I'm not able to access the LAN from the OpenVPN subnet, despite having port-forwarding, iptables, and routes configured. Likely the routing or iptables portions are incorrect in some way.
Network Summary:
LAN: 192.168.1.0/24
OpenVPN: 10.8.0.0/24
DD-WRT router: 192.168.1.2
OpenVPN server: 192.168.1.50 (10.8.0.1)
OpenVPN server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
iptables configuration in rc.local (pulled from various write-ups in hopes of making it work)
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 192.168.1.50
iptables -A FORWARD -j REJECT
service dnsmasq restart
Figured I may need a route on the DD-WRT router:
Destination LAN NET Subnet Mask Gateway
10.8.0.0 255.255.255.0 192.168.1.50
Added a route to 10.8.0.0 on my OpenVPN Ubuntu server. Not sure however if routes to the OpenVPN subnet are meant to go through the OpenVPN server IP (10.8.0.1) or the OpenVPN server LAN IP (192.168.1.50).
So not sure which command:
route add -net 10.8.0.0/24 gw 192.168.1.50
route add -net 10.8.0.0/24 gw 10.8.0.1
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.2 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.1 255.255.255.0 UG 0 0 0 tun0
10.8.0.0 192.168.1.50 255.255.255.0 UG 0 0 0 eth0 # <-- THIS ONE
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
Attempting to ping the LAN from the OpenVPN subnet is failing:
ping -I tun0 192.168.1.50
PING 192.168.1.50 (192.168.1.50) from 10.8.0.1 tun0: 56(84) bytes of data.
--- 192.168.1.50 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 999ms
ping -I tun0 192.168.1.2
PING 192.168.1.2 (192.168.1.2) from 10.8.0.1 tun0: 56(84) bytes of data.
--- 192.168.1.2 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2015ms
ping -I tun0 yahoo.com
PING yahoo.com (98.138.253.109) from 10.8.0.1 tun0: 56(84) bytes of data.
--- yahoo.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2015ms
Overall I'm not sure if I require static routes on both the Ubuntu OpenVPN server and the DD-WRT router. I've read at least the guides below but am struggling to make it work. Any help would be appreciated.
http://grantcurell.com/2014/07/22/setting-up-a-vpn-server-on-ubuntu-14-04/
http://www.unixmen.com/setup-configure-openvpn-server-ubuntu-13-10/
http://parabing.com/2014/06/openvpn-on-ubuntu/
http://stackoverflow.com/questions/26539719/openvpn-and-iptables
http://allanmcrae.com/2013/09/routing-traffic-with-openvpn/
http://blog.remibergsma.com/2013/01/13/howto-connect-to-hosts-on-a-remote-network-using-openvpn-and-some-routing/
