Unable to connect to DD-WRT Router using OpenVPN

dnguyen411

I'm not having any luck connecting any devices from outside my network to my router running DD-WRT and setup for OpenVPN. I used this guide from YouTube to set it up: https://www.youtube.com/watch?v=cYZAXLgTJsc&index=5&list=WL

For the client side, I'm using an iPhone 4S running OpenVPN 1.0.4 build 140. Below is the log from the app after I try connecting to my router via the Verizon.

2014-07-19 14:59:32 LZO-ASYM init swap=0 asym=0
2014-07-19 14:59:32 EVENT: RESOLVE
2014-07-19 14:59:32 Contacting 73.37.140.86:1194 via UDP
2014-07-19 14:59:32 EVENT: WAIT
2014-07-19 14:59:32 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-19 14:59:42 Server poll timeout, trying next remote entry...
2014-07-19 14:59:42 EVENT: RECONNECTING
2014-07-19 14:59:42 LZO-ASYM init swap=0 asym=0
2014-07-19 14:59:42 EVENT: RESOLVE
2014-07-19 14:59:42 Contacting 73.37.140.86:1194 via UDP
2014-07-19 14:59:42 EVENT: WAIT
2014-07-19 14:59:42 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-19 14:59:52 Server poll timeout, trying next remote entry...
2014-07-19 14:59:52 EVENT: RECONNECTING
2014-07-19 14:59:52 LZO-ASYM init swap=0 asym=0
2014-07-19 14:59:52 EVENT: RESOLVE
2014-07-19 14:59:52 Contacting 73.37.140.86:1194 via UDP
2014-07-19 14:59:52 EVENT: WAIT
2014-07-19 14:59:52 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-19 15:00:02 Server poll timeout, trying next remote entry...
2014-07-19 15:00:02 EVENT: RECONNECTING
2014-07-19 15:00:02 LZO-ASYM init swap=0 asym=0
2014-07-19 15:00:02 EVENT: RESOLVE
2014-07-19 15:00:02 Contacting 73.37.140.86:1194 via UDP
2014-07-19 15:00:02 EVENT: WAIT
2014-07-19 15:00:02 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-19 15:00:12 Server poll timeout, trying next remote entry...
2014-07-19 15:00:12 EVENT: RECONNECTING
2014-07-19 15:00:12 LZO-ASYM init swap=0 asym=0
2014-07-19 15:00:12 EVENT: RESOLVE
2014-07-19 15:00:12 Contacting 73.37.140.86:1194 via UDP
2014-07-19 15:00:12 EVENT: WAIT
2014-07-19 15:00:12 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-19 15:00:22 Server poll timeout, trying next remote entry...
2014-07-19 15:00:22 EVENT: RECONNECTING
2014-07-19 15:00:22 LZO-ASYM init swap=0 asym=0
2014-07-19 15:00:22 EVENT: RESOLVE
2014-07-19 15:00:22 Contacting 73.37.140.86:1194 via UDP
2014-07-19 15:00:22 EVENT: WAIT
2014-07-19 15:00:22 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-19 15:00:32 EVENT: CONNECTION_TIMEOUT [ERR]
2014-07-19 15:00:32 EVENT: DISCONNECTED
2014-07-19 15:00:32 Raw stats on disconnect:
BYTES_OUT : 420
PACKETS_OUT : 30
CONNECTION_TIMEOUT : 1
N_RECONNECT : 5
2014-07-19 15:00:32 Performance stats on disconnect:
CPU usage (microseconds): 83346
Network bytes per CPU second: 5039
Tunnel bytes per CPU second: 0
2014-07-19 15:00:32 ----- OpenVPN Stop -----
2014-07-19 15:00:32 EVENT: DISCONNECT_PENDING

Here's the log from the server:

20140719 14:59:33 174.238.101.73:5329 TLS: Initial packet from [AF_INET]174.238.101.73:5329 sid=76276d55 ab37c6a2
20140719 14:59:43 174.238.101.73:5312 TLS: Initial packet from [AF_INET]174.238.101.73:5312 sid=d293101c 82e52791
20140719 14:59:53 174.238.101.73:5313 TLS: Initial packet from [AF_INET]174.238.101.73:5313 sid=c9ab49ac dabd1af4
20140719 15:00:03 174.238.101.73:5318 NOTE: --mute triggered...
20140719 15:00:34 174.238.101.73:5329 3 variation(s) on previous 3 message(s) suppressed by --mute
20140719 15:00:34 N 174.238.101.73:5329 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140719 15:00:34 N 174.238.101.73:5329 TLS Error: TLS handshake failed
20140719 15:00:34 174.238.101.73:5329 SIGUSR1[soft tls-error] received client-instance restarting
20140719 15:00:43 N 174.238.101.73:5312 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140719 15:00:43 N 174.238.101.73:5312 TLS Error: TLS handshake failed
20140719 15:00:43 174.238.101.73:5312 SIGUSR1[soft tls-error] received client-instance restarting
20140719 15:00:53 N 174.238.101.73:5313 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140719 15:00:53 N 174.238.101.73:5313 TLS Error: TLS handshake failed
20140719 15:00:53 174.238.101.73:5313 SIGUSR1[soft tls-error] received client-instance restarting
20140719 15:01:04 N 174.238.101.73:5318 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140719 15:01:04 N 174.238.101.73:5318 TLS Error: TLS handshake failed
20140719 15:01:04 174.238.101.73:5318 SIGUSR1[soft tls-error] received client-instance restarting
20140719 15:01:13 N 174.238.101.73:5339 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140719 15:01:13 N 174.238.101.73:5339 TLS Error: TLS handshake failed
20140719 15:01:13 174.238.101.73:5339 SIGUSR1[soft tls-error] received client-instance restarting
20140719 15:01:23 N 174.238.101.73:5340 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140719 15:01:23 N 174.238.101.73:5340 TLS Error: TLS handshake failed
20140719 15:01:23 174.238.101.73:5340 SIGUSR1[soft tls-error] received client-instance restarting

I did a UDP port scan of port 1194 and the scanner found it was open so I think I can rule out that my router firewall is blocking the request. I've attached screenshots of my router's settings:
Router_Info.JPG VPN Settings.JPG port_forward.JPG

Here are my Firewall Settings in the Commands tab:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT

iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT

iptables -I FORWARD -i br0 -o tun0 -j ACCEPT

iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Here is my client's ovpn file:

client
dev tun
proto udp
remote server.ddns.net 1194
remote-random
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert davisiphone.crt
key davisiphone.key
ns-cert-type server
comp-lzo
verb 3

Can anybody help me figure out why I can't get a connection? Thanks in advance...

dnguyen411

According to http://www.dd-wrt.com/wiki/index.php/OpenVPN#Troubleshooting, this is my server ovpn file:

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 4
mute 5
log-append /var/log/openvpn
writepid /var/run/openvpnd.pid
management 127.0.0.1 5002
management-log-cache 50
mtu-disc yes
topology subnet
client-config-dir /tmp/openvpn/ccd
script-security 2
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
fast-io
passtos

dnguyen411

I was able to telnet into my router and read the server configuration file for OpenVPN:

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp
cipher bf-cbc
auth md5
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
mtu-disc yes
server 10.8.0.0 255.255.255.0
dev tun2
tun-ipv6

Can anybody tell me what I'm doing wrong?

dnguyen411

I modified my server and client for "Auth sha256". I'm able to VPN into the router from inside the firewall (i.e. inside my house), but not outside the firewall (i.e. from another wifi).

Server Log:

20140724 20:58:58 24.131.141.196:62945 TLS: Initial packet from [AF_INET]24.131.141.196:62945 sid=69297fce 49c087f5
20140724 20:59:08 24.131.141.196:53506 TLS: Initial packet from [AF_INET]24.131.141.196:53506 sid=6367a2f0 36dc1415
20140724 20:59:18 24.131.141.196:4382 TLS: Initial packet from [AF_INET]24.131.141.196:4382 sid=8945bfa7 4e00160d
20140724 20:59:28 24.131.141.196:64703 NOTE: --mute triggered...
20140724 20:59:58 24.131.141.196:62945 3 variation(s) on previous 3 message(s) suppressed by --mute
20140724 20:59:58 N 24.131.141.196:62945 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140724 20:59:58 N 24.131.141.196:62945 TLS Error: TLS handshake failed
20140724 20:59:58 24.131.141.196:62945 SIGUSR1[soft tls-error] received client-instance restarting
20140724 21:00:08 N 24.131.141.196:53506 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140724 21:00:08 N 24.131.141.196:53506 TLS Error: TLS handshake failed
20140724 21:00:08 24.131.141.196:53506 SIGUSR1[soft tls-error] received client-instance restarting
20140724 21:00:18 N 24.131.141.196:4382 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140724 21:00:18 N 24.131.141.196:4382 TLS Error: TLS handshake failed
20140724 21:00:18 24.131.141.196:4382 SIGUSR1[soft tls-error] received client-instance restarting
20140724 21:00:28 N 24.131.141.196:64703 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140724 21:00:28 N 24.131.141.196:64703 TLS Error: TLS handshake failed
20140724 21:00:28 24.131.141.196:64703 SIGUSR1[soft tls-error] received client-instance restarting
20140724 21:00:38 N 24.131.141.196:53187 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140724 21:00:38 N 24.131.141.196:53187 TLS Error: TLS handshake failed
20140724 21:00:38 24.131.141.196:53187 SIGUSR1[soft tls-error] received client-instance restarting
20140724 21:00:48 N 24.131.141.196:62092 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20140724 21:00:48 N 24.131.141.196:62092 TLS Error: TLS handshake failed
20140724 21:00:48 24.131.141.196:62092 SIGUSR1[soft tls-error] received client-instance restarting

Client Log:

2014-07-24 20:58:57 LZO-ASYM init swap=0 asym=0
2014-07-24 20:58:57 EVENT: RESOLVE
2014-07-24 20:58:58 Contacting 73.37.140.86:1194 via UDP
2014-07-24 20:58:58 EVENT: WAIT
2014-07-24 20:58:58 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-24 20:59:07 Server poll timeout, trying next remote entry...
2014-07-24 20:59:07 EVENT: RECONNECTING
2014-07-24 20:59:07 LZO-ASYM init swap=0 asym=0
2014-07-24 20:59:07 EVENT: RESOLVE
2014-07-24 20:59:07 Contacting 73.37.140.86:1194 via UDP
2014-07-24 20:59:07 EVENT: WAIT
2014-07-24 20:59:07 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-24 20:59:17 Server poll timeout, trying next remote entry...
2014-07-24 20:59:17 EVENT: RECONNECTING
2014-07-24 20:59:17 LZO-ASYM init swap=0 asym=0
2014-07-24 20:59:17 EVENT: RESOLVE
2014-07-24 20:59:17 Contacting 73.37.140.86:1194 via UDP
2014-07-24 20:59:17 EVENT: WAIT
2014-07-24 20:59:17 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-24 20:59:27 Server poll timeout, trying next remote entry...
2014-07-24 20:59:27 EVENT: RECONNECTING
2014-07-24 20:59:27 LZO-ASYM init swap=0 asym=0
2014-07-24 20:59:27 EVENT: RESOLVE
2014-07-24 20:59:27 Contacting 73.37.140.86:1194 via UDP
2014-07-24 20:59:27 EVENT: WAIT
2014-07-24 20:59:27 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-24 20:59:37 Server poll timeout, trying next remote entry...
2014-07-24 20:59:37 EVENT: RECONNECTING
2014-07-24 20:59:37 LZO-ASYM init swap=0 asym=0
2014-07-24 20:59:37 EVENT: RESOLVE
2014-07-24 20:59:37 Contacting 73.37.140.86:1194 via UDP
2014-07-24 20:59:37 EVENT: WAIT
2014-07-24 20:59:37 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-24 20:59:47 Server poll timeout, trying next remote entry...
2014-07-24 20:59:47 EVENT: RECONNECTING
2014-07-24 20:59:47 LZO-ASYM init swap=0 asym=0
2014-07-24 20:59:47 EVENT: RESOLVE
2014-07-24 20:59:47 Contacting 73.37.140.86:1194 via UDP
2014-07-24 20:59:47 EVENT: WAIT
2014-07-24 20:59:47 Connecting to server.ddns.net:1194 (73.37.140.86) via UDPv4
2014-07-24 20:59:57 EVENT: CONNECTION_TIMEOUT [ERR]
2014-07-24 20:59:57 EVENT: DISCONNECTED
2014-07-24 20:59:57 Raw stats on disconnect:
BYTES_OUT : 420
PACKETS_OUT : 30
CONNECTION_TIMEOUT : 1
N_RECONNECT : 5
2014-07-24 20:59:57 Performance stats on disconnect:
CPU usage (microseconds): 81764
Network bytes per CPU second: 5136
Tunnel bytes per CPU second: 0
2014-07-24 20:59:57 ----- OpenVPN Stop -----
2014-07-24 20:59:57 EVENT: DISCONNECT_PENDING

Server conf:

ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp
cipher bf-cbc
auth sha256
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
mtu-disc yes
server 10.8.0.0 255.255.255.0
dev tun2
tun-ipv6
passtos

Client ovpn:

client
dev tun2
proto udp
auth sha256
remote server.ddns.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ca.crt
cert davisiphone.crt
key davisiphone.key
ns-cert-type server
comp-lzo
verb 4

Other than trying with a laptop versus an iphone, is there anything else I should do?

dnguyen411

I restarted my router to start the server log over. Maybe something here will help:

Serverlog 20140724 22:28:58 I OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 25 2013
20140724 22:28:58 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14
20140724 22:28:58 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20140724 22:28:59 Diffie-Hellman initialized with 1024 bit key
20140724 22:28:59 Socket Buffers: R=[114688->131072] S=[114688->131072]
20140724 22:28:59 I TUN/TAP device tun2 opened
20140724 22:28:59 TUN/TAP TX queue length set to 100
20140724 22:28:59 I do_ifconfig tt->ipv6=1 tt->did_ifconfig_ipv6_setup=0
20140724 22:28:59 I /sbin/ifconfig tun2 10.8.0.1 netmask 255.255.255.0 mtu 1500 broadcast 10.8.0.255
20140724 22:29:00 I UDPv4 link local (bound): [undef]
20140724 22:29:00 I UDPv4 link remote: [undef]
20140724 22:29:00 MULTI: multi_init called r=256 v=256
20140724 22:29:00 IFCONFIG POOL: base=10.8.0.2 size=252 ipv6=0
20140724 22:29:00 I ifconfig_pool_read() in='davisiphone 10.8.0.2' TODO: IPv6
20140724 22:29:00 I succeeded -> ifconfig_pool_set()
20140724 22:29:00 I ifconfig_pool_read() in='Mine 10.8.0.3' TODO: IPv6
20140724 22:29:00 I succeeded -> ifconfig_pool_set()
20140724 22:29:00 IFCONFIG POOL LIST
20140724 22:29:00 davisiphone 10.8.0.2
20140724 22:29:00 Mine 10.8.0.3
20140724 22:29:00 I Initialization Sequence Completed

I also modified the Firewall slightly from "tun0" to "tun2" and "br0" to "eth1" since my router is using "eth1" for local LAN connections and "tun2" as the VPN tunnel

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT

iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT

iptables -I FORWARD -i eth1 -o tun2 -j ACCEPT

iptables -I FORWARD -i tun2 -o eth1 -j ACCEPT

dnguyen411

I've reset the iptables and still haven't had any luck. I've modified the firewall again this time to log the activity going into my router:

iptables -I INPUT 1 -p udp --dport 1194 -j logaccept
iptables -I FORWARD 1 --source 10.8.0.0/24 -j logaccept
iptables -I FORWARD -i br0 -o tun2 -j logaccept
iptables -I FORWARD -i tun2 -o br0 -j logaccept

It looks like I am getting activity into the router and it's accepted by UDP 1194 but it seems like my iphone client is impatient and not waiting for the server to assign a VPN IP address. The reason I say that is my iphone client seems to send 3 separate connections within a few seconds of each other. Here's an excerpt from the log:

Jul 26 13:10:04 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=18657 PROTO=UDP SPT=10558 DPT=1194 LEN=22
Jul 26 13:10:04 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=44472 PROTO=UDP SPT=10558 DPT=1194 LEN=22
Jul 26 13:10:04 DD-WRT daemon.notice openvpn[26922]: 174.225.241.150:10558 TLS: Initial packet from [AF_INET]174.225.241.150:10558, sid=a38d20af 683ee4ad
Jul 26 13:10:06 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=34092 PROTO=UDP SPT=10558 DPT=1194 LEN=22
Jul 26 13:10:08 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=13803 PROTO=UDP SPT=10558 DPT=1194 LEN=22
Jul 26 13:10:09 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=2160 PROTO=UDP SPT=10548 DPT=1194 LEN=22
Jul 26 13:10:09 DD-WRT daemon.notice openvpn[26922]: 174.225.241.150:10548 TLS: Initial packet from [AF_INET]174.225.241.150:10548, sid=0fb3f679 f4949c0c
Jul 26 13:10:11 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=29492 PROTO=UDP SPT=10548 DPT=1194 LEN=22
Jul 26 13:10:13 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=22616 PROTO=UDP SPT=10548 DPT=1194 LEN=22
Jul 26 13:10:15 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=9203 PROTO=UDP SPT=10548 DPT=1194 LEN=22
Jul 26 13:10:17 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=25232 PROTO=UDP SPT=10548 DPT=1194 LEN=22
Jul 26 13:10:19 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=41650 PROTO=UDP SPT=10541 DPT=1194 LEN=22
Jul 26 13:10:19 DD-WRT daemon.notice openvpn[26922]: 174.225.241.150:10541 TLS: Initial packet from [AF_INET]174.225.241.150:10541, sid=a07eb140 ec3cb6a6
Jul 26 13:10:21 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=36083 PROTO=UDP SPT=10541 DPT=1194 LEN=22
Jul 26 13:10:23 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=34181 PROTO=UDP SPT=10541 DPT=1194 LEN=22
Jul 26 13:10:25 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=19886 PROTO=UDP SPT=10541 DPT=1194 LEN=22
Jul 26 13:10:27 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=48297 PROTO=UDP SPT=10541 DPT=1194 LEN=22
Jul 26 13:10:29 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=26435 PROTO=UDP SPT=10545 DPT=1194 LEN=22
Jul 26 13:10:29 DD-WRT daemon.notice openvpn[26922]: 174.225.241.150:10545 NOTE: --mute triggered...
Jul 26 13:10:31 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=40523 PROTO=UDP SPT=10545 DPT=1194 LEN=22
Jul 26 13:10:33 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=6613 PROTO=UDP SPT=10545 DPT=1194 LEN=22
Jul 26 13:10:35 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=63177 PROTO=UDP SPT=10545 DPT=1194 LEN=22
Jul 26 13:10:37 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=54876 PROTO=UDP SPT=10545 DPT=1194 LEN=22
Jul 26 13:10:39 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=704 PROTO=UDP SPT=10543 DPT=1194 LEN=22
Jul 26 13:10:41 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=28749 PROTO=UDP SPT=10543 DPT=1194 LEN=22
Jul 26 13:10:43 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=15164 PROTO=UDP SPT=10543 DPT=1194 LEN=22
Jul 26 13:10:45 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=53070 PROTO=UDP SPT=10543 DPT=1194 LEN=22
Jul 26 13:10:47 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=62105 PROTO=UDP SPT=10543 DPT=1194 LEN=22
Jul 26 13:10:49 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=7560 PROTO=UDP SPT=10555 DPT=1194 LEN=22
Jul 26 13:10:51 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=36421 PROTO=UDP SPT=10555 DPT=1194 LEN=22
Jul 26 13:10:53 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=7121 PROTO=UDP SPT=10555 DPT=1194 LEN=22
Jul 26 13:10:55 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=54461 PROTO=UDP SPT=10555 DPT=1194 LEN=22
Jul 26 13:10:57 DD-WRT kern.warn kernel: ACCEPT IN=vlan2 OUT= MAC=00:23:69:aa:0e:d1:64:00:f1:7c:10:e2:08:00:45:20:00:2a SRC=174.225.241.150 DST=192.168.1.1 LEN=42 TOS=0x00 PREC=0x20 TTL=47 ID=58421 PROTO=UDP SPT=10555 DPT=1194 LEN=22
Jul 26 13:11:04 DD-WRT daemon.notice openvpn[26922]: 174.225.241.150:10558 3 variation(s) on previous 3 message(s) suppressed by --mute

Separate Question: Would generating the EasyRSA keys on a 32 bit machine vs a 64 bit machine make a difference? I used the 64-bit openvpn install to create the keys but my iphone is a 32-bit device.

dnguyen411

You are clearly loosing your way on this thread .....

I'm not a software nor networking expert in any way. I just have a knack in tinkering in this stuff from time to time.

If your OpenVPN server is on IP address 192.168.1.1 I suggest you change this as it will very likely cause routing conflicts in the future. It is also possible that this is causing issues with your current setup.

The router is on 192.168.1.1. The OpenVPN IP address is setup on 10.8.0.0. Are you saying that I need to modify the IP address for the router and forward that IP to UDP 1194 or should I really be forwarding IP 10.8.0.0 to UDP 1194?

Like I said, I'm not a networking expert in any way...

dnguyen411

Quote:
If your OpenVPN server is on IP address 192.168.1.1 I suggest you change this as it will very likely cause routing conflicts in the future. It is also possible that this is causing issues with your current setup.

The router is on 192.168.1.1. The OpenVPN IP address is setup on 10.8.0.0. Are you saying that I need to modify the IP address for the router and forward that IP to UDP 1194 or should I really be forwarding IP 10.8.0.0 to UDP 1194?

Nevermind my last statement... wasn't thinking too clearly here. I can't forward IP 10.8.0.0 because that's not my server. 192.168.1.1 is my server.

I went ahead and changed my router LAN to start with 192.168.54.1 and my DHCP for my local PCs to start with 192.168.54.100. Fifty IP addresses (i.e. 192.168.54.100 through 192.168.54.149) were made available on my router. I also changed my port forwarding of UDP 1194 to 192.168.54.1. Ran OpenVPN again on my iPhone. Still no luck...

dnguyen411

So I erased the nvram on my router and reload the firmware into my router. Setup my router again for OpenVPN and tried to connect with my iphone. Still no luck.

I went ahead and opened the DMZ on my router to 192.168.54.1 (my router's address) and tried again. This time the iphone will connect to the OpenVPN.

I closed the DMZ after this so I don't get some attack that would affect my network.

So I've concluded that my OpenVPN server setup is correct but my router's firewall is preventing the UDP 1194 traffic from going through even though the port is forwarded correctly. Are there any other ports I should be forwarding to my server? How about any other IPTables commands?

Here's my latest Iptables:

iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT
iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o br0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
iptables -I FORWARD -i br0 -o tun2 -j ACCEPT
iptables -I FORWARD -i tun2 -o br0 -j ACCEPT
iptables -t nat -I POSTROUTING -o tun2 -j MASQUERADE

I ran IPTABLES -vnL. Here's the output:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
1361 153K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
0 0 ACCEPT 0 -- tun2 * 0.0.0.0/0 0.0.0.0/0
0 0 DROP udp -- vlan2 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
0 0 DROP udp -- br0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.54.1 tcp dpt:443
0 0 DROP icmp -- vlan2 * 0.0.0.0/0 0.0.0.0/0
0 0 DROP 2 -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW
425 41833 ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
63 6749 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- tun2 br0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br0 tun2 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- * * 10.8.0.0/24 0.0.0.0/0
0 0 ACCEPT 47 -- * vlan2 192.168.54.0/24 0.0.0.0/0
0 0 ACCEPT tcp -- * vlan2 192.168.54.0/24 0.0.0.0/0 tcp dpt:1723
0 0 ACCEPT 0 -- tun2 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- * tun2 0.0.0.0/0 0.0.0.0/0
15624 3238K lan2wan 0 -- * * 0.0.0.0/0 0.0.0.0/0
10682 2656K ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
64 3296 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
0 0 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.54.100 tcp dpt:54232
896 103K ACCEPT udp -- * * 0.0.0.0/0 192.168.54.100 udp dpt:54232
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.54.101 tcp dpt:61391
3924 472K ACCEPT udp -- * * 0.0.0.0/0 192.168.54.101 udp dpt:61391
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.54.1 udp dpt:1194
16 800 ACCEPT tcp -- * * 0.0.0.0/0 192.168.54.100 tcp dpts:5800:5900
0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.54.100 udp dpts:5800:5900
0 0 TRIGGER 0 -- vlan2 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0
106 6885 trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
99 6605 ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
7 280 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 2139 packets, 1136K bytes)
pkts bytes target prot opt in out source destination
Chain advgrp_1 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_10 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_2 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_3 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_4 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_5 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_6 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_7 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_8 (0 references)
pkts bytes target prot opt in out source destination
Chain advgrp_9 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_1 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_10 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_2 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_3 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_4 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_5 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_6 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_7 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_8 (0 references)
pkts bytes target prot opt in out source destination
Chain grp_9 (0 references)
pkts bytes target prot opt in out source destination
Chain lan2wan (1 references)
pkts bytes target prot opt in out source destination
Chain logaccept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (0 references)
pkts bytes target prot opt in out source destination
0 0 DROP 0 -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
pkts bytes target prot opt in out source destination
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
Chain trigger_out (1 references)
pkts bytes target prot opt in out source destination

dnguyen411

Figured it out... when using DD-WRT, there is no need to Port Forward the router's IP Address to UDP 1194. The router will automatically do it.