OpenVPN connection established but can't use internet

jrn

Hi there,

I am trying to create my own openVPN consisting of two DD-WRT routers (both Linksys WRT54G). One DD-WRT box will act as the server the other one as the client. The client DD-WRT is sitting behind another router not running DD-WRT. The client DD-WRT is connected through its WAN port to the Non-DD-WRT router's LAN port.

While this is all new to me I've been trying the following tutorial with some success so far:
http://www.dd-wrt.com/wiki/index.php/VPN_(the_easy_way)_v24%2B

I was able to establish a connection from my Mac running Tunnelblick to my OpenVPN server but I am not able to connect to any website.

My goal is to connect to the openVPN server and have the client assigned its IP address so it will always look like I'm browsing from this region.

This is the server config I am using right now:

push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.66.1"
push "redirect-gateway def1"
server 192.168.66.0 255.255.255.0

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

# management parameter allows DD-WRT's OpenVPN Status web page to access the server's management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001

This is the client config I am using right now:

remote XXXXserver.dyndns.org 1194

client
remote-cert-tls server
dev tun0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float

ca ca.crt
cert client1.crt
key client1.key

These are the firewall settings on the openVPN server:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT

iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

The firewall on the client is deactivated since it's behind another router with a firewall.

Please let me know if you need anything else.

Any pointing into the right direction would be greatly appreciated.

Thanks a lot,

jrn

maikcat

please post the output of:

iptables -L -t nat -v

on your openvpn server.

Michael.

jrn

Hi Michael,

thanks for your reply.

I ssh'd into my openVPN server and ran the command you requested.
Here is the output for

iptables -L -t nat -v

Chain PREROUTING (policy ACCEPT 24 packets, 1917 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   10   640 DNAT       tcp  --  any    any     anywhere             myPublicIp.myProvider.net tcp dpt:1600 to:192.168.1.1:80 
    1   196 DNAT       tcp  --  any    any     anywhere             myPublicIp.myProvider.net tcp dpt:16000 to:192.168.1.1:16000 
    0     0 DNAT       icmp --  any    any     anywhere             myPublicIp.myProvider.net to:192.168.1.1 
    0     0 TRIGGER    0    --  any    any     anywhere             myPublicIp.myProvider.net TRIGGER type:dnat match:0 relate:0 

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   15   888 SNAT       0    --  any    vlan1   anywhere             anywhere            to:XXX.XXX.XXX.XXX(my public IP) 
    0     0 RETURN     0    --  any    br0     anywhere             anywhere            PKTTYPE = broadcast 
    1   328 MASQUERADE  0    --  any    br0     192.168.1.0/24       192.168.1.0/24      

Chain OUTPUT (policy ACCEPT 6 packets, 679 bytes)
 pkts bytes target     prot opt in     out     source               destination

Thanks a lot for helping me,

jrn

jrn

...and this is what I get executing the following command on my openVPN server

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.66.2    0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
192.168.66.0    192.168.66.2    255.255.255.0   UG    0      0        0 tun0
XXX.XXX.XXX.0   0.0.0.0         255.255.255.0   U     0      0        0 vlan1
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         XXX.XXX.XXX.1   0.0.0.0         UG    0      0        0 vlan1

where XXX.XXX.XXX.1 is my public IP.

maikcat

ok then,

so you want to NAT your traffic through your vlan1 interface...

  1   328 MASQUERADE  0    --  any    br0     192.168.1.0/24       192.168.1.0/24

whats this for? :?:

Michael.

jrn

Hi Michael,

thanks again for your reply.
Honestly, I don't know what this is for. Maybe it's something the DD-WRT router does by default? Does this make any sense?

As I am super new to all this I have very little knowledge with routing but am eager to learn.

Any recommendations what I could possibly do now?
You said I should NAT the traffic to the vlan1 interface. How would I do that? 🙂

Thanks,

jrn

maikcat

try this rule:

iptables -t nat -A POSTROUTING -s 192.168.66.0/24 -o vlan1 -j MASQUERADE

Michael.

jrn

Perfect. It's working!

Thanks a bunch Michael!!!

jrn

maikcat

Excellent! 8-)

Closing Topic.

Regards,

Michael.