=9677f2dc bc40971f Sat Aug 10 00:11:58 2013 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain Sat Aug 10 00:11:58 2013 VERIFY OK: nsCertType=SERVER Sat Aug 10 00:11:58 2013 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=server/name=server/emailAddress=mail@host.domain Sat Aug 10 00:12:00 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Sat Aug 10 00:12:00 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Sat Aug 10 00:12:00 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Sat Aug 10 00:12:00 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Sat Aug 10 00:12:00 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA Sat Aug 10 00:12:00 2013 [server] Peer Connection Initiated with 210.197.231.185:1194 Sat Aug 10 00:12:01 2013 MANAGEMENT: >STATE:1376118721,GET_CONFIG,,, Sat Aug 10 00:12:02 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Sat Aug 10 00:12:02 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120' Sat Aug 10 00:12:02 2013 OPTIONS IMPORT: timers and/or timeouts modified Sat Aug 10 00:12:02 2013 OPTIONS IMPORT: route options modified Sat Aug 10 00:12:02 2013 OPTIONS IMPORT: route-related options modified Sat Aug 10 00:12:02 2013 ROUTE default_gateway=192.168.0.1 Sat Aug 10 00:12:02 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{1DF9F52C-28A2-4926-AE2F-435F485B7D00}.tap Sat Aug 10 00:12:02 2013 TAP-Win32 Driver Version 9.7 Sat Aug 10 00:12:02 2013 TAP-Win32 MTU=1500 Sat Aug 10 00:12:02 2013 Successful ARP Flush on interface [20] {1DF9F52C-28A2-4926-AE2F-435F485B7D00} Sat Aug 10 00:12:02 2013 Extracted DHCP router address: 192.168.1.1 Sat Aug 10 00:12:07 2013 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up Sat Aug 10 00:12:07 2013 C:\Windows\system32\route.exe ADD 210.197.231.185 MASK 255.255.255.255 192.168.0.1 Sat Aug 10 00:12:07 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4 Sat Aug 10 00:12:07 2013 Route addition via IPAPI succeeded [adaptive] Sat Aug 10 00:12:07 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.1.1 Sat Aug 10 00:12:07 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4 Sat Aug 10 00:12:07 2013 Route addition via IPAPI succeeded [adaptive] Sat Aug 10 00:12:07 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.1.1 Sat Aug 10 00:12:07 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4 Sat Aug 10 00:12:07 2013 Route addition via IPAPI succeeded [adaptive] Sat Aug 10 00:12:07 2013 Initialization Sequence Completed Sat Aug 10 00:12:07 2013 MANAGEMENT: >STATE:1376118727,CONNECTED,SUCCESS,,210.197.231.185[/code] [b]Client PC ipconfig/all command:[/b] [code]C:\Users\D420T>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : D420T-PC Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Local Area Connection 2: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : TAP-Win32 Adapter OAS Physical Address. . . . . . . . . : 00-FF-1D-F9-F5-2C DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:c90:8000:27d5:3139:c001:ca5b:2357(Pr eferred) Temporary IPv6 Address. . . . . . : 2001:c90:8000:27d5:3424:fd6d:399a:4bcd(Pr eferred) Link-local IPv6 Address . . . . . : fe80::3139:c001:ca5b:2357%20(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.7(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, August 09, 2013 10:47:33 PM Lease Expires . . . . . . . . . . : Saturday, August 10, 2013 11:53:37 PM Default Gateway . . . . . . . . . : fe80::ff:fe02:2028%20 DHCP Server . . . . . . . . . . . : 192.168.1.1 DNS Servers . . . . . . . . . . . : 192.168.1.1 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Bluetooth Network Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network) Physical Address. . . . . . . . . : 00-16-41-B4-18-79 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controlle r Physical Address. . . . . . . . . : 00-18-8B-AD-64-E7 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::f448:ee71:1820:8d8%12(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.0.103(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, August 09, 2013 10:42:58 PM Lease Expires . . . . . . . . . . : Saturday, August 10, 2013 12:43:00 AM Default Gateway . . . . . . . . . : 192.168.0.1 DHCP Server . . . . . . . . . . . : 192.168.0.1 DHCPv6 IAID . . . . . . . . . . . : 268441739 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-C5-F9-18-00-18-8B-AD-64-E7 DNS Servers . . . . . . . . . . . : 209.18.47.61 209.18.47.62 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter isatap.{43994EB2-1515-435F-9A7A-3CAFA2A09468}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 13: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fd:242c:b77:3f57:fef8(Prefe rred) Link-local IPv6 Address . . . . . : fe80::242c:b77:3f57:fef8%13(Preferred) Default Gateway . . . . . . . . . : NetBIOS over Tcpip. . . . . . . . : Disabled Tunnel adapter isatap.{1DF9F52C-28A2-4926-AE2F-435F485B7D00}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter isatap.{B15C1AF4-A1A4-4985-9BA2-EFED7348E860}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes C:\Users\D420T>[/code] Can anyone please help me get on the internet? I'm happy to provide any other troubleshooting data you might need. Thank you so much!

though i am not familiar with ddwrt based routers i noticed a couple of things on your setup.. [quote]server mode bridge[/quote] ok bridging setup... [quote]network 192.168.1.1[/quote] are you sure this shouldnt be 192.168.1.0 ? [quote]pool start 192.168.200 - pool end 192.168.249[/quote] are you sure the above shouldnt be 192.168.1.200 and 192.168.1.249???? :? can you check them out please? Michael.

Michael, thank you for the reply. So, I fixed a couple of things as you pointed out, but I still lack internet capability. 1. Added push "route 0.0.0.0 0.0.0.0 192.168.1.1" to my server config. Now Gateway shows in my Client's IP config. 2. I had some typos that were probably inconsequential to my problem. My DHCP address pool from my server was missing the subnet. Since I was actually letting the main firewall/DHCP server on the subnet (192.168.1.1) assign addresses to clients, that part of my server config probably was ignored. Here are the new changes, and my client side ipconfig, and route print outputs New Server Config Screen Shots: http://postimg.org/image/dye712bp9/ http://postimg.org/image/n2mb04qoj/ c:\ipconfig /all: [code]C:\>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : D420T-PC Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Local Area Connection 2: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : TAP-Win32 Adapter OAS Physical Address. . . . . . . . . : 00-FF-1D-F9-F5-2C DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.1.7(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Tuesday, August 13, 2013 4:47:55 PM Lease Expires . . . . . . . . . . : Wednesday, August 14, 2013 5:38:34 PM Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DNS Servers . . . . . . . . . . . : 192.168.1.1 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controlle r Physical Address. . . . . . . . . : 00-18-8B-AD-64-E7 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.0.103(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Monday, August 12, 2013 11:04:54 AM Lease Expires . . . . . . . . . . : Tuesday, August 13, 2013 6:36:44 PM Default Gateway . . . . . . . . . : 192.168.0.1 DHCP Server . . . . . . . . . . . : 192.168.0.1 DNS Servers . . . . . . . . . . . : 209.18.47.61 209.18.47.62 NetBIOS over Tcpip. . . . . . . . : Enabled[/code] c:\route print: [code]C:\Users\D420T>route print =========================================================================== Interface List 20...00 ff 1d f9 f5 2c ......TAP-Win32 Adapter OAS 14...00 16 41 b4 18 79 ......Bluetooth Device (Personal Area Network) 12...00 18 8b ad 64 e7 ......Broadcom NetXtreme 57xx Gigabit Controller 1...........................Software Loopback Interface 1 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface 17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3 28...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5 =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.103 10 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.7 30 0.0.0.0 128.0.0.0 192.168.1.1 192.168.1.7 30 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 128.0.0.0 128.0.0.0 192.168.1.1 192.168.1.7 30 192.168.0.0 255.255.255.0 On-link 192.168.0.103 266 192.168.0.103 255.255.255.255 On-link 192.168.0.103 266 192.168.0.255 255.255.255.255 On-link 192.168.0.103 266 192.168.1.0 255.255.255.0 On-link 192.168.1.7 286 192.168.1.7 255.255.255.255 On-link 192.168.1.7 286 192.168.1.255 255.255.255.255 On-link 192.168.1.7 286 210.197.231.185 255.255.255.255 192.168.0.1 192.168.0.103 10 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.0.103 266 224.0.0.0 240.0.0.0 On-link 192.168.1.7 286 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.0.103 266 255.255.255.255 255.255.255.255 On-link 192.168.1.7 286 =========================================================================== Persistent Routes: None IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 13 58 ::/0 On-link 1 306 ::1/128 On-link 13 58 2001::/32 On-link 13 306 2001:0:9d38:6abd:184d:36ac:3f57:fef8/128 On-link 13 306 fe80::/64 On-link 13 306 fe80::184d:36ac:3f57:fef8/128 On-link 1 306 ff00::/8 On-link 13 306 ff00::/8 On-link =========================================================================== Persistent Routes: None [/code]

hello there, [quote]Sat Aug 10 00:11:56 2013 OpenVPNAS 2.1.1oOAS Win32-MSVC++ [SSL] [LZO2] built on Jul 29 2010[/quote] please download & install the open source version of openvpn on your client (you are using the AS). Michael.

OK, I installed the other version. Is the AC not open source? Is that why I needed to change versions? Either way, my problem still persists. I think my problem has to do with routing on the server side. I can ping bidirectionally everywhere within the network, to AND from my client (including the true gateway on the server side). Here's what my network looks like (I made this drawing) [url=http://postimg.org/image/mhd5oqgfx/][img]http://s6.postimg.org/mhd5oqgfx/Network_Map.jpg[/img][/url] As you can see in the diagram, ping is no problem. I can also resolve domain names thru the server network. When I try to access the internet, it seems to find the address, but hangs waiting for data to return. This website seems to describe my problem, but I don't know how to go about fixing it. http://blog.remibergsma.com/2013/01/13/howto-connect-to-hosts-on-a-remote-network-using-openvpn-and-some-routing/

Michael, Thank you for your suggestions. I made changes as recommended, but problem persists. I will include some more screen shots of my settings on my DDWRT/OpenVPN server (192.168.1.253). I have marked a few places in red that seem like likely problem spots. Basic Setup Tab: [url=http://postimg.org/image/gerqt0nul/][img]http://s6.postimg.org/gerqt0nul/Basic_Setup.jpg[/img][/url] Advanced Routing Tab: [url=http://postimg.org/image/wbqipqg8t/][img]http://s6.postimg.org/wbqipqg8t/Adv_Routing.jpg[/img][/url] Networking Tab: [url=http://postimg.org/image/nkjhvgwxp/][img]http://s6.postimg.org/nkjhvgwxp/Networking.jpg[/img][/url] Services Tab: [url=http://postimg.org/image/pqdspz0e5/][img]http://s6.postimg.org/pqdspz0e5/Services.jpg[/img][/url] Administration Commands Tab: [url=http://postimg.org/image/pqdspz0e5/][img]http://s6.postimg.org/pqdspz0e5/Services.jpg[/img][/url]

Opps The last image should be this: Administration commands:(startup and firewall) [url=http://postimg.org/image/fzgh001x9/][img]http://s6.postimg.org/fzgh001x9/Admin_Commands2.jpg[/img][/url]

HELP! I can't connect to Internet! Need a PRO!

tcaradonna

First time posting here, and so my thanks go out to all the great contributors who have gotten me as far as I have.

PURPOSE: I am in US. I am making an OpenVPN server in Japan so I can surf Japanese sites with a Japanese IP address. Many sites prevent foreign IP addresses and public VPNs are actively discovered and blocked. Therefore I need to create my own personal VPN. I also want to access network resources remotely so I like the idea of being attached to the remote network at will.

CONCEPT: Since I'm using a NTT rented fiber-optic modem in japan that I can't do away with (it also handles telephone traffic) and does not have VPN capability, I would like to use OpenVPN on a box behind the NTT firewall. This also allows minimal changes to the current structure (other than opening a port on the firewall). However, the DHCP server will continue to be the original NTT box.

PROPOSED STRUCTURE:

[BUFFALLO w/ DD-WRT]-------[NTT Firewall/DHCP Server]------**INTERNET**

PROBLEM: I am able to establish a connection. The server assigns me an IP address within the DHCP pool, and I can ping to all local machines, and visit the firewall and openvpn server administraiton pages on my browser. I can resolve domain names. However, I cannot surf the internet. It looks like it can find my destination webpages, but data is not returned to my browser. It's as if I can find the webpage, but the webpage doesn't know how to find me. The bottom of my screen perpetually says transferring data from...

I suspect something is wrong with the way the gateway or routing table is setup. This is where I need help

SERVER SIDE:
Firewall/Gateway/DHCP Server
NTT RT-200NE (Fiber-optic internet modem)
External IP address: 210.197.231.185
Internal IP address: 192.168.1.1
DHCP Address Pool: 192.168.1.2 – 192.168.1.199 (200 and greater are statically assigned)

OpenVPN Server
Buffalo WZR-600DHP running DD-WRT v24-sp2 (04/11/13) std
Static IP address: 192.168.1.253
WAN and DHCP disabled in firmware
Also functions as wireless router for local network clients. Clients are assigned IP addresses from DHCP pool above.

OpenVPN Server (DD-WRT) Settings:
Administration-->Commands tab
Startup Commands:

openvpn --mktun --dev tap0 --script-security 2
brctl addif br0 tap0 
ifconfig tap0 0.0.0.0 promisc up

Firewall Commands:

iptables -A INPUT -i tap0 -j ACCEPT 
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I INPUT -p tcp --dport 1194 -j ACCEPT  
iptables -I FORWARD -s 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tap0 -j ACCEPT
iptables -I FORWARD -i tap0 -o br0 -j ACCEPT
iptables -A POSTROUTING -t nat -o tap0 -j MASQUERADE
iptables -A POSTROUTING -t nat -s 192.168.1.0/24 -o eth0 -j MASQUERADE

Services-->OpenVPN tab
(Keys have been excluded from pictures below. They seem to be working.)

http://postimg.org/image/u4d9epa29/
http://postimg.org/image/97edcjuhf/

Server Log:
Status-->OpenVPN tab

Serverlog 19700101 00:00:19 I OpenVPN 2.3.1 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 11 2013 
19700101 00:00:19 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14 
19700101 00:00:19 W NOTE: when bridging your LAN adapter with the TAP adapter note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to 
19700101 00:00:19 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 
20130810 06:53:05 Diffie-Hellman initialized with 1024 bit key 
20130810 06:53:05 Socket Buffers: R=[172032->131072] S=[172032->131072] 
20130810 06:53:05 I TUN/TAP device tap2 opened 
20130810 06:53:05 TUN/TAP TX queue length set to 100 
20130810 06:53:09 I UDPv4 link local (bound): [undef] 
20130810 06:53:09 I UDPv4 link remote: [undef] 
20130810 06:53:09 MULTI: multi_init called r=256 v=256 
20130810 06:53:09 I Initialization Sequence Completed 
20130810 06:53:17 76.169.39.137:62142 TLS: Initial packet from [AF_INET]76.169.39.137:62142 sid=31578fde 48a1d58e 
20130810 06:53:20 76.169.39.137:62142 VERIFY OK: depth=1 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=changeme name=changeme emailAddress=mail@host.domain 
20130810 06:53:20 76.169.39.137:62142 VERIFY OK: depth=0 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=client1 name=client1 emailAddress=mail@host.domain 
20130810 06:53:22 76.169.39.137:62142 NOTE: --mute triggered... 
20130810 06:53:22 76.169.39.137:62142 5 variation(s) on previous 3 message(s) suppressed by --mute 
20130810 06:53:22 I 76.169.39.137:62142 [client1] Peer Connection Initiated with [AF_INET]76.169.39.137:62142 
20130810 06:53:22 N client1/76.169.39.137:62142 MULTI: no dynamic or static remote --ifconfig address is available for client1/76.169.39.137:62142 
20130810 06:53:25 client1/76.169.39.137:62142 PUSH: Received control message: 'PUSH_REQUEST' 
20130810 06:53:25 I client1/76.169.39.137:62142 send_push_reply(): safe_cap=940 
20130810 06:53:25 client1/76.169.39.137:62142 SENT CONTROL [client1]: 'PUSH_REPLY redirect-gateway def1 redirect-gateway def1 route-gateway dhcp ping 10 ping-restart 120' (status=1) 
20130810 06:53:25 client1/76.169.39.137:62142 MULTI: Learn: 00:ff:1d:f9:f5:2c -> client1/76.169.39.137:62142 
20130810 06:53:35 N client1/76.169.39.137:62142 write UDPv4: Message too long (code=97) 
20130810 06:53:35 N client1/76.169.39.137:62142 write UDPv4: Message too long (code=97) 
20130810 06:53:35 N client1/76.169.39.137:62142 write UDPv4: Message too long (code=97) 
20130810 06:53:35 client1/76.169.39.137:62142 NOTE: --mute triggered... 
20130810 07:08:00 client1/76.169.39.137:62142 63 variation(s) on previous 3 message(s) suppressed by --mute 
20130810 07:08:00 client1/76.169.39.137:62142 SIGTERM[soft remote-exit] received client-instance exiting 
20130810 07:11:44 76.169.39.137:57449 TLS: Initial packet from [AF_INET]76.169.39.137:57449 sid=aa968824 18bcd2e4 
20130810 07:11:47 76.169.39.137:57449 VERIFY OK: depth=1 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=changeme name=changeme emailAddress=mail@host.domain 
20130810 07:11:47 76.169.39.137:57449 VERIFY OK: depth=0 C=US ST=CA L=SanFrancisco O=OpenVPN OU=changeme CN=client1 name=client1 emailAddress=mail@host.domain 
20130810 07:11:47 76.169.39.137:57449 NOTE: --mute triggered... 
20130810 07:11:48 76.169.39.137:57449 5 variation(s) on previous 3 message(s) suppressed by --mute 
20130810 07:11:48 I 76.169.39.137:57449 [client1] Peer Connection Initiated with [AF_INET]76.169.39.137:57449 
20130810 07:11:48 N client1/76.169.39.137:57449 MULTI: no dynamic or static remote --ifconfig address is available for client1/76.169.39.137:57449 
20130810 07:11:49 client1/76.169.39.137:57449 PUSH: Received control message: 'PUSH_REQUEST' 
20130810 07:11:49 I client1/76.169.39.137:57449 send_push_reply(): safe_cap=940 
20130810 07:11:49 client1/76.169.39.137:57449 SENT CONTROL [client1]: 'PUSH_REPLY redirect-gateway def1 redirect-gateway def1 route-gateway dhcp ping 10 ping-restart 120' (status=1) 
20130810 07:11:49 client1/76.169.39.137:57449 MULTI: Learn: 00:ff:1d:f9:f5:2c -> client1/76.169.39.137:57449 
20130810 07:11:58 N client1/76.169.39.137:57449 write UDPv4: Message too long (code=97) 
20130810 07:11:58 N client1/76.169.39.137:57449 write UDPv4: Message too long (code=97) 
20130810 07:11:58 N client1/76.169.39.137:57449 write UDPv4: Message too long (code=97) 
20130810 07:11:59 client1/76.169.39.137:57449 NOTE: --mute triggered... 
20130810 07:23:13 31 variation(s) on previous 3 message(s) suppressed by --mute 
20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 
20130810 07:23:13 D MANAGEMENT: CMD 'state' 
20130810 07:23:13 MANAGEMENT: Client disconnected 
20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 
20130810 07:23:13 D MANAGEMENT: CMD 'state' 
20130810 07:23:13 MANAGEMENT: Client disconnected 
20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 
20130810 07:23:13 D MANAGEMENT: CMD 'state' 
20130810 07:23:13 MANAGEMENT: Client disconnected 
20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 
20130810 07:23:13 D MANAGEMENT: CMD 'status 2' 
20130810 07:23:13 MANAGEMENT: Client disconnected 
20130810 07:23:13 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14 
20130810 07:23:13 D MANAGEMENT: CMD 'log 500' 
19700101 00:00:00 
Clientlog

CLIENT SIDE:
Firewall/DHCP Server (Netgear Cable Modem)
External IP address: 76.169.39.137
Internal IP address: 192.168.0.1
DHCP Address Pool: 192.168.0.100 – 192.168.1.199 (99 and below are statically assigned)

Client PC
IP Address: 192.168.0.103 (assigned by above DHCP server)

Client Settings (Using OpenVPN Client for Windows 7)

client
proto udp
dev tap

remote sakuragi.no-ip.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server

comp-lzo                              
verb 3                     
explicit-exit-notify 2
ping 10
ping-restart 60
tun-mtu 1500
#route-method exe
#route-delay 2

ca "C:\\Users\\D420T\\Documents\\OpenVPN\\keys\\ca.crt"                
cert "C:\\Users\\D420T\\Documents\\OpenVPN\\keys\\client1.crt"
key "C:\\Users\\D420T\\Documents\\OpenVPN\\keys\\client1.key"

Client Log

Sat Aug 10 00:11:56 2013 Note: option http-proxy-fallback ignored because no TCP-based connection profiles are defined
Sat Aug 10 00:11:56 2013 OpenVPNAS 2.1.1oOAS Win32-MSVC++ [SSL] [LZO2] built on Jul 29 2010
Sat Aug 10 00:11:56 2013 MANAGEMENT: Connected to management server at 127.0.0.1:37971
Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'log on'
Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'state on'
Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'echo on'
Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'bytecount 5'
Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'hold off'
Sat Aug 10 00:11:56 2013 MANAGEMENT: CMD 'hold release'
Sat Aug 10 00:11:56 2013 NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Aug 10 00:11:57 2013 LZO compression initialized
Sat Aug 10 00:11:57 2013 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Aug 10 00:11:57 2013 Socket Buffers: R=[8192->8192] S=[64512->64512]
Sat Aug 10 00:11:57 2013 MANAGEMENT: >STATE:1376118717,RESOLVE,,,
Sat Aug 10 00:11:57 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Sat Aug 10 00:11:57 2013 Local Options hash (VER=V4): 'd79ca330'
Sat Aug 10 00:11:57 2013 Expected Remote Options hash (VER=V4): 'f7df56b8'
Sat Aug 10 00:11:57 2013 UDPv4 link local: [undef]
Sat Aug 10 00:11:57 2013 UDPv4 link remote: 210.197.231.185:1194
Sat Aug 10 00:11:57 2013 MANAGEMENT: >STATE:1376118717,WAIT,,,
Sat Aug 10 00:11:57 2013 MANAGEMENT: >STATE:1376118717,AUTH,,,
Sat Aug 10 00:11:57 2013 TLS: Initial packet from 210.197.231.185:1194, sid=9677f2dc bc40971f
Sat Aug 10 00:11:58 2013 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Sat Aug 10 00:11:58 2013 VERIFY OK: nsCertType=SERVER
Sat Aug 10 00:11:58 2013 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=OpenVPN/OU=changeme/CN=server/name=server/emailAddress=mail@host.domain
Sat Aug 10 00:12:00 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Aug 10 00:12:00 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 10 00:12:00 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Aug 10 00:12:00 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 10 00:12:00 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Aug 10 00:12:00 2013 [server] Peer Connection Initiated with 210.197.231.185:1194
Sat Aug 10 00:12:01 2013 MANAGEMENT: >STATE:1376118721,GET_CONFIG,,,
Sat Aug 10 00:12:02 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Aug 10 00:12:02 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120'
Sat Aug 10 00:12:02 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sat Aug 10 00:12:02 2013 OPTIONS IMPORT: route options modified
Sat Aug 10 00:12:02 2013 OPTIONS IMPORT: route-related options modified
Sat Aug 10 00:12:02 2013 ROUTE default_gateway=192.168.0.1
Sat Aug 10 00:12:02 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{1DF9F52C-28A2-4926-AE2F-435F485B7D00}.tap
Sat Aug 10 00:12:02 2013 TAP-Win32 Driver Version 9.7 
Sat Aug 10 00:12:02 2013 TAP-Win32 MTU=1500
Sat Aug 10 00:12:02 2013 Successful ARP Flush on interface [20] {1DF9F52C-28A2-4926-AE2F-435F485B7D00}
Sat Aug 10 00:12:02 2013 Extracted DHCP router address: 192.168.1.1
Sat Aug 10 00:12:07 2013 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Sat Aug 10 00:12:07 2013 C:\Windows\system32\route.exe ADD 210.197.231.185 MASK 255.255.255.255 192.168.0.1
Sat Aug 10 00:12:07 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Sat Aug 10 00:12:07 2013 Route addition via IPAPI succeeded [adaptive]
Sat Aug 10 00:12:07 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.1.1
Sat Aug 10 00:12:07 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Aug 10 00:12:07 2013 Route addition via IPAPI succeeded [adaptive]
Sat Aug 10 00:12:07 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.1.1
Sat Aug 10 00:12:07 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Aug 10 00:12:07 2013 Route addition via IPAPI succeeded [adaptive]
Sat Aug 10 00:12:07 2013 Initialization Sequence Completed
Sat Aug 10 00:12:07 2013 MANAGEMENT: >STATE:1376118727,CONNECTED,SUCCESS,,210.197.231.185

Client PC ipconfig/all command:

C:\Users\D420T>ipconfig /all
Windows IP Configuration

   Host Name . . . . . . . . . . . . : D420T-PC
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Win32 Adapter OAS
   Physical Address. . . . . . . . . : 00-FF-1D-F9-F5-2C
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:c90:8000:27d5:3139:c001:ca5b:2357(Pr
eferred)
   Temporary IPv6 Address. . . . . . : 2001:c90:8000:27d5:3424:fd6d:399a:4bcd(Pr
eferred)
   Link-local IPv6 Address . . . . . : fe80::3139:c001:ca5b:2357%20(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.7(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Friday, August 09, 2013 10:47:33 PM
   Lease Expires . . . . . . . . . . : Saturday, August 10, 2013 11:53:37 PM
   Default Gateway . . . . . . . . . : fe80::ff:fe02:2028%20
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
   Physical Address. . . . . . . . . : 00-16-41-B4-18-79
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controlle
r
   Physical Address. . . . . . . . . : 00-18-8B-AD-64-E7
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::f448:ee71:1820:8d8%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.103(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Friday, August 09, 2013 10:42:58 PM
   Lease Expires . . . . . . . . . . : Saturday, August 10, 2013 12:43:00 AM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 268441739
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-C5-F9-18-00-18-8B-AD-64-E7

   DNS Servers . . . . . . . . . . . : 209.18.47.61
                                       209.18.47.62
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{43994EB2-1515-435F-9A7A-3CAFA2A09468}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 13:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fd:242c:b77:3f57:fef8(Prefe
rred)
   Link-local IPv6 Address . . . . . : fe80::242c:b77:3f57:fef8%13(Preferred)
   Default Gateway . . . . . . . . . :
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{1DF9F52C-28A2-4926-AE2F-435F485B7D00}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{B15C1AF4-A1A4-4985-9BA2-EFED7348E860}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

C:\Users\D420T>

Can anyone please help me get on the internet? I'm happy to provide any other troubleshooting data you might need.

Thank you so much!

maikcat

hi there,

please post your server config for start....

Michael.

tcaradonna

Hi Michael,
Thanks for reply.

I'm using the GUI from DDWRT to config the server side. These are screen shots of it.
http://postimg.org/image/u4d9epa29/
http://postimg.org/image/97edcjuhf/

I'm thinking if these are hard to understand, I can probably rewrite the entire server config in the "Additional config" on the second link. This should take precedence over the gui. Would you suggest doing that?

maikcat

though i am not familiar with ddwrt based routers i noticed a couple of things on your setup..

server mode bridge

ok bridging setup...

network 192.168.1.1

are you sure this shouldnt be 192.168.1.0 ?

pool start 192.168.200 - pool end 192.168.249

are you sure the above shouldnt be 192.168.1.200 and 192.168.1.249???? :?

can you check them out please?

Michael.

tcaradonna

Michael, thank you for the reply.

So, I fixed a couple of things as you pointed out, but I still lack internet capability.

1. Added push "route 0.0.0.0 0.0.0.0 192.168.1.1" to my server config. Now Gateway shows in my Client's IP config.

2. I had some typos that were probably inconsequential to my problem. My DHCP address pool from my server was missing the subnet. Since I was actually letting the main firewall/DHCP server on the subnet (192.168.1.1) assign addresses to clients, that part of my server config probably was ignored. Here are the new changes, and my client side ipconfig, and route print outputs

New Server Config Screen Shots:
http://postimg.org/image/dye712bp9/
http://postimg.org/image/n2mb04qoj/

c:\ipconfig /all:

C:\>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : D420T-PC
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Win32 Adapter OAS
   Physical Address. . . . . . . . . : 00-FF-1D-F9-F5-2C
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.1.7(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, August 13, 2013 4:47:55 PM
   Lease Expires . . . . . . . . . . : Wednesday, August 14, 2013 5:38:34 PM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controlle
r
   Physical Address. . . . . . . . . : 00-18-8B-AD-64-E7
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.0.103(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Monday, August 12, 2013 11:04:54 AM
   Lease Expires . . . . . . . . . . : Tuesday, August 13, 2013 6:36:44 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DNS Servers . . . . . . . . . . . : 209.18.47.61
                                       209.18.47.62
   NetBIOS over Tcpip. . . . . . . . : Enabled

c:\route print:

C:\Users\D420T>route print
===========================================================================
Interface List
 20...00 ff 1d f9 f5 2c ......TAP-Win32 Adapter OAS
 14...00 16 41 b4 18 79 ......Bluetooth Device (Personal Area Network)
 12...00 18 8b ad 64 e7 ......Broadcom NetXtreme 57xx Gigabit Controller
  1...........................Software Loopback Interface 1
 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 28...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1    192.168.0.103     10
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.7     30
          0.0.0.0        128.0.0.0      192.168.1.1      192.168.1.7     30
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0      192.168.1.1      192.168.1.7     30
      192.168.0.0    255.255.255.0         On-link     192.168.0.103    266
    192.168.0.103  255.255.255.255         On-link     192.168.0.103    266
    192.168.0.255  255.255.255.255         On-link     192.168.0.103    266
      192.168.1.0    255.255.255.0         On-link       192.168.1.7    286
      192.168.1.7  255.255.255.255         On-link       192.168.1.7    286
    192.168.1.255  255.255.255.255         On-link       192.168.1.7    286
  210.197.231.185  255.255.255.255      192.168.0.1    192.168.0.103     10
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.0.103    266
        224.0.0.0        240.0.0.0         On-link       192.168.1.7    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.0.103    266
  255.255.255.255  255.255.255.255         On-link       192.168.1.7    286
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 13     58 ::/0                     On-link
  1    306 ::1/128                  On-link
 13     58 2001::/32                On-link
 13    306 2001:0:9d38:6abd:184d:36ac:3f57:fef8/128
                                    On-link
 13    306 fe80::/64                On-link
 13    306 fe80::184d:36ac:3f57:fef8/128
                                    On-link
  1    306 ff00::/8                 On-link
 13    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

maikcat

hello there,

Sat Aug 10 00:11:56 2013 OpenVPNAS 2.1.1oOAS Win32-MSVC++ [SSL] [LZO2] built on Jul 29 2010

please download & install the open source version of openvpn on your client (you are using the AS).

Michael.

tcaradonna

OK, I installed the other version. Is the AC not open source? Is that why I needed to change versions? Either way, my problem still persists.

I think my problem has to do with routing on the server side. I can ping bidirectionally everywhere within the network, to AND from my client (including the true gateway on the server side).

Here's what my network looks like (I made this drawing)

As you can see in the diagram, ping is no problem. I can also resolve domain names thru the server network. When I try to access the internet, it seems to find the address, but hangs waiting for data to return. This website seems to describe my problem, but I don't know how to go about fixing it.
http://blog.remibergsma.com/2013/01/13/howto-connect-to-hosts-on-a-remote-network-using-openvpn-and-some-routing/

maikcat

if you can ping over the bridge we are good...

a couple to things to check though...

are these rules still apply?

iptables -A INPUT -i tap0 -j ACCEPT
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I INPUT -p tcp --dport 1194 -j ACCEPT 
iptables -I FORWARD -s 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tap0 -j ACCEPT
iptables -I FORWARD -i tap0 -o br0 -j ACCEPT
iptables -A POSTROUTING -t nat -o tap0 -j MASQUERADE
iptables -A POSTROUTING -t nat -s 192.168.1.0/24 -o eth0 -j MASQUERADE

if yes , please remove this:

iptables -A POSTROUTING -t nat -o tap0 -j MASQUERADE

and change this:

iptables -A POSTROUTING -t nat -s 192.168.1.0/24 -o eth0 -j MASQUERADE

to this

iptables -A POSTROUTING -t nat -s 192.168.1.0/24 -o br0 -j MASQUERADE

also remove this

push "route 0.0.0.0 0.0.0.0 192.168.1.1"

Michael.

tcaradonna

Michael,
Thank you for your suggestions. I made changes as recommended, but problem persists.

I will include some more screen shots of my settings on my DDWRT/OpenVPN server (192.168.1.253). I have marked a few places in red that seem like likely problem spots.

Basic Setup Tab:

Advanced Routing Tab:

Networking Tab:

Services Tab:

Administration Commands Tab:

tcaradonna

Opps

The last image should be this:

Administration commands:(startup and firewall)

tcaradonna

Finally gave up and tried something new:
Different network topology and VPN protocol

Instead of putting everything on the same subnet, I changed from using the router as a switch to using as a gateway. I turned on PPTP and that started working for internet access. I have to deal with another subnet for routing, but it's doing the job I hoped. No additional client needed (just the native windows client), no messy configuring. I have a feeling OpenVPN would probably work with my new subnet topology, but I don't see how it would benefit me. (I like not having a separate client to install and the easy of setup!)

OpenVPN would have been nice if I got it working, but its too hard to configure. I even bought the OpenVPN2 Cookbook by Jan Just Keijser. Not a bad book, but I couldn't get it to fix my issue. It did help with my new PPTP server though on the general routing info.

So long OpenVPN, until you get a bit easier to understand...

maikcat

Instead of putting everything on the same subnet

i thought that bridging was something you really wanted... :?

bridged mode is a little bit complicated that routed mode,
you didnt clarify it and i didnt asked...

but I don't see how it would benefit me

you must be joking right?
why are you building a vpn? security maybe...
is PPtP secure?.... :lol: :lol: :lol: :lol: :lol: :lol: :lol: :lol: :lol:

do you still asking the same question?

So long OpenVPN, until you get a bit easier to understand...

openvpn is a VPN solution...
did you ever used other vpn protocols? IPSec maybe? l2tp?
building a vpn requires some knowledge about routing/encryption etc...
these are NOT easy..

PPtP on the other hand yes its build-in in MS products (they made it)
but openvpn is intergrated on some gateway-based products to (untangle) which
also "creates" you a single exe with configs all included...

also in my opinion it should be better to setup openvpn on a linux pc because
you dont know if ddwrt intergrates openvpn correctly or not..

hope to see you around again,

Michael.

tcaradonna

Bridging would have been nice. But my number one priority was obtaining an IP address for streaming location protected video content. Public VPNs are no good anymore because they can be easily discovered and blocked.

I may fiddle with openvpn again, but I'd also like to see native support thru ios. Granted the technology is very good, its just difficult for amateurs like myself to implement.