Hello, I'm using Linksys E1200. On this router I have configured openVPN daemon. Connection to the openVPN from the local network works good. From my ISP I'm connected to the Internet by access point. I can access the AP from the internet. I requested ISP to turn off firewall and forward 1194 UDP port to my IP address of router. I can see it from the port checker as [b]open|filtered[/b]. I've also have dynamic IP which I covered by dyndns.org. The problem comes when I try to connect through the internet (not by local IP) it says Connection Timeout (on PC and on Android device). Firewall commands: [code]iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT iptables -I FORWARD 1 --source 10.0.7.0/24 -j ACCEPT iptables -I FORWARD -i br0 -o tun0 -j ACCEPT iptables -I FORWARD -i tun0 -o br0 -j ACCEPT iptables -t nat -A POSTROUTING -s 10.0.7.0/24 -j MASQUERADE[/code] openVPN config: [code]push "route 192.168.100.1 255.255.255.0" server 10.0.7.0 255.255.255.0 push "dhcp-option DNS 192.168.1.1" push "dhcp-option DNS 194.145.207.94" push "dhcp-option DNS 192.168.100.1" dev tun0 proto udp keepalive 10 120 dh /tmp/openvpn/dh.pem ca /tmp/openvpn/ca.crt cert /tmp/openvpn/cert.pem key /tmp/openvpn/key.pem management localhost 16[/code] Thanks for response

for testing disable your openvpns server firewall, also change this [code]push "route 192.168.100.1 255.255.255.0"[/code] to this [code]push "route 192.168.100.1 255.255.255.255"[/code] without logs i cant say much... Michael

[quote="mfocko"][b]OpenVPN 2.3.1[/b] mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] [u]built on May 27 [b]2013[/b][/u][/quote]does this needs updating .. [quote="mfocko"]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/quote]this is going to be an ongoing problem for you .. [quote="mfocko"]20150210 15:32:50 W WARNING: External program may not be called unless '--script-security 2' or higher is enabled. Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier. See --help text or man page for detailed info. 20150210 15:32:50 W WARNING: Failed running command (--route-up): external program fork failed[/quote]Probably worth you posting your complete server and client configs and logs (verb 4) .. [quote="mfocko"]Serverlog Clientlog [/quote] :?:

openVPN works in LAN but not from internet

mfocko

Hello, I'm using Linksys E1200. On this router I have configured openVPN daemon. Connection to the openVPN from the local network works good. From my ISP I'm connected to the Internet by access point. I can access the AP from the internet. I requested ISP to turn off firewall and forward 1194 UDP port to my IP address of router. I can see it from the port checker as open|filtered. I've also have dynamic IP which I covered by dyndns.org. The problem comes when I try to connect through the internet (not by local IP) it says Connection Timeout (on PC and on Android device).

Firewall commands:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 10.0.7.0/24 -j ACCEPT

iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

iptables -t nat -A POSTROUTING -s 10.0.7.0/24 -j MASQUERADE

openVPN config:

push "route 192.168.100.1 255.255.255.0"
server 10.0.7.0 255.255.255.0

push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DNS 194.145.207.94"
push "dhcp-option DNS 192.168.100.1"

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

management localhost 16

Thanks for response

maikcat

you are trying to connect FROM the internet or while in the same lan using your
routers WAN ip address?

also post your server config/logs

Michael

mfocko

I'm connecting by AP's external IP and the ISP told me they have forwarded 1194 UDP to my router. It doesn't work from outside and LAN too. When I use local IP of server (address of IP) it works. I'm not near the netqork so I can't post the logs. When I run traceoute on 1194 it ends on AP

maikcat

for testing disable your openvpns server firewall,

also change this

push "route 192.168.100.1 255.255.255.0"

to this

push "route 192.168.100.1 255.255.255.255"

without logs i cant say much...

Michael

mfocko

This is log from openVPN:

 Serverlog Clientlog 20150210 14:58:24 I OpenVPN 2.3.1 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May 27 2013
20150210 14:58:24 W NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
20150210 14:58:24 W NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
20150210 14:58:26 I TUN/TAP device tun0 opened
20150210 14:58:26 I do_ifconfig tt->ipv6=0 tt->did_ifconfig_ipv6_setup=0
20150210 14:58:26 I /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
20150210 14:58:26 W WARNING: External program may not be called unless '--script-security 2' or higher is enabled. Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier. See --help text or man page for detailed info.
20150210 14:58:26 W WARNING: Failed running command (--route-up): external program fork failed
20150210 14:58:26 I UDPv4 link local (bound): [undef]
20150210 14:58:26 I UDPv4 link remote: [undef]
20150210 14:58:26 I Initialization Sequence Completed
20150210 14:59:10 I 192.168.100.41:33923 [P8P67] Peer Connection Initiated with [AF_INET]192.168.100.41:33923
20150210 14:59:10 I P8P67/192.168.100.41:33923 MULTI_sva: pool returned IPv4=10.8.0.6 IPv6=(Not enabled)
20150210 14:59:12 I P8P67/192.168.100.41:33923 send_push_reply(): safe_cap=940
19700101 00:00:00

That last three logs are from connecting from LAN.
Firewall is disabled from beginning.

mfocko

Log from openVPN:

Serverlog Clientlog 20150210 15:32:48 I OpenVPN 2.3.1 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May 27 2013
20150210 15:32:48 W NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
20150210 15:32:48 W NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
20150210 15:32:50 I TUN/TAP device tun0 opened
20150210 15:32:50 I do_ifconfig tt->ipv6=0 tt->did_ifconfig_ipv6_setup=0
20150210 15:32:50 I /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
20150210 15:32:50 W WARNING: External program may not be called unless '--script-security 2' or higher is enabled. Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier. See --help text or man page for detailed info.
20150210 15:32:50 W WARNING: Failed running command (--route-up): external program fork failed
20150210 15:32:50 I UDPv4 link local (bound): [undef]
20150210 15:32:50 I UDPv4 link remote: [undef]
20150210 15:32:50 I Initialization Sequence Completed
19700101 00:00:00

Can't it be something with VLAN or DNS setting? And also if the 1194 UDP is forwarded from the AP to my router isn't there something I have to do (more than firewall settings I posted). By the way the firewall is disabled from the beginning.

Traffic

mfocko wroteOpenVPN 2.3.1 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May 27 2013

does this needs updating ..

mfocko wroteNOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

this is going to be an ongoing problem for you ..

mfocko wrote20150210 15:32:50 W WARNING: External program may not be called unless '--script-security 2' or higher is enabled. Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier. See --help text or man page for detailed info.
20150210 15:32:50 W WARNING: Failed running command (--route-up): external program fork failed

Probably worth you posting your complete server and client configs and logs (verb 4) ..

mfocko wroteServerlog Clientlog

:?:

mfocko

OK. so:
1, I'm running the openVPN server on DD-WRT router and there is no newer version of ROM, I'm going to run server on old laptop, but it needs to be completely reinstalled, so this is just temporary solution for me.
2, My subnet is 192.168.100.x so I'm not sure it makes so big problem, but I can change it.

mfocko

I have changed the subnet (112.200.60.1) and I'm still getting "Connection timeout"

Traffic

mfocko wroteMy subnet is 192.168.100.x

Your Log:

mfocko wroteCode:
Serverlog Clientlog :?: 20150210 15:32:48 I OpenVPN 2.3.1 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May 27 2013
20150210 15:32:48 W NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

You even push "dhcp-option DNS 192.168.1.1" in your server config ..

mfocko wroteI have changed the subnet (112.200.60.1) and I'm still getting "Connection timeout"

You have changed what subnet ?

Have you read this : RFC1918 : These are the internet reserved IP ranges for private subnets.

mfocko

You mean that subnet? I can't chamge this it's subnet of AP from, but I can delete the DHCP server command and use that they have on AP

mfocko

Would it help if I use openDNS server? It was problem even to convince them to turn off firewall and forward 1194.

Traffic

Let us start over:

mfocko wrotem using Linksys E1200. On this router I have configured openVPN daemon. Connection to the openVPN from the local network works good. From my ISP I'm connected to the Internet by access point. I can access the AP from the internet. I requested ISP to turn off firewall and forward 1194 UDP port to my IP address of router. I can see it from the port checker as open|filtered. I've also have dynamic IP which I covered by dyndns.org. The problem comes when I try to connect through the internet (not by local IP) it says Connection Timeout (on PC and on Android device).

On your Linksys E1200 check the log files for incoming UDP:1194 packets.

Forget about everything else for now.

mfocko

For logging I had to start firewall, enabled logging at maximum verbosity and I don't have here 1194UDP when I'm trying to connect.

Traffic

For testing try using --proto tcp-server & tcp-client

maybe your ISP has enabled the right port but the wrong protocol ...

mfocko

no, they opened right port, when i use online port check it says the TCP is closed and UDP is opened|filtered
And traceroute ends on AP's IP

Traffic

mfocko wrotewhen i use online port check it says the TCP is closed and UDP is opened|filtered

mfocko wroteFor logging I had to start firewall, enabled logging at maximum verbosity and I don't have here 1194UDP

Do you see packets in log at the server when you use online port check ?

mfocko

No, for me it looks like they didn't set forwarding