Folks,
I followed some really good instructions on getting my VPN setup up and running here -
http://www.frogiswrong.com/blog/articles/8/openvpn-on-openwrt-a-little-more-detail?commented=0#txpCommentInputForm
I am able to get a successful connection when on my MiFi, however my public IP doesn’t change after connection and I’m unable to hit any of my internal LAN IPs. Connection to the internet continues to work as-is. I’d really appreciate if you can help me resolve this. The following is the message seen on Tunnelblick -
*Tunnelblick: This computer's apparent public IP address (<MiFi WAN IP>) was unchanged after the connection was made
Tunnelblick 3.3beta44 (build3276) - OpenVPN 2.3.1
Set DNS/WINS to Set nameserver (3.0b10)
Server Config for firewall
config rule
option 'name' 'OpenVPN'
option 'target' 'ACCEPT'
option 'dest_port' '1194'
option 'src' 'wan'
option 'proto' 'tcpudp'
option 'family' ‘ipv4'
Server Config for OpenVPN
root@<OpenWRT>:~# cat /etc/config/openvpn
config 'openvpn' 'lan'
option 'enable' '1'
option 'dev' 'tap0'
option 'persist_tun' '1'
option 'persist_key' '1'
option 'proto' 'udp'
option 'comp_lzo' '1'
option 'verb' '3'
option 'log' '/tmp/openvpn.log'
option 'status' '/tmp/openvpn-status.log'
option 'ca' '/etc/openvpn/ca.crt'
option 'cert' '/etc/openvpn/server.crt'
option 'key' '/etc/openvpn/server.key'
option 'server_bridge' '192.168.1.1 255.255.255.0 192.168.1.200 192.168.1.219'
option 'port' '1194'
option 'ifconfig_pool_persist' '/tmp/ipp.txt'
option 'keepalive' '10 120'
option 'dh' '/etc/openvpn/dh1024.pem'
option 'push' 'redirect-gateway def1'
list 'push' 'dhcp-option DNS 192.168.1.1'
Client Config (Tunnelblick)
client
tls-client
dev tap
proto udp
remote <WAN IP> 1194
remote-cert-tls server
resolv-retry infinite
nobind
persist-key
persist-tun
pkcs12 user1.p12
comp-lzo
verb 3
Client Logs:
2014-07-13 10:21:00 *Tunnelblick: openvpnstart starting OpenVPN:
* /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.1/openvpn --cd /Library/Application Support/Tunnelblick/Users/<username>/Atmun1.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Users/<username>/Atmun1.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SUsers-S<username>-SLibrary-SApplication Support-STunnelblick-SConfigurations-SAtmun1.tblk-SContents-SResources-Sconfig.ovpn.9_0_1_1_882.1337.openvpn.log --management-query-passwords --management-hold --redirect-gateway def1 --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.2.up.tunnelblick.sh -w -d -a -f -atADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.2.down.tunnelblick.sh -w -d -a -f -atADGNWradsgnw --up-restart
2014-07-13 10:21:01 *Tunnelblick: Established communication with OpenVPN
2014-07-13 10:21:01 OpenVPN 2.3.1 i386-apple-darwin10.8.0 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [MH] [IPv6] built on Apr 8 2013
2014-07-13 10:21:01 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2014-07-13 10:21:01 Need hold release from management interface, waiting...
2014-07-13 10:21:01 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2014-07-13 10:21:01 MANAGEMENT: CMD 'pid'
2014-07-13 10:21:01 MANAGEMENT: CMD 'state on'
2014-07-13 10:21:01 MANAGEMENT: CMD 'state'
2014-07-13 10:21:01 MANAGEMENT: CMD 'bytecount 1'
2014-07-13 10:21:01 MANAGEMENT: CMD 'hold release'
2014-07-13 10:21:01 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2014-07-13 10:21:04 MANAGEMENT: CMD 'password [...]'
2014-07-13 10:21:04 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2014-07-13 10:21:04 Socket Buffers: R=[196724->65536] S=[9216->65536]
2014-07-13 10:21:04 UDPv4 link local: [undef]
2014-07-13 10:21:04 UDPv4 link remote: [AF_INET]<WAN IP>:1194
2014-07-13 10:21:04 MANAGEMENT: >STATE:1405272064,WAIT,,,
2014-07-13 10:21:04 MANAGEMENT: >STATE:1405272064,AUTH,,,
2014-07-13 10:21:04 TLS: Initial packet from [AF_INET]<WAN IP>:1194, sid=d69d5d33 0d40ac3e
2014-07-13 10:21:04 VERIFY OK: depth=1, C=US, ST=CA, L=<l>, O=<o>, OU=<ou>, CN=user1, name=user1, emailAddress=<email>
2014-07-13 10:21:04 Validating certificate key usage
2014-07-13 10:21:04 ++ Certificate has key usage 00a0, expects 00a0
2014-07-13 10:21:04 VERIFY KU OK
2014-07-13 10:21:04 Validating certificate extended key usage
2014-07-13 10:21:04 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2014-07-13 10:21:04 VERIFY EKU OK
2014-07-13 10:21:04 VERIFY OK: depth=0, C=US, ST=CA, L=<l>, O=<o>, OU=<ou>, CN=server, name=server, emailAddress=<email>
2014-07-13 10:21:05 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2014-07-13 10:21:05 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-13 10:21:05 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2014-07-13 10:21:05 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-13 10:21:05 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2014-07-13 10:21:05 [server] Peer Connection Initiated with [AF_INET]<WAN IP>:1194
2014-07-13 10:21:06 MANAGEMENT: >STATE:1405272066,GET_CONFIG,,,
2014-07-13 10:21:07 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2014-07-13 10:21:07 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.200 255.255.255.0'
2014-07-13 10:21:07 OPTIONS IMPORT: timers and/or timeouts modified
2014-07-13 10:21:07 OPTIONS IMPORT: --ifconfig/up options modified
2014-07-13 10:21:07 OPTIONS IMPORT: route options modified
2014-07-13 10:21:07 OPTIONS IMPORT: route-related options modified
2014-07-13 10:21:07 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2014-07-13 10:21:07 TUN/TAP device /dev/tap0 opened
2014-07-13 10:21:07 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2014-07-13 10:21:07 MANAGEMENT: >STATE:1405272067,ASSIGN_IP,,192.168.1.200,
2014-07-13 10:21:07 /sbin/ifconfig tap0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2014-07-13 10:21:07 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2014-07-13 10:21:07 /sbin/ifconfig tap0 192.168.1.200 netmask 255.255.255.0 mtu 1500 up
2014-07-13 10:21:07 /Applications/Tunnelblick.app/Contents/Resources/client.2.up.tunnelblick.sh -w -d -a -f -atADGNWradsgnw tap0 1500 1574 192.168.1.200 255.255.255.0 init
2014-07-13 10:21:08 /sbin/route add -net <WAN IP> 192.168.1.1 255.255.255.255
add net <WAN IP>: gateway 192.168.1.1
2014-07-13 10:21:08 /sbin/route add -net 0.0.0.0 192.168.1.1 128.0.0.0
add net 0.0.0.0: gateway 192.168.1.1
2014-07-13 10:21:08 /sbin/route add -net 128.0.0.0 192.168.1.1 128.0.0.0
add net 128.0.0.0: gateway 192.168.1.1
2014-07-13 10:21:08 Initialization Sequence Completed
2014-07-13 10:21:08 MANAGEMENT: >STATE:1405272068,CONNECTED,SUCCESS,192.168.1.200,<WAN IP>
2014-07-13 10:21:14 *Tunnelblick: This computer's apparent public IP address (<MiFi WAN IP>) was unchanged after the connection was made
Server Logs
root@<OpenWrt>:~# cat /tmp/openvpn.log
Sun Jul 13 10:20:18 2014 MULTI: multi_create_instance called
Sun Jul 13 10:20:18 2014 <MiFi WAN IP>:12650 Re-using SSL/TLS context
Sun Jul 13 10:20:18 2014 <MiFi WAN IP>:12650 LZO compression initialized
Sun Jul 13 10:20:18 2014 <MiFi WAN IP>:12650 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 13 10:20:18 2014 <MiFi WAN IP>:12650 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Jul 13 10:20:18 2014 <MiFi WAN IP>:12650 TLS: Initial packet from <MiFi WAN IP>:12650, sid=099f1afb 1c3d76f7
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 VERIFY OK: depth=1, /C=US/ST=CA/L=<l>/O=<o>/OU=<ou>/CN=user1/name=user1/emailAddress=<email>
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 VERIFY OK: depth=0, /C=US/ST=CA/L=<l>/O=<o>/OU=<ou>/CN=user1/emailAddress=<email>
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jul 13 10:20:19 2014 <MiFi WAN IP>:12650 [user1] Peer Connection Initiated with <MiFi WAN IP>:12650
Sun Jul 13 10:20:19 2014 MULTI: new connection by client 'user1' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sun Jul 13 10:20:22 2014 user1/<MiFi WAN IP>:12650 PUSH: Received control message: 'PUSH_REQUEST'
Sun Jul 13 10:20:22 2014 user1/<MiFi WAN IP>:12650 SENT CONTROL [user1]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.200 255.255.255.0' (status=1)
Sun Jul 13 10:20:22 2014 user1/<MiFi WAN IP>:12650 MULTI: Learn: <MAC ADDR> -> user1/<MiFi WAN IP>:12650
root@<OpenWRT>:~# cat /tmp/openvpn-status.log
OpenVPN CLIENT LIST
Updated,Sun Jul 13 10:42:05 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
user1,<MiFi WAN IP>:12650,28411,80825,Sun Jul 13 10:20:18 2014
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
<MAC ADDR>,user1,<MiFi WAN IP>:12650,Sun Jul 13 10:20:33 2014
GLOBAL STATS
Max bcast/mcast queue length,1
END
