All,
Been putzing around with OpenVPN over the last few days and I have the Bridged (TAP) configuration working the way I want it for the time being.
I am having a problem accessing the Internet when configure and connect over a Routed (TUN) connection. Client can connect to the VPN, but cannot connect to any of the internal devices or the internet.
Pertinent information:
e3000 Router running D-WRT v24-sp2 (08/19/13) vpnkong (SVN revision 22200M)
I am using the UI to configure OpenVPN and the following is the openvpn.conf file that gets created. The last portion (after) the comment lines are the 'Additional Info' items that I added in.
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 7310
proto tcp-server
cipher aes-256-cbc
auth sha256
client-config-dir /tmp/openvpn/ccd
comp-lzo yes
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
push "redirect-gateway def1"
tcp-nodelay
tun-mtu 1500
mtu-disc yes
server 10.100.2.0 255.255.255.0
dev tun2
tun-ipv6
tls-auth /tmp/openvpn/ta.key 0
#
# ROUTED OpenVPN Server Config Script
#
push "dhcp-option DOMAIN xxx.xxx.xxx"
push "dhcp-option DNS 10.100.1.200"
push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 208.67.222.222"
push "route 10.100.2.200 255.255.255.0"
The Client config file is as follows
#
# ROUTED OpenVPN Client Config
#
remote xxx.xxx.xxx 1910
client
pull
dev tun0
proto tcp
resolv-retry infinite
nobind
persist-key
persist-tun
verb 5
tls-client
tls-auth tlsauth.key 1
ca ca.crt
cert Naveens-Win8.crt
key Naveens-Win8.key
cipher AES-256-CBC
comp-lzo yes
auth sha256
redirect-gateway def1
ns-cert-type server
The following is a listing of the routes available on the client 'after' a connection is established.
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.211.55.1 10.211.55.4 10
0.0.0.0 128.0.0.0 10.100.2.1 10.100.2.2 30
10.100.2.0 255.255.255.0 On-link 10.100.2.2 286
10.100.2.2 255.255.255.255 On-link 10.100.2.2 286
10.100.2.255 255.255.255.255 On-link 10.100.2.2 286
10.211.55.0 255.255.255.0 On-link 10.211.55.4 266
10.211.55.4 255.255.255.255 On-link 10.211.55.4 266
10.211.55.255 255.255.255.255 On-link 10.211.55.4 266
99.16.103.24 255.255.255.255 10.211.55.1 10.211.55.4 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.100.2.1 10.100.2.2 30
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.100.2.2 286
224.0.0.0 240.0.0.0 On-link 10.211.55.4 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.100.2.2 286
255.255.255.255 255.255.255.255 On-link 10.211.55.4 266
===========================================================================
I am wondering if the problem is created by the fact that the traffic is looking for the gateway at 10.100.2.1. My dd-wrt router/gateway is sitting at 10.100.2.200.
Let me know if I am correct in my assessment. Needless to say, the next question would be to look for a way to force the config to use the gateway at 10.100.2.200.
If there are other potential issues with the config, do let me know.
Thanks in advance
