Hi: I am unable to get responses for DNS queries sent from clients. The same names resolve fine on the router where OpenVPN is running. I can ping all other IP addresses in the network, but cannot ping the router itself. So I am guessing it's an iptables rules.
Interfaces on the router:
br0 Link encap:Ethernet HWaddr 10:6F:3F:DB:0D:B0
inet addr:192.168.10.2 Bcast:192.168.10.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1188064 errors:0 dropped:38128 overruns:0 frame:0
TX packets:2541752 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:225558614 (215.1 MiB) TX bytes:3394768869 (3.1 GiB)
.
.
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.127.1 P-t-P:10.0.127.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:32 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:2107 (2.0 KiB) TX bytes:889 (889.0 B)
.
.
vlan2 Link encap:Ethernet HWaddr 10:6F:3F:DB:0D:B1
inet addr:X.X.X.X Bcast:X.X.X.X Mask:255.255.255.224
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5032807 errors:0 dropped:14886 overruns:0 frame:0
TX packets:1029644 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3475097602 (3.2 GiB) TX bytes:234535759 (223.6 MiB)
DNS lookup on the router works fine
root@DD-WRT:~# nslookup hostname
Server: 192.168.10.2
Address 1: 192.168.10.2 DD-WRT
Name: hostname
Address 1: 192.168.10.53 hostname
tcpdump on router when running DNS for same hostname from the client
root@DD-WRT:~# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
19:14:56.745678 IP 10.0.127.2.59484 > DD-WRT.domain: 1+ PTR? 2.10.168.192.in-addr.arpa. (43)
19:14:58.755959 IP 10.0.127.2.59485 > DD-WRT.domain: 2+ A? hostname.localdomain. (43)
19:15:00.766083 IP 10.0.127.2.59486 > DD-WRT.domain: 3+ AAAA? hostname.localdomain. (43)
Firewall on router
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.0.127.0/24 -o vlan2 -j SNAT --to-source $(nvram get wan_ipaddr)
Server Config
push "route 192.168.10.0 255.255.255.0"
push "dhcp-option DNS 192.168.10.2"
server 10.0.127.0 255.255.255.0
topology subnet
dev tun
proto udp
keepalive 10 120
tls-server
comp-lzo
daemon
client-to-client
verb 3
status /tmp/openvpn/openvpn.log
script-security 2
Client Config
client
dev tun1
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3
auth-user-pass
