Reach my openVPN client from outside.

walawa75

hello dear community,

I hope you can help me.

I have OpenVPN server on win7 machine and client on a WRT300N which connect automatically on.

Eveything works OK but I have a problem and I don't know why.

What I have to do to reach my client from outside through the tunnel only (through server WAN IP address not from client WAN IP) ?

I tried to forward 8000 port on the router server but without any chance. http doesn't bring me to the remote console of the WRT300N on port 8000.

Server conf

port 443
proto tcp-server
dev tap
ca ca.crt
cert server.crt
key server.key  
dh dh1024.pem
server-bridge 192.168.0.250 255.255.255.0 192.168.0.128 192.168.0.240
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
tls-auth ta.key 0
comp-lzo
reneg-sec 0
persist-key
persist-tun
status openvpn-status.log
verb 3

and client conf

float
client
dev tap
proto tcp
remote xxx.xxx.xxx.xxx 443
redirect-gateway
resolv-retry infinite
nobind
persist-key
persist-tun
ca /jffs/ca.crt
cert /jffs/client2.crt
key /jffs/client2.key
tls-auth /jffs/ta.key 1
comp-lzo
verb 3
reneg-sec 0

WRT300N firewall rules

iptables -I FORWARD -i br0 -o tap0 -j ACCEPT
iptables -I FORWARD -i tap0 -o br0 -j ACCEPT
iptables -I INPUT -i tap0 -j ACEEPT
iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE

walawa75

Thanks for the quick response !!!

About 443 port I need to forward to the VPN server (192.168.0.1) or to the virtual device known under 192.168.0.130 on the local network ?

walawa75

Dear debbie10t,

The distant connected WRT300 client is reachable from local network where is the server with 192.168.0.130 IP. My WRT is recognized in my LAN so I was thinking by forwarding port 8000 on the router, I could be able to go to my WRT console (port 8000) directly through the tunnel. Why is it not possible ?

I hope you'll understand my poor english. Thank you.

walawa75

Fisrt site.
Server Win7 GUI openVPN>> IP 192.168.0.1 >> Bridge TAP interface with gateway (router) 192.168.0.250. WAN IP XXX.XXX.XXX.XXX

Second site.
Client linksys WRT300N>> Local client IP 192.168.1.1 but Tunnel IP 192.168.0.130 and no wan ip available or reachable.

Port TCP 443 is already forwarded on gateway to server 192.168.0.1 to make connection of openvpn tunnel with WRT300N.

I can ping server from client and I can ping client from server. The WAN IP I have on client is XXX.XXX.XXX.XXX like server IP. So all is working good and my client is visible as 192.168.0.130 in the gateway network.

The big problem is when I want access the client from outside and when I type http://XXX.XXX.XXX.XXX:8000 the address is not reachable.
Why the gateway forward rule on TCP 8000 doesn't bring traffic on 192.168.0.130 where my console is reachable on this port ? Does Windows block anything ?

I hope you'll understand the problem :-(( Thank you so much.

walawa75

Of course on the WRT300 the two interfaces tun0 and wl0 (192.168.0.130 and 192.168.1.1) are bridged.

walawa75

Yes I'm agree but how can I reach my client from any internet connection ?

What is going wrong in the configuration ?

Please help.