I am using the OpenVPN Access Server AMI on Amazon EC2 and DD-WRT on my home router.
I am able to connect my DD-WRT OpenVPN client to my OpenVPN Access server and successfully tunnel all my network devices over the VPN.
What I am NOT able to do is only route one device through the VPN. I was advised that I need to turn off the redirect-gateway and redirect-gateway def1 directives as they are overriding my ip route scripts on my DD-WRT router but despite my attempts in doing so, the directives are not disabled.
I'm trying to avoid modifying config files directly on the AMI as this is an appliance, my assumption is that the necessary changes can be made via the GUI.
Here is a snippet from the OpenVPN AS log:
2014-02-11 11:44:20+0000 [-] OVPN 1 OUT: "Tue Feb 11 11:44:20 2014 ddwrt_AUTOLOGIN/180.43.200.254:32768GIN]: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcping 12,ping-restart 50,redirect-gateway def1,redirect-gateway bypass-dhcp,redirect-gateway autolocal,rption DNS 172.16.0.23,register-dns,comp-lzo yes,ifconfig 5.5.8.5 255.255.248.0' (status=1)"
I have attached a snippet of how I have tried to remove the directives. I have tried just server and/or client but no joy. The screenshot shows both.
Here is what my DD-WRT OpenVPN client log is showing:
Serverlog Clientlog 20140211 20:44:16 W Multiple --route-up scripts defined. The previously configured script is overridden.
20140211 20:44:16 I OpenVPN 2.3.2 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Nov 22 2013
20140211 20:44:16 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:16
20140211 20:44:16 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20140211 20:44:16 W WARNING: file '/tmp/openvpncl/client.key' is group or others accessible
20140211 20:44:16 W WARNING: file '/tmp/openvpncl/ta.key' is group or others accessible
20140211 20:44:16 I Control Channel Authentication: using '/tmp/openvpncl/ta.key' as a OpenVPN static key file
20140211 20:44:16 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
20140211 20:44:16 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
20140211 20:44:16 Socket Buffers: R=[114688->131072] S=[114688->131072]
20140211 20:44:16 I UDPv4 link local: [undef]
20140211 20:44:16 I UDPv4 link remote: [AF_INET]54.193.144.232:1194
20140211 20:44:16 TLS: Initial packet from [AF_INET]54.193.144.232:1194 sid=3622e9be 2a1f818b
20140211 20:44:16 VERIFY OK: depth=1 CN=OpenVPN CA
20140211 20:44:16 VERIFY OK: nsCertType=SERVER
20140211 20:44:16 NOTE: --mute triggered...
20140211 20:44:17 6 variation(s) on previous 3 message(s) suppressed by --mute
20140211 20:44:17 I [OpenVPN Server] Peer Connection Initiated with [AF_INET]54.193.144.232:1194
20140211 20:44:20 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
20140211 20:44:20 PUSH: Received control message: 'PUSH_REPLY explicit-exit-notify topology subnet route-delay 5 30 dhcp-pre-release dhcp-renew dhcp-release route-metric 101 ping 12 ping-restart 50 redirect-gateway def1 redirect-gateway bypass-dhcp redirect-gateway autolocal route-gateway 5.5.8.1 dhcp-option DNS 172.16.0.23 register-dns comp-lzo yes ifconfig 5.5.8.5 255.255.248.0'
20140211 20:44:20 N Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: dhcp-pre-release (2.3.2)
20140211 20:44:20 N Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.3.2)
20140211 20:44:20 N Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.3.2)
20140211 20:44:20 NOTE: --mute triggered...
20140211 20:44:20 1 variation(s) on previous 3 message(s) suppressed by --mute
20140211 20:44:20 OPTIONS IMPORT: timers and/or timeouts modified
20140211 20:44:20 OPTIONS IMPORT: explicit notify parm(s) modified
20140211 20:44:20 OPTIONS IMPORT: LZO parms modified
20140211 20:44:20 NOTE: --mute triggered...
20140211 20:44:20 4 variation(s) on previous 3 message(s) suppressed by --mute
20140211 20:44:20 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=vlan2 HWADDR=58:6d:8f:38:fa:48
20140211 20:44:20 I TUN/TAP device tun1 opened
20140211 20:44:20 TUN/TAP TX queue length set to 100
20140211 20:44:20 I do_ifconfig tt->ipv6=1 tt->did_ifconfig_ipv6_setup=0
20140211 20:44:20 I /sbin/ifconfig tun1 5.5.8.5 netmask 255.255.248.0 mtu 1500 broadcast 5.5.15.255
20140211 20:44:25 ROUTE remote_host is NOT LOCAL
20140211 20:44:25 /sbin/route add -net 54.193.144.232 netmask 255.255.255.255 gw 192.168.0.1
20140211 20:44:25 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 5.5.8.1
20140211 20:44:25 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 5.5.8.1
20140211 20:44:25 I Initialization Sequence Completed
20140211 20:51:19 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 20:51:19 D MANAGEMENT: CMD 'state'
20140211 20:51:19 MANAGEMENT: Client disconnected
20140211 20:51:19 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 20:51:19 D MANAGEMENT: CMD 'state'
20140211 20:51:19 MANAGEMENT: Client disconnected
20140211 20:51:19 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 20:51:19 D MANAGEMENT: CMD 'state'
20140211 20:51:19 MANAGEMENT: Client disconnected
20140211 20:51:19 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 20:51:19 D MANAGEMENT: CMD 'log 500'
20140211 20:51:19 MANAGEMENT: Client disconnected
20140211 21:09:18 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 21:09:18 D MANAGEMENT: CMD 'state'
20140211 21:09:18 MANAGEMENT: Client disconnected
20140211 21:09:18 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 21:09:18 D MANAGEMENT: CMD 'state'
20140211 21:09:18 MANAGEMENT: Client disconnected
20140211 21:09:18 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 21:09:18 D MANAGEMENT: CMD 'state'
20140211 21:09:18 MANAGEMENT: Client disconnected
20140211 21:09:18 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20140211 21:09:18 D MANAGEMENT: CMD 'log 500'
19700101 00:00:00
I'm not sure if I can link to other forums but here is my post on the dd-wrt forum:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=257833
I just simply want one (maybe two) of my devices to go through the VPN tunnel while everything else stays local.
Can someone kindly point me in the right direction?
