Hey all,
I'm trying to get openvpn working on DD-WRT router.
I can make a connection inside my lan, but outside the connection is yellow. I think yellow means it is close to making a connection, but it never completes the connection. So I believe there is a problem with my iptables since it works inside my lan.
My openvpn server conf looks like this:
dev tun
ifconfig 10.1.0.1 10.1.0.2
script-security 2
up ./openvpn.up
push "route 192.168.10.0 255.255.255.0"
secret static.key
comp-lzo
persist-tun
persist-key
verb 3
log-append /opt/var/log/openvpn/openvpn.log
My client conf:
remote x.x.x.x
dev tun
ifconfig 10.1.0.2 10.1.0.1
script-security 2
comp-lzo
secret static.key
My iptable is as follows:
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:1194
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
DROP udp -- anywhere anywhere udp dpt:route
DROP udp -- anywhere anywhere udp dpt:route
ACCEPT udp -- anywhere anywhere udp dpt:route
ACCEPT 0 -- anywhere anywhere
ACCEPT tcp -- anywhere asusn tcp dpt:ssh
ACCEPT tcp -- anywhere asusn tcp dpt:ssh
DROP icmp -- anywhere anywhere
DROP igmp -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
ACCEPT 0 -- anywhere anywhere state NEW
DROP 0 -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- 10.1.0.0/24 anywhere
ACCEPT tcp -- anywhere ipcam tcp dpt:8300
ACCEPT gre -- 192.168.10.0/24 anywhere
ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:1723
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
lan2wan 0 -- anywhere anywhere
TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere
ACCEPT tcp -- anywhere asusn tcp dpt:ssh
ACCEPT udp -- anywhere asusn udp dpt:ssh
TRIGGER 0 -- anywhere anywhere TRIGGER type:in match:0 relate:0
trigger_out 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
DROP 0 -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
Chain logaccept (0 references)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
Chain logbrute (0 references)
target prot opt source destination
0 -- anywhere anywhere recent: SET name: BRUTEFORCE side: source
RETURN 0 -- anywhere anywhere !recent: UPDATE seconds: 60 hit_count: 4 name: BRUTEFORCE side: source
RETURN 0 -- anywhere anywhere limit: avg 1/min burst 1
DROP 0 -- anywhere anywhere
Chain logdrop (0 references)
target prot opt source destination
DROP 0 -- anywhere anywhere
Chain logreject (0 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere reject-with tcp-reset
Here is the openvpn client output:
Fri Aug 15 12:34:03 2014 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Fri Aug 15 12:34:03 2014 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Fri Aug 15 12:34:03 2014 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Aug 15 12:34:03 2014 LZO compression initialized
Fri Aug 15 12:34:03 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{784EE124-9618-4E92-9B06-169556C07A08}.tap
Fri Aug 15 12:34:03 2014 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.1.0.2/255.255.255.252 on interface {784EE124-9618-4E92-9B06-169556C07A08} [DHCP-serv: 10.1.0.1, lease-time: 31536000]
Fri Aug 15 12:34:03 2014 UDPv4 link local (bound): [undef]:1194
Fri Aug 15 12:34:03 2014 UDPv4 link remote: x.x.x.x:1194
Do you guys see any issues? I know the static key method is not very secure but I just wanted to get something easy and quick working, before I make it more secure.
Here is my server log, doesn't seem to create any new entries when I attempt to connect.
Fri Aug 15 12:46:57 2014 OpenVPN 2.2.0 mipsel-linux [SSL] [LZO2] [EPOLL] [eurephia] built on Feb 16 2012
2 Fri Aug 15 12:46:57 2014 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVP N 2.0-beta16 and earlier used 5000 as the default port.
3 Fri Aug 15 12:46:57 2014 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
4 Fri Aug 15 12:46:57 2014 Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
5 Fri Aug 15 12:46:57 2014 Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
6 Fri Aug 15 12:46:57 2014 Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
7 Fri Aug 15 12:46:57 2014 Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
8 Fri Aug 15 12:46:57 2014 LZO compression initialized
9 Fri Aug 15 12:46:57 2014 Socket Buffers: R=[114688->131072] S=[114688->131072]
10 Fri Aug 15 12:46:57 2014 TUN/TAP device tun0 opened
11 Fri Aug 15 12:46:57 2014 TUN/TAP TX queue length set to 100
12 Fri Aug 15 12:46:57 2014 /sbin/ifconfig tun0 10.1.0.1 pointopoint 10.1.0.2 mtu 1500
13 Fri Aug 15 12:46:57 2014 ./openvpn.up tun0 1500 1545 10.1.0.1 10.1.0.2 init
14 Fri Aug 15 12:46:57 2014 Data Channel MTU parms [ L:1545 D:1450 EF:45 EB:135 ET:0 EL:0 AF:3/1 ]
15 Fri Aug 15 12:46:57 2014 Local Options hash (VER=V4): '2b90ef6a'
16 Fri Aug 15 12:46:57 2014 Expected Remote Options hash (VER=V4): 'cc1583e3'
17 Fri Aug 15 12:46:57 2014 UDPv4 link local (bound): [undef]:1194
18 Fri Aug 15 12:46:57 2014 UDPv4 link remote: [undef]
