Hello Community,
I've been reading, searching, trying, bricking and being frustrated about a week now and I hope I can profit from your knowledge and experience.
I've recently gotten an openWrt Router and installed an openVPN-Server on it
This is the guide I've followed. (The only thing I changed: I replaced these "dev tun" or "tun+" in configs and firewall rules with
tun0 to be sure about the interface name.
Now what I'm trying to do is making my server a VPN-Client at the same time. I have no control about the server which my router should connect to.
[My Laptop] -----v-p-n via tun0 (tcp 993) ----- [My Router's WAN] -----v-p-n via tun1 (udp 3194) ----- [a VPN Service]
I do want to route Internet traffic from my Laptop into the tun1-tunnel - but that has low priority. In 99% of the cases I only want to grab a file or so.
Now the
Problem is this: I can connect to my Router when the tun1-tunnel is NOT connected. As soon as it is, I get no response from my Router at the given port.
I do know why that happens (or at least think I knew): The Router "answers" my connection through the tun1-tunnel, which of course is not possible.
The thing I need is obviously a firewall rule which tells my Router to let tcp-993 traffic in (and out) without bothering about the tun1 connection. I'm pretty new to iptables and would like to know if anyone of you can help me.
I can post more config files if needed - just at the moment I'm not at home.
Thank you very much!
Here's my firewall config: (don't worry about the open port 80. The Router is behind a 2nd Router. Port 80 is open to this one, not to you 🙂)
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option target 'ACCEPT'
option src 'wan'
option proto 'tcp'
option des_port '80'
option name 'LuCi-WAN'
config rule
option target 'ACCEPT'
option src 'wan'
option proto 'tcp'
option dest_port '22'
option name 'SSH-Wan'
config rule
option target 'ACCEPT'
option name 'VPN'
option src 'wan'
option proto 'tcp'
option dest_port '993'
config zone
option name 'hide'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'Hide'
config rule ############# WHICH DID NOT WORK. ME TRYING TO BIND 993 TRAFFIC TO WAN INTERFACE
option enabled '1'
option target 'ACCEPT'
option proto 'tcp'
option dest_port '993'
option name 'Test'
option src_port '993'
option src 'lan'
option dest 'wan'
and here's the firewall.user
######### Allow openVPN Server Input, Output, Forward (from Tutorial in Wiki)
iptables -t nat -A prerouting_wan_rule -p tcp --dport 993 -j ACCEPT
iptables -A input_wan_rule -p tcp --dport 993 -j ACCEPT
####################################
#Make openVPN Clients being able to browse the net
####################################
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I OUTPUT -o tun0 -j ACCEPT
iptables -I FORWARD -o tun0 -j ACCEPT
