Validation of approach - TAP over TUN for use with Windows

RangerZ

I am a windows user with probably not a good enough understanding of networking to really understand OpenVPN. I have however built both TAP and TUN environments that mostly work. They work from a Windows PC Client to an OpenWRT Server, but I have varying amounts of failures as I move to running through my travel router (working as a Router) or from my travel router (working as a Router with an OpenVPN Client).

I am more concerned for this post of validating my approach to things, but have included files for my TAP config issue if someone can spot the problem.

I expect to have up to 3 Windows clients (XP and 7) and 1-2 IOS devices with no more than 3 simultaneous connections. If I can cover Android great, but not required. I travel frequently and I want to be able to run ALL my remote traffic back through my home server and also access files on my LAN through either the travel router (HooToo TM-02) or PC. I am not sure if will need to run a remote desktop client or not, but have found this useful. If I can have full access to files on the LAN (mostly media) then I would be fine. I am skeptical I will be able to stream from my LAN (connection speed limitations) and expect to download and play local.

Reading this article https://community.openvpn.net/openvpn/wiki/BridgingAndRouting and wanting to use Windows Explorer I am lead to beliving that I must use TAP.

I am now seeing some new wiki articles on OpenWRT and other places about accessing the LAN with TUN (routing).
http://wiki.openwrt.org/doc/howto/openvpn-streamlined-server-setup
http://wiki.openwrt.org/doc/howto/vpn.openvpn
None of these are clear on what I get\need for LAN access:

Linux\Windows
Windows Explorer\other tools
Other => remote desktop, streaming

I need to browse, but can probably use an alternative tool (to Explorer) under Windows.

A single TUN would make life easier as I could connect directly or through the travel router with any device.

The only real issue I have with TAP today is that, with my travel router, I can connect, access the internet, see the LAN but not access it. I get a permissions errors trying to access the shared folders.

Below are the client side logs and configs for both the OpenWRT client and Windows PC, along with the server logs for the connected HooToo. I also have included the HooToo network and firewall files. There are some differences, and they are basically lines that would error under OpenWRT.

remote-cert-tls server - not in OpenWRT
option port '1190' required in OpenWRT to use other than default 1194

There does not appear to be anything required on the client for rules, etc from my readings.

TM-02 OpenVPN Client Log File - Verb 4

Sun Jul 19 10:52:47 2015 us=830196 [server] Inactivity timeout (--ping-restart), restarting
Sun Jul 19 10:52:47 2015 us=834736 TCP/UDP: Closing socket
Sun Jul 19 10:52:47 2015 us=835716 SIGUSR1[soft,ping-restart] received, process restarting
Sun Jul 19 10:52:47 2015 us=836176 Restart pause, 2 second(s)
Sun Jul 19 10:52:50 2015 us=79896 Re-using SSL/TLS context
Sun Jul 19 10:52:50 2015 us=80376 LZO compression initialized
Sun Jul 19 10:52:50 2015 us=80856 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 13000)
Sun Jul 19 10:52:50 2015 us=87196 Control Channel MTU parms [ L:13094 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 19 10:52:50 2015 us=97916 Socket Buffers: R=[163840->327680] S=[163840->327680]
Sun Jul 19 10:52:50 2015 us=98616 Data Channel MTU parms [ L:13094 D:13094 EF:62 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Jul 19 10:52:50 2015 us=99036 Fragmentation MTU parms [ L:13094 D:1300 EF:61 EB:135 ET:33 EL:0 AF:3/1 ]
Sun Jul 19 10:52:50 2015 us=99416 UDPv4 link local: [undef]
Sun Jul 19 10:52:50 2015 us=99816 UDPv4 link remote: [AF_INET]192.168.1.21:1190
Sun Jul 19 10:52:50 2015 us=104776 TLS: Initial packet from [AF_INET]192.168.1.21:1190, sid=5cc7c526 6fbe8e59
Sun Jul 19 10:52:50 2015 us=394076 VERIFY OK: depth=1, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=BlackBox1, name=Name_Var, emailAddress=[email removed]
Sun Jul 19 10:52:50 2015 us=408956 VERIFY OK: nsCertType=SERVER
Sun Jul 19 10:52:50 2015 us=409396 VERIFY OK: depth=0, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=server, name=Name_Var, emailAddress=[email removed]
Sun Jul 19 10:52:51 2015 us=346856 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 19 10:52:51 2015 us=347376 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 19 10:52:51 2015 us=347796 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 19 10:52:51 2015 us=348236 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 19 10:52:51 2015 us=349556 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jul 19 10:52:51 2015 us=350156 [server] Peer Connection Initiated with [AF_INET]192.168.1.21:1190
Sun Jul 19 10:52:53 2015 us=299756 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Jul 19 10:52:53 2015 us=330656 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.111.1,dhcp-option DNS 8.8.8.8,route-gateway 192.168.111.1,ping 10,ping-restart 120,ifconfig 192.168.111.200 255.255.255.0'
Sun Jul 19 10:52:53 2015 us=331856 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jul 19 10:52:53 2015 us=332256 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jul 19 10:52:53 2015 us=332576 OPTIONS IMPORT: route options modified
Sun Jul 19 10:52:53 2015 us=332896 OPTIONS IMPORT: route-related options modified
Sun Jul 19 10:52:53 2015 us=333196 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jul 19 10:52:53 2015 us=333536 Preserving previous TUN/TAP instance: tap0
Sun Jul 19 10:52:53 2015 us=333876 Initialization Sequence Completed

TM-02 OpenVPN TAP Client

config openvpn 'TAP' 
	option client '1' 
	option dev 'tap0' 
	option proto 'udp' 
	option resolv_retry 'infinite' 
	option nobind '1' 
	option persist_key '1' 
	option persist_tun '1' 
	option ca '/etc/openvpn/ca.crt' 
	option cert '/etc/openvpn/client3.crt' 
	option key '/etc/openvpn/client3.key' 
	option ns_cert_type 'server' 
	option comp_lzo 'yes' 
	option cipher 'aes-128-cbc' 
	option rcvbuf '393216' 
	option sndbuf '393216' 
	option tun_mtu '13000' 
	option fragment '1300' 
	option port '1190' 
	option mssfix '0' 
	option verb '4' 
	option remote '192.168.1.21 1190' 
	option enabled '1' 
    option log '/tmp/openvpn.log' 
    option status '/tmp/openvpn-status.log'

Windows OpenVPN TAP Client

remote 192.168.1.21 1190
client
tls-client
dev tap0
proto udp
remote-cert-tls server
resolv-retry infinite
nobind
persist-tun
persist-key
ca ca.crt 
cert client3.crt 
key client3.key 
ns-cert-type server
comp-lzo yes
cipher aes-128-cbc
verb 5

rcvbuf 393216
sndbuf 393216
tun-mtu 13000
fragment 1300
mssfix

OpenVPN Server Log file - verb 4

Sun Jul 19 11:24:28 2015 us=577438 OpenVPN 2.3.6 i486-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jun  3 2015
Sun Jul 19 11:24:28 2015 us=577438 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.08
Sun Jul 19 11:24:28 2015 us=577438 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Sun Jul 19 11:24:28 2015 us=590856 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Jul 19 11:24:28 2015 us=704304 Initializing OpenSSL support for engine 'cryptodev'
Sun Jul 19 11:24:29 2015 us=426475 Diffie-Hellman initialized with 1024 bit key
Sun Jul 19 11:24:29 2015 us=489333 WARNING: file '/etc/openvpn/server.key' is group or others accessible
Sun Jul 19 11:24:29 2015 us=489333 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 13000)
Sun Jul 19 11:24:29 2015 us=489333 TLS-Auth MTU parms [ L:13090 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 19 11:24:29 2015 us=489333 Socket Buffers: R=[163840->327680] S=[163840->327680]
Sun Jul 19 11:24:29 2015 us=539876 TUN/TAP device tap0 opened
Sun Jul 19 11:24:29 2015 us=540054 TUN/TAP TX queue length set to 100
Sun Jul 19 11:24:29 2015 us=540406 Data Channel MTU parms [ L:13090 D:13090 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Jul 19 11:24:29 2015 us=540529 UDPv4 link local (bound): [undef]
Sun Jul 19 11:24:29 2015 us=540641 UDPv4 link remote: [undef]
Sun Jul 19 11:24:29 2015 us=540755 MULTI: multi_init called, r=256 v=256
Sun Jul 19 11:24:29 2015 us=540755 IFCONFIG POOL: base=192.168.111.200 size=6, ipv6=0
Sun Jul 19 11:24:29 2015 us=540755 IFCONFIG POOL LIST
Sun Jul 19 11:24:29 2015 us=540755 Initialization Sequence Completed
Sun Jul 19 11:25:54 2015 us=880016 MULTI: multi_create_instance called
Sun Jul 19 11:25:54 2015 us=880016 192.168.1.16:45297 Re-using SSL/TLS context
Sun Jul 19 11:25:54 2015 us=880016 192.168.1.16:45297 LZO compression initialized
Sun Jul 19 11:25:54 2015 us=880016 192.168.1.16:45297 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 13000)
Sun Jul 19 11:25:54 2015 us=880016 192.168.1.16:45297 Control Channel MTU parms [ L:13094 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 19 11:25:54 2015 us=880016 192.168.1.16:45297 Data Channel MTU parms [ L:13094 D:13094 EF:62 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Jul 19 11:25:54 2015 us=880016 192.168.1.16:45297 Fragmentation MTU parms [ L:13094 D:1300 EF:61 EB:135 ET:33 EL:0 AF:3/1 ]
Sun Jul 19 11:25:54 2015 us=880016 192.168.1.16:45297 TLS: Initial packet from [AF_INET]192.168.1.16:45297, sid=3f4615b6 e1db6ad1
Sun Jul 19 11:25:55 2015 us=542203 192.168.1.16:45297 VERIFY OK: depth=1, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=BlackBox1, name=Name_Var, emailAddress=[email removed}
Sun Jul 19 11:25:55 2015 us=546341 192.168.1.16:45297 VERIFY OK: depth=0, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=client3, name=Name_Var, emailAddress=[email removed]
Sun Jul 19 11:26:00 2015 us=292560 192.168.1.16:45297 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 19 11:26:00 2015 us=292560 192.168.1.16:45297 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 19 11:26:00 2015 us=292560 192.168.1.16:45297 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 19 11:26:00 2015 us=292560 192.168.1.16:45297 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 19 11:26:00 2015 us=302338 192.168.1.16:45297 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jul 19 11:26:00 2015 us=302338 192.168.1.16:45297 [client3] Peer Connection Initiated with [AF_INET]192.168.1.16:45297
Sun Jul 19 11:26:00 2015 us=302338 client3/192.168.1.16:45297 MULTI_sva: pool returned IPv4=192.168.111.200, IPv6=(Not enabled)
Sun Jul 19 11:26:02 2015 us=755436 client3/192.168.1.16:45297 PUSH: Received control message: 'PUSH_REQUEST'
Sun Jul 19 11:26:02 2015 us=755597 client3/192.168.1.16:45297 send_push_reply(): safe_cap=940
Sun Jul 19 11:26:02 2015 us=756355 client3/192.168.1.16:45297 SENT CONTROL [client3]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.111.1,dhcp-option DNS 8.8.8.8,route-gateway 192.168.111.1,ping 10,ping-restart 120,ifconfig 192.168.111.200 255.255.255.0' (status=1)
Sun Jul 19 11:26:12 2015 us=719748 client3/192.168.1.16:45297 MULTI: Learn: [mac removed] -> client3/192.168.1.16:45297

OpenVPN Server Config

config openvpn 'TAP'
	option _description 'Frog is Wrong'
	option _role 'server'
	option enabled '1'
	option port '1190'
	option proto 'udp'
	option dev 'tap0'
	option ca '/etc/openvpn/ca.crt'
	option cert '/etc/openvpn/server.crt'
	option key '/etc/openvpn/server.key'
	option dh '/etc/openvpn/dh1024.pem'
	option ifconfig_pool_persist '/tmp/ipp-tap0.txt'
	option status '/tmp/openvpn-status-tap0.log'
	option log '/tmp/openvpn-log-tap0.log'
	option keepalive '10 120'
	option persist_key '1'
	option persist_tun '1'
	option cipher 'aes-128-cbc'
	option engine 'cryptodev'
	option comp_lzo 'yes'
	option verb '4'
	option server_bridge '192.168.111.1 255.255.255.0 192.168.111.200 192.168.111.205'
	list push 'redirect-gateway def1'
	list push 'dhcp-option DNS 192.168.111.1'
	list push 'dhcp-option DNS 8.8.8.8'
	option tun_mtu '13000'
	option fragment '1300' 
	option sndbuf '393216'
	option rcvbuf '393216'
	option mssfix '0'

HooToo Network Config

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd72:60b8:a28e::/48'

config interface 'lan'
	option force_link '1'
	option macaddr '[mac removed]'
	option type 'bridge'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option _orig_ifname 'eth0.1 wlan0 wlan1'
	option _orig_bridge 'true'
	option ifname 'eth0.1'
	option ipaddr '192.168.2.1'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '4 6t'

config interface 'OpenVPN'
	option proto 'none'
	option _orig_ifname 'tap0'
	option _orig_bridge 'false'
	option ifname 'tap0'

config interface 'wwan'
	option proto 'dhcp'

I added the OpenVPN interface, believing this to be the equivalent of the Windows Virtual TAP Adapter.

TM-02 Firewall Config

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan'
	option masq '1'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan wan6 wwan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fe80::/10'
	option src_port '547'
	option dest_ip 'fe80::/10'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option name 'VPN'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'
	option network 'OpenVPN'

config forwarding
	option dest 'wan'
	option src 'lan'

config forwarding
	option dest 'lan'
	option src 'VPN'

config forwarding
	option dest 'VPN'
	option src 'lan'

config forwarding
	option dest 'wan'
	option src 'vpn'

I do not recall the source for adding the last entry, but it made sense as I did not see how the VPN traffic would ever see the outbound wireless connection. I added MASQ to the LAN zone or I did not have Internet.

I shut down the TM-02 Client OpenVPN and recived the following in the log. IP address 192.168.1.21 is the WAN side of the OpenVPN Server's Router

Sun Jul 19 11:59:59 2015 us=516819 event_wait : Interrupted system call (code=4)
Sun Jul 19 11:59:59 2015 us=526799 TCP/UDP: Closing socket
Sun Jul 19 11:59:59 2015 us=527739 /sbin/route del -net 192.168.1.21 netmask 255.255.255.255
route: SIOCDELRT: No such process
Sun Jul 19 11:59:59 2015 us=702118 [b]ERROR: Linux route delete command failed: external program exited with error status: 1[/b]
Sun Jul 19 11:59:59 2015 us=702838 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
Sun Jul 19 11:59:59 2015 us=715057 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
Sun Jul 19 11:59:59 2015 us=729317 Closing TUN/TAP interface
Sun Jul 19 11:59:59 2015 us=729917 /sbin/ifconfig tap0 0.0.0.0
Sun Jul 19 11:59:59 2015 us=752957 SIGTERM[hard,] received, process exiting

It is probably worth noting that I have a test network behind my "Primary" router with the following network config:

                   192.168.21.1       192.168.1.1        192.168.1.16
192.168.111.79     192.168.111.1                         192.168.2.1                       192.168.2.134
Server Side PC <=> OpenVPN Server <=> Primary Router <=> HooToo Router/OpenVPN Client <=> Client PC2

I can successfully navigate with Windows Network Neighborhood with Client PC2 on the 192.168.1.1 subnet or through the HooToo on the 192.168.2.1 subnet with the OpenWRT OpenVPN Client disabled and the PC running it's own OpenVPN Client (included above) .

I also have static assigned IP addresses for all of the devices that are trying to connect. They still seem to get assigned an IP in the 192.168.111.200 - 205 range, which is fine.

I am running OpenWRT CC 15.05 RC2 which looks like 2.3.6-4. and 2.3.6 on the PC.

l also see in the Server system logs the following:

Reloading firewall due to ifup of OpenVPN (tap0)

Traffic

RangerZ wroteI am more concerned for this post of validating my approach to things

Does your OpenVPN work ?

RangerZ wrotehave included files for my TAP config issue if someone can spot the problem.

what is the the problem ?

RangerZ

The OpenVPN connects to the server and can access the internet. I can not access the LAN resources.

Thanks.. RangerZ

Traffic

RangerZ wrote I can not access the LAN resources

If you are trying to browse network neighborhood then you need to use --dev tap and --server-bridge because Windows requires Broadcast packets.

Otherwise, simply connect like so:

net use z: //windows.pc.ip.add/share_name

which does not require broadcasts and can be used over --dev tun and --server

Please see this HOWTO for details how to expose your server/client LANs to the VPN:
HOWTO: Expanding the scope of the VPN to include additional machines

RangerZ

Thank you

I do have --dev tap and -- server bridge in the OpenVPN server config. The logs appear to be assigning out the IP correctly.

I also have --dev tap in the OpenVPN client. I am not clear on the need/use of a --server-bridge element on the client side.

Much of the content in the content in the link is related to TUN. It says TAP should basically just work.

I have too many resources on the Server side to want to specify paths with net use, but I may try to see if I can at least connect to something.

Traffic

As this is OpenWRT not OpenVPN ...

A basic test would be to determine if you see broadcast packets on your server LAN from a VPN client.

RangerZ

I am showing my lack of skill, but how do I do that?

What do I run from the command prompt or which log will have this info?

Thanks... RangerZ

Traffic

How about firewall logs and a packet sniffer.

RangerZ

Again, my skills are at least in part an issue. OpenWRT, as best I can tell, does not have firewall logs, at least with out the addition of some packages. It will take me some time to figure out what and how to configure these. Packet sniffers are something that I would need to learn about.

That said I am trying to understand a basic issue here. I thought with basic TAP that I would be directing my LAN traffic through the tunnel and that Internet traffic would go direct, unless the "redirect gateway def1" is used, which I have.

My issue is the reverse. Internet traffic is going, but LAN is not. And again to be clear, if I run the same basic config directly off my laptop, there is no issue.

Thus, I am assuming (maybe you are not) that my issue is on the client.

Looking at my logs today (after some tinkering) I see that I have some routing data that I am not understanding. While no expert, I do not understand how the LAN traffic is going anywhere or where the 128.0.0.0 came from.

OpenVPN Client Logs

Sun Jul 26 08:16:36 2015 us=331600 OpenVPN 2.3.6 mipsel-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jun 18 2015
Sun Jul 26 08:16:36 2015 us=332280 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.08
Sun Jul 26 08:16:36 2015 us=717880 WARNING: file '/etc/openvpn/client3.key' is group or others accessible
Sun Jul 26 08:16:36 2015 us=725460 LZO compression initialized
Sun Jul 26 08:16:36 2015 us=725920 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 13000)
Sun Jul 26 08:16:36 2015 us=731560 Control Channel MTU parms [ L:13094 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 26 08:16:36 2015 us=738180 Socket Buffers: R=[163840->327680] S=[163840->327680]
Sun Jul 26 08:16:36 2015 us=738760 Data Channel MTU parms [ L:13094 D:13094 EF:62 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Jul 26 08:16:36 2015 us=739180 Fragmentation MTU parms [ L:13094 D:1300 EF:61 EB:135 ET:33 EL:0 AF:3/1 ]
Sun Jul 26 08:16:36 2015 us=739560 UDPv4 link local: [undef]
Sun Jul 26 08:16:36 2015 us=740000 UDPv4 link remote: [AF_INET]192.168.1.21:1190
Sun Jul 26 08:16:36 2015 us=745580 TLS: Initial packet from [AF_INET]192.168.1.21:1190, sid=cc11de1e fe96cc52
Sun Jul 26 08:16:37 2015 us=17020 VERIFY OK: depth=1, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=BlackBox1, name=Name_Var, emailAddress=steven@zallen.com
Sun Jul 26 08:16:37 2015 us=22200 VERIFY OK: nsCertType=SERVER
Sun Jul 26 08:16:37 2015 us=22740 Validating certificate key usage
Sun Jul 26 08:16:37 2015 us=23120 ++ Certificate has key usage  00a0, expects 00a0
Sun Jul 26 08:16:37 2015 us=23480 VERIFY KU OK
Sun Jul 26 08:16:37 2015 us=23920 Validating certificate extended key usage
Sun Jul 26 08:16:37 2015 us=24620 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sun Jul 26 08:16:37 2015 us=25020 VERIFY EKU OK
Sun Jul 26 08:16:37 2015 us=25380 VERIFY OK: depth=0, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=server, name=Name_Var, emailAddress=steven@zallen.com
Sun Jul 26 08:16:37 2015 us=555620 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 26 08:16:37 2015 us=556160 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 26 08:16:37 2015 us=556580 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 26 08:16:37 2015 us=557040 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 26 08:16:37 2015 us=558420 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jul 26 08:16:37 2015 us=559020 [server] Peer Connection Initiated with [AF_INET]192.168.1.21:1190
Sun Jul 26 08:16:39 2015 us=758780 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Jul 26 08:16:39 2015 us=767620 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.111.1,dhcp-option DNS 8.8.8.8,route-gateway 192.168.111.1,ping 10,ping-restart 120,ifconfig 192.168.111.200 255.255.255.0'
Sun Jul 26 08:16:39 2015 us=768900 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jul 26 08:16:39 2015 us=769560 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jul 26 08:16:39 2015 us=769920 OPTIONS IMPORT: route options modified
Sun Jul 26 08:16:39 2015 us=770220 OPTIONS IMPORT: route-related options modified
Sun Jul 26 08:16:39 2015 us=770540 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jul 26 08:16:39 2015 us=786100 TUN/TAP device tap0 opened
Sun Jul 26 08:16:39 2015 us=786600 TUN/TAP TX queue length set to 100
Sun Jul 26 08:16:39 2015 us=787060 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Jul 26 08:16:39 2015 us=787640 /sbin/ifconfig tap0 192.168.111.200 netmask 255.255.255.0 mtu 13000 broadcast 192.168.111.255
Sun Jul 26 08:16:39 2015 us=997480 /sbin/route add -net 192.168.1.21 netmask 255.255.255.255 dev wlan0
Sun Jul 26 08:16:40 2015 us=297080 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 192.168.111.1
Sun Jul 26 08:16:40 2015 us=320900 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 192.168.111.1
Sun Jul 26 08:16:40 2015 us=354820 Initialization Sequence Completed

Open VPN Client Traffic Stats

OpenVPN STATISTICS
Updated,Sun Jul 26 08:37:57 2015
TUN/TAP read bytes,6964899
TUN/TAP write bytes,12465617
TCP/UDP read bytes,1563985
TCP/UDP write bytes,7735622
Auth read bytes,12465809
pre-compress bytes,6629676
post-compress bytes,6672688
pre-decompress bytes,782426
post-decompress bytes,12288324
END

OpenWRT Client ARP Table

IPv4-Address	MAC-Address	Interface
192.168.1.1	          00:1d:73:b4:XX:XX	wlan0
192.168.111.23	     	 00:24:a5:d8:XX:XX	tap0
192.168.2.146	        00:01:6c:cc:XX:XX	br-lan
192.168.2.134	        80:1f:02:e6:XX:XX	br-lan

192.168.111.23 is an AP behind the VPN server off which there is a Client I am trying to access.

OpenWRT Client Active IPv4-Routes Table

Network	Target	IPv4-Gateway	Metric	Table
OpenVPN	 0.0.0.0/1	        192.168.111.1	0	main
wwan	 	 0.0.0.0/0	        192.168.1.1	0	main
OpenVPN	128.0.0.0/1		 192.168.111.1	0	main
wwan		 192.168.1.0/24        		0	main
wwan		 192.168.1.1		 	        0	main
wwan		 192.168.1.21	 	 		0	main
lan		192.168.2.0/24				 0	main
OpenVPN	192.168.111.0/24		 		 0	main

OpenWRT Client Active IPv6-Routes

Network	Target	Source	Metric	Table
lan		 	 fd72:60b8:a28e::/64		1024	main
wwan		 ff02::1:2		0	local
wwan		 ff02::1:3		0	local
(eth0)		 ff00::/8		256	local
lan		 	 ff00::/8		256	local
wwan		 ff00::/8		256	local
lan		 	 ff00::/8		256	local
OpenVPN		 ff00::/8		256	local

OpenVPN Server Log

Sun Jul 26 11:45:59 2015 daemon.notice openvpn(TAP)[1528]: MULTI: multi_create_instance called
Sun Jul 26 11:45:59 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Re-using SSL/TLS context
Sun Jul 26 11:45:59 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 LZO compression initialized
Sun Jul 26 11:45:59 2015 daemon.warn openvpn(TAP)[1528]: 192.168.1.16:45166 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 13000)
Sun Jul 26 11:45:59 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Control Channel MTU parms [ L:13094 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 26 11:45:59 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Data Channel MTU parms [ L:13094 D:13094 EF:62 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Jul 26 11:45:59 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Fragmentation MTU parms [ L:13094 D:1300 EF:61 EB:135 ET:33 EL:0 AF:3/1 ]
Sun Jul 26 11:45:59 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 TLS: Initial packet from [AF_INET]192.168.1.16:45166, sid=dfce6be0 c3f71f7e
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 VERIFY OK: depth=1, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=BlackBox1, name=Name_Var, emailAddress=[removed]
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 VERIFY OK: depth=0, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=client3, name=Name_Var, emailAddress=[removed]
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: 192.168.1.16:45166 [client3] Peer Connection Initiated with [AF_INET]192.168.1.16:45166
Sun Jul 26 11:46:01 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 MULTI_sva: pool returned IPv4=192.168.111.200, IPv6=(Not enabled)
Sun Jul 26 11:46:03 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 PUSH: Received control message: 'PUSH_REQUEST'
Sun Jul 26 11:46:03 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 send_push_reply(): safe_cap=940
Sun Jul 26 11:46:03 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 SENT CONTROL [client3]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.111.1,dhcp-option DNS 8.8.8.8,route-gateway 192.168.111.1,ping 10,ping-restart 120,ifconfig 192.168.111.200 255.255.255.0' (status=1)
Sun Jul 26 11:46:30 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 MULTI: Learn: 62:51:26:62:6f:41 -> client3/192.168.1.16:45166
Sun Jul 26 12:11:23 2015 daemon.info dnsmasq-dhcp[2505]: DHCPINFORM(br-lan) 192.168.111.74 00:11:25:15:b1:9e 
Sun Jul 26 12:11:23 2015 daemon.info dnsmasq-dhcp[2505]: DHCPACK(br-lan) 192.168.111.74 00:11:25:15:b1:9e T43_2687H
Sun Jul 26 12:40:46 2015 daemon.info dnsmasq-dhcp[2505]: DHCPINFORM(br-lan) 192.168.111.74 00:11:25:15:b1:9e 
Sun Jul 26 12:40:46 2015 daemon.info dnsmasq-dhcp[2505]: DHCPACK(br-lan) 192.168.111.74 00:11:25:15:b1:9e T43_2687H
Sun Jul 26 12:46:05 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 VERIFY OK: depth=1, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=BlackBox1, name=Name_Var, emailAddress=[removed]
Sun Jul 26 12:46:05 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 VERIFY OK: depth=0, C=US, ST=MA, L=Boston, O=MMandI, OU=OU_var, CN=client3, name=Name_Var, emailAddress=[removed]
Sun Jul 26 12:46:05 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 26 12:46:05 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 26 12:46:05 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jul 26 12:46:05 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 26 12:46:05 2015 daemon.notice openvpn(TAP)[1528]: client3/192.168.1.16:45166 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA

OpenWRT server ARP Table
I

Pv4-Address	MAC-Address	Interface
192.168.1.1	00:1d:73:b4:XX:XX	eth1
192.168.1.16	00:1c:c2:15:XX:XX	eth1
192.168.1.80	00:1b:78:70:XX:XX	eth1
192.168.111.200	62:51:26:62:XX:XX	br-lan
192.168.111.74	00:11:25:15:XX:XX	br-lan
192.168.111.23	00:24:a5:d8:XX:XX	br-lan

OpenWRT Server Active IPv4-Routes Table

Network	Target	IPv4-Gateway	Metric	Table
wan	0.0.0.0/0		 192.168.1.1	0	main
wan	192.168.1.0/24	 		0	main
wan	192.168.1.1		 	 	0	main
lan	192.168.111.0/24	 		0	main
lan	192.168.111.1		 	 192.168.111.1	1	main
tun0	192.168.112.0/24	 	 	192.168.112.2	0	main
tun0	192.168.112.2			 	 0	main

OpenWRT Server Active IPv6-Routes

Network	Target	Source	Metric	Table
lan	fd62:858f:22ee::/64		1024	main
lan	ff00::/8			 	 256	local
wan	ff00::/8			 	 256	local

Maybe related, I noticed in another post you identified that there was an issue with OpenWRT CC versions, I believe related to OpenSSL under TUN. Is this of concern, as I am running OpenWRT CC RC3, and was on RC2 when I started the post (broke the box, so I upgraded)?

Could having IPV6 active be mucking up the works?

Thanks again

Traffic

Traffic wroteAs this is OpenWRT not OpenVPN ...

Did you see this:
http://wiki.openwrt.org/doc/howto/vpn.server.openvpn.tap

Some things to note:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

That probably causes you problems.

Also understand: Your server bridge needs to be the same network as you real LAN not a virtual LAN ..
IE: Your real LAN is 192.168.1.0/24 then so is your server bridge not 192.168.111.0/24 as you have configured.

So I recommend you change your entire server side network number from 192.168.1.0/24 to something more unique .. eg: 192.168.147.0/24

RangerZ

I am very familiar with the post. It unfortunately does not offer any config for an OpenWRT client or device. The windows client, as I indicated, works fine on this config.

The actual goal of the project is to move to a new infrastructure which includes the 3 devices below. I have a router and AP that will exist at home on the left (AP not included) and a travel router on the right.

                   192.168.21.1       192.168.1.1        192.168.1.16
192.168.111.79     192.168.111.1                         192.168.2.1                       192.168.2.134
Server Side PC <=> OpenVPN Server <=> Primary Router <=> HooToo Router/OpenVPN Client <=> Client PC2

The subnet of 192.168.111.1, which is that of the VPN server, is currently setup behind my "production" LAN. Indeed, I am assuming, maybe incorrectly, that my production LAN IS the internet for testing.

I am trying to bench test the config. It is the only practical way I have been able to think of to test the infrastructure inside my home. 192.168.21 and 192.168.1.16 are the WAN addresses assigned by DHCP of the Server and Client respectively. I can make the travel router any subnet including the 192.168.111.x though I did not think that would be good if I want it to just be a router.

As I write this I realize that I have not put any consideration to how the 192.168.1.1 device is configured. It is DD-WRT and I know it has VPN pass through enabled, but not sure this is sufficient.

Is this a valid test environment, if not how can I build one inside my 4 walls?

I appreciate your help and patience!

Traffic

If you enable a custom config in the OpenWRT uci for openvpn you can create a normal openvpn config file and run that .. which means you can use the example openvpn configs and more or less all the standard openvpn config directives and so bypass the OpenWRT uci method.

BTW:

RangerZ wroteI see that I have some routing data that I am not understanding. While no expert, I do not understand how the LAN traffic is going anywhere or where the 128.0.0.0 came from.

That is set by --redirect-gateway def1 option. (Route: 0.0.0.0/1 and 128.0.0.0/1)
See --redirect-gateway in The Manual v23x

RangerZ

I'm not sure I fully understand your comments on uci, but I do not use it. I connect with WinSCP and use the text editor to modify the openvpn files. Occasionally I will use the LuCi interface if I am not clear on the format of a variable. If I need I can execute commands at the prompt via putty. Not sure if this makes a difference.

I am working through the sample config and creating both a new basic server and client on a different port. I am trying to understand the comments, so I am not moving to fast.

I did learn today that if I enter the IP address in the address bar that I can get to the shared folders behind the server. Not sure what this tells us.