tossom
Hello people,
I need help with my Asus RT-N66U router running the latest Merlin firmware (374.33) which includes a built-in openvpn server. The server settings are:
Service state: on
start with wan: yes
interface type: tun
protocol: tcp
port: 443
firewall: automatic
authorisation mode: tls
extra hmac authorisation: disabled
vpn subnet/ mask: 10.168.1.1 255.255.255.0
Poll interval: 0
push LAN to clients: yes
direct clients to redirect internet traffic: no
respond to dns: no
encryption cypher: aes-128-cbc
compression: adaptive
tls renegotiation time: -1
manage client specific options: no
The client config is the following:
client
server-poll-timeout 4
connect-retry-max 5
resolv-retry 60
nobind
remote remoteadress.no-ip.com 443 tcp
dev tun
ns-cert-type server
remote-cert-tls server
cipher AES-128-CBC
comp-lzo
verb 3
ca ca.crt
cert client1.crt
key client1.key
This config is working, I can connect to the server from WAN and it's possible to access the hdd which is attached to the router.
The problem is that the whole LAN behind the router is not accessible. I can't ping any machine nor is it possible to obtain access to other samba shares.
I added the client-to-client command under custom configuration and
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 10.168.1.1"
and I disabled the firewall. Still no connectivity to the LAN behind the router. Had this all smoothly running on my old WRT-54GL with dd-wrt and I remember that I had to add there some rules for the firewall to get it working. This was what I added in dd-wrt as firewall script:
iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT
iptables -I FORWARD 1 --source 10.168.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.168.1.0/24 -o br0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.168.1.0/24 -j MASQUERADE
iptables -I INPUT 3 -i tun0 -j ACCEPT
iptables -I FORWARD 3 -i tun0 -o tun0 -j ACCEPT
Maybe I have to this also somewhere in Merlins firmware?
Any help is appreciated. I know that this all would work quiet flawless if I would switch to a tap interface, but IOS and I think also Android don't support it. Thanks for all your help and advices.
tossom
Thank you for your reply. I noticed that incoming traffic was blocked by the win7 firewall. After adjusting the firewall rules, it was possbile to connect to the local LAN without having to change any settings on the openvpn server side.
ampereman
I have axactly the same issue with tomato and Asus rtn66u. Please could you please clarify how exactly solve the problem? Thanks a lot
bjjanson
I had a similar issue and finally noticed that the server configuration auto sets the interface name to tun21 instead of tun. Once I updated my client config to use tun21 then everything started working fine.
