Thanks in advance for help. I am missing something and I just can't seem to figure it out.
I have 2 DD-WRT routers I am connecting via Openvpn. I want to be able to route traffic freely between them as if they belong to one LAN. Openvpn sets up fine. Openvpn logs look correct.
Traffic flows fine from 1 -> 2 meaning router 2 can access hosts on router 1 LAN. Traffic does NOT flow from 2 -> 1, meaning hosts on router 1 can not access hosts on router 2.
I am NOT using the dd-wrt openvpn web interface to setup openvpn. I am setting this up with scripts.
I checked the firewall logs and see packets from router 1 going into tun0 but the logs on router 2 show nothing being routed out of the tunnel (nothing out of tun0). I tried turning off the firewalls on router 2 and no change. The iptables -i tun0 -o br0 shows zero traffic on both routers.
Router 1 (server) - subnet 10.41.61.0
Router 2 (client) - subnet 192.168.11.0
Tunnel - 10.0.1.0
Router 1 (server) config
mode server
tls-server
cipher AES-128-CBC
proto udp
client-to-client
port 1195
server 10.0.1.0 255.255.255.0
push "route 10.47.67.0 255.255.255.0"
route 192.168.11.0 255.255.255.0
dev tun0
client-to-client
verb 5
keepalive 15 60
daemon
comp-lzo no # disables compression
persist-key
persist-tun
dh dh.pem
ca ca.crt
cert cert.pem
key key.pem
tls-auth abc.key 0
Router 1 - Firewall
iptables -I INPUT -p udp --dport 1195 -j logbrute
iptables -I INPUT -p udp --dport 1195 -j logaccept
iptables -I FORWARD -i tun0 -o br0 -j logaccept
iptables -I FORWARD -i br0 -o tun0 -j logaccept
iptables -t nat -A POSTROUTING -j MASQUERADE
Router 2 (client) config
client
remote my.dns.address.org
proto udp
ns-cert-type server
resolv-retry infinite
port 1195
dev tun0
verb 3
keepalive 15 60
daemon
cipher AES-128-CBC
comp-lzo no
tls-auth abc.key 1
ca ca.crt
cert c1.crt
float
key c1.key
resolv-retry 60
auth-nocache
nobind
Router 2 - firewall
iptables -I INPUT -p udp --dport 1195 -j logaccept
iptables -I INPUT -i tun0 -p icmp -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j logaccept
iptables -I FORWARD -i br0 -o tun0 -j logaccept
iptables -t nat -A POSTROUTING -j MASQUERADE
Startup Script - both routers same
openvpn --mktun --dev tun0
ifconfig tun0 0.0.0.0 promisc up
sleep 20 && openvpn --config openvpn.conf &
route table (server) - router 1
~# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.1.1 P-t-P:10.0.1.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST MTU:1500 Metric:1
RX packets:1829 errors:0 dropped:0 overruns:0 frame:0
TX packets:2874 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:126418 (123.4 KiB) TX bytes:2428572 (2.3 MiB)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 90.989.999.1 0.0.0.0 UG 0 0 0 vlan2
10.0.1.0 10.0.1.2 255.255.255.0 UG 0 0 0 tun0
10.0.1.2 * 255.255.255.255 UH 0 0 0 tun0
10.41.61.0 * 255.255.255.0 U 0 0 0 br0
90.989.999.0 * 255.255.254.0 U 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.166.7.0 * 255.255.255.0 U 0 0 0 wl0.1
192.168.11.0 10.0.1.2 255.255.255.0 UG 0 0 0 tun0
route table (client) - router 2
~# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.1.6 P-t-P:10.0.1.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:148 (148.0 B)
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 888.999.55.1 0.0.0.0 UG 0 0 0 ath0
10.0.1.0 10.0.1.5 255.255.255.0 UG 0 0 0 tun0
10.0.1.5 * 255.255.255.255 UH 0 0 0 tun0
10.41.61.0 10.0.1.5 255.255.255.0 UG 0 0 0 tun0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.168.11.0 * 255.255.255.0 U 0 0 0 br0
888.999.55.0 * 255.255.255.0 U 0 0 0 ath0
