In case someone needs this in the future, I managed to get my Synology Diskstation to talk to an Ubiquiti Edgerouter (these devices run Vyatta).
Server: Synology Diskstation, it sits on 192.168.2.20 on it's internal network in my example
Client: Ubiquiti EdgeRouter, it sits on 192.168.0.1 on it's internal network
I find the way the Synology set up OpenVPN a little strange so I don't have a lot of control over that end. The openvpn.ovpn file references a cert but then has me use a username and password to authenticate -- no client key. I'm not quite sure what purpose the cert serves in this situation.
On the Synology side, the server.conf is located in: /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf
If your device is behind a firewall you need to open the usual port 1194 to the diskstation.
In the web interface of the diskstation:
1) Install the VPN Server package
2) Open the VPN Server from the main menu
3) Go to the Privileges tab and check the OpenVPN box for the user you want to be able to use the VPN (admin for example)
4) Go to the OpenVPN tab and enable OpenVPN
5) Press the 'Export configuration' button and download the zip file containing:
ca.crt
openvpn.ovpn
README.txt
For me to get this to work, I had to add a route command to my configuration.
On your diskstation, log in as root, use the password for the admin user from the web interface
1) mkdir /var/packages/VPNCenter/target/etc/openvpn/ccd/
2) create a file in that directory named 'admin' which contained the following line:
iroute 192.168.0.0 255.255.255.0
3) edit /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf and add:
client-config-dir /var/packages/VPNCenter/target/etc/openvpn/ccd
route 192.168.0.0 255.255.255.0
4) restart openvpn:
/var/packages/VPNCenter/target/scripts/openvpn.sh restart
Unzip those files and edit openvpn.ovpn. Change:
1) change YOUR_SERVER_IP to the ip address or hostname of your diskatation
2) change these lines like this:
ca /config/auth/diskstation-ca.crt
auth-user-pass /config/auth/diskstation.auth
Now, on the Edgerouter side, we have a little more work to do. Log into your edgerouter as ubnt.
Put this openvpn.ovpn file on your router in /config/auth/diskstation-openvpn.ovpn.
Put the ca.crt file in /config/auth/diskstation-ca.crt.
Lastly, in /config/auth/diskstation.auth, add these lines (where password is the admin password):
admin
password
Now to add the interface:
configure
edit interfaces openvpn vtun0
set config-file /config/auth/diskstation-openvpn.ovpn
commit
save
exit
The tun interface that comes up on the diskstation is:
DiskStation> ifconfig
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:11 errors:0 dropped:0 overruns:0 frame:0
TX packets:54 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:924 (924.0 B) TX bytes:4536 (4.4 KiB)
and on the edgerouter:
ubnt@ubnt:/config/auth$ sudo ifconfig tun0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:7090 errors:0 dropped:0 overruns:0 frame:0
TX packets:3924 errors:0 dropped:103 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:3359024 (3.2 MiB) TX bytes:410460 (400.8 KiB)
The routing table on the diskstation looks like this:
DiskStation> route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.2.0 * 255.255.255.0 U 0 0 0 eth0
I can ping the diskstation from any machine on the 192.168.0.x network and from the diskstation I can ping any machine on the 192.168.0.x network.
The diskstation is not typically a router. On the router on the 192.168.2.x network which in my case was a Netgear, I added a static route to the 192.168.2.0/24 network to point at the diskstation. Then, any machine on the 192.168.2.x network was able to get to any machine on the 192.168.0.x network.
A little complicated but I hope this helps someone at some point who tries this setup.
Michael Grant
