I've recently configured my dd-wrt router to successfully host OpenVPN as server. I'm consistently able to connect to the server from "the outside" internet, but I have some ping and firewall concerns. I only know enough about this stuff to hold my own in a conversation, so pardon my lack of knowledge of firewalls.
This is my current configuration:
-the dd-wrt router (vpn server)
-my w7 laptop (vpn client, on unique network in some other city)*
-my w8.1 desktop (no vpn software, just on the subnet "behind" the router)
*note that I'm not doing redirect-gateway
local: 192.168.1.0
vpn: 192.168.66.0
Everything seems to function. The firewalls are on, the laptop's OpenVPN software says it connects without errors, new VPN IPs get assigned to clients, etc etc. The only issue is that the devices are not able to ping each other. More specifically, the PCs cannot ping each other and the laptop is not even able to ping the router. I know it's a firewall issue because
once I disable all 3 firewalls (router, desktop, and laptop), suddenly they can all ping each other without a single hiccup. I tried activating each firewall independently then re-testing and I've come to the conclusion that the fault lies with all 3 firewalls. Each device can only be ping'd when its respective firewall is disabled - so it seems that each firewall needs some m
assaging to allow the pings to work. I've searched all over and most of the solutions out there were things that I already have configured. I suspect that this is an easy fix.
I think my firewall question can be broken down into 3 categories:
1) the w7 laptop client. What firewall settings do I need to change? I've already given the OpenVPN software full firewall access. What else do I need to do?
2) the w8.1 desktop behind the router on the local subnet. There is no OpenVPN software to which I can grant firewall access. I know I need to add some type of firewall rule to let these through, but the only rule I could get to work was a rule that basically allowed
any connection, which just sounds horribly insecure to me. Is there a simple way to allow these through that doesn't compromise my firewall? I suspect that port forwarding will come into play, but I'll have a few more questions about that (such as: how to not break the vpn in the process; or what about other devices on the subnet if they want to be "ping-able" too?... etc etc).
3) the dd-wrt server. One thread had someone with a similar issue that they fixed by adding FORWARD policies to their host. I already have forward policies in my iptables that allow the vpn to work. It seems that only one of them is being used based on packets counters (see below). Is there one I need to add? I have a FORWARD policy with 192.168.66.0/24 as the source (e.g. my laptop client), but there are no packet counts, so I think I'm misunderstanding something here. How do I forward pings from a client up to 192.168.
66.1 and 192.168.
1.1? I can't ping either one when the firewall is up. (the pings to the server work fine when I disable the firewall).
If you don't know the answer to all 3, that's fine - any insight is much appreciated. If you really really really really want to see my config files, I'll paste them in. I just think the issue here is independent of the config - they are working as expected. The issue here has to do with the firewall settings which are managed on the individual PCs and in the iptables on the router. But if you need to see the config for some reason, just say the word 😉
My iptables:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
125 15611 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1194
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:1194
6275 863K ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 DROP udp -- vlan2 any anywhere anywhere udp dpt:route
0 0 DROP udp -- br0 any anywhere anywhere udp dpt:route
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:route
31 2948 ACCEPT icmp -- vlan2 any anywhere anywhere
741 26676 DROP igmp -- any any anywhere anywhere
13 802 ACCEPT 0 -- lo any anywhere anywhere state NEW
6674 520K ACCEPT 0 -- br0 any anywhere anywhere state NEW
3129 883K DROP 0 -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
#### I ADDED THE TOP 4 DURING VPN CONFIGURATION ####
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- tun0 br0 anywhere anywhere
0 0 ACCEPT 0 -- br0 tun0 anywhere anywhere
1552K 84M ACCEPT 0 -- any any 192.168.1.0/24 anywhere
0 0 ACCEPT 0 -- any any 192.168.66.0/24 anywhere
0 0 ACCEPT gre -- any vlan2 192.168.1.0/24 anywhere
0 0 ACCEPT tcp -- any vlan2 192.168.1.0/24 anywhere tcp dpt:1723
4307K 6336M lan2wan 0 -- any any anywhere anywhere
2687 142K TCPMSS tcp -- any any anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
4307K 6336M ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT 0 -- br0 br0 anywhere anywhere
0 0 TRIGGER 0 -- vlan2 br0 anywhere anywhere TRIGGER type:in match:0 relate:0
0 0 trigger_out 0 -- br0 any anywhere anywhere
0 0 ACCEPT 0 -- br0 any anywhere anywhere state NEW
0 0 DROP 0 -- any any anywhere anywhere
