Hi all,
Despite my best efforts and the last two weekends troubleshooting, and all sorts of reading of various forums on DD-WRT, here, and other places, I continue to get TLS key negotiation errors from both my Android as well as my Windows PC. I cross-posted this at
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=886220#886220 but have had no responses.
To the extent that it is relevant, I have a separate VLan for my Guest network that I've described below as well.
I'm using DD-WRT v24 SP2 Build 14929 mega on an Asus RT-N66, and OpenVPN 2.2.2.
Goals:
1. Allow remote access to my home network while traveling for maintenance and streaming purposes
2. Enable remote backup of extended family pc's through WHS2011
3. Prevent visitors (babysitters, etc) from accessing my home network while still providing internet access
It seemed to me that I could solve #1/2 using OpenVPN, and #3 through the use of VLAN's. I think the VLAN works fine, but I mention this all in case there are questions about my Firewall file.
I have intentionally left the comments in my files to explain my thinking and objective in each line, but if it is offensive I can certainly get rid of them.
Here is my Firewall file:
#Open UDP on port 1194 to allow VPN
#tun0 is the VPN traffic from OPENVPN
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
#Allow traffic coming from the VPN
iptables -I FORWARD -s 10.10.10.0/24 -j ACCEPT
#Allow transfer of data between VPN and Home
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
#Prevent Guest and Home Network Interaction
#Home is BR0, Guest is BR1
iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
#ACCEPT any NEW requests from Guest
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
#Allow TCP types SYN and RST
#iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
#DROP any requests from Guest to Home
iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP
#DROP any requests from Home to Guest
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
#Restrict BR1 from accessing WAN, but allow Internet
iptables -I FORWARD -i br1 -d `nvram get wan_ipaddr`/`nvram get wan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
#Drop any traffic destined for BR1 except ports 53 UDP and 67 UDP/TCP
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
In terms of port forwarding, I have 443, 80, 4125, 3389, and 21 all forwarded to my WHS (192.168.1.102) and 1194 forwarded to my router (192.168.1.1). This last bit seems redundant with the first iptable rule, but I was trying everything I could think of.
Networking Setup
Bridging Table:
Port Setup:
DHCPD:
From the OpenPVN Tab
Start OpenVPN Daemon: Enable
Start Type: WAN Up
CA Cert:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
Certificate Revoke List: <Empty>
Public Client Cert:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
Private Client Key:
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
DH PEM:
-----BEGIN DH PARAMETERS-----
...
-----END DH PARAMETERS-----
OpenVPN Config (Server):
#Server LAN Subnet
server 10.10.10.0 255.255.255.0
#Advertise Local LAN to VPN and VPN to itself
push "route 192.168.1.0 255.255.255.0"
push "route 10.10.10.0 255.255.255.0"
#Establish DNS Servers
push "dhcp-option DNS 75.75.75.75"
push "dhcp-option DNS 75.75.76.76"
dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
# Only use crl-verify if you are using the revoke list
# crl-verify /tmp/openvpn/ca.crl
# management parameter allows DD-WRT\s OpenVPN
# Status web page to access the server\s management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001
Client Config:
remote 98.217.2.177 1194
client
remote-cert-tls server
dev tun0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
#If the pushed routes appear not to be added on windows hosts, add the following:
#route-delay 30
ca ca.crt
cert KPMGLaptop.crt
key KPMGLaptop.key
Any and all help or questions are welcome, and thanks in advance!
Doug
