Hi,
I have a WiFi router with a 3G modem (Huawei MU609) running OpenWrt trunk (DD). The mobile connection is scheduled to turn on and off only at certain times during the day (it's off at boot) and works flawlessly.
I'd like the router to work as an OpenVPN client (tunnelling all LAN / WiFi connected clients). This is all setup and works when the WAN connection is ethernet (device also has an ethernet port). The issue is that this doesn't work when using the 3G connection. It seems like the VPN connects when the 3G interface comes up, but none of the clients behind the router can access the internet. I suspect it is one of the routes added by the VPN connection coming up *after* the 3G connection that is causing the issue - or the firewall.
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd36:3ab3:412c::/48'
config interface 'lan'
option ifname 'eth0.1'
option force_link '1'
option macaddr '78:a3:51:08:e0:a0'
option type 'bridge'
option proto 'static'
option ipaddr '10.0.1.1'
option netmask '255.255.255.0'
config interface 'wan'
option ifname 'eth0.2'
option force_link '1'
option macaddr '78:a3:51:08:e0:a1'
option proto 'dhcp'
config switch
option name 'switch0'
option reset '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 5 6t'
option vid '1'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
option vid '2'
config interface 'mobile'
option proto '3g'
option ipv6 'auto'
option device '/dev/ttyUSB0'
option auto '0'
option username 'web'
option password 'web'
option apn 'pp.vodafone.co.uk'
option maxwait '30'
option service 'umts'
config interface 'vpn'
option ifname 'tun0'
option proto 'none'
option auto '1'
/etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
option masq '1'
option mtu_fix '1'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'
option network 'wan'
option forward 'ACCEPT'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'newzone'
option input 'ACCEPT'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'
option forward 'REJECT'
option network 'mobile'
config forwarding
option dest 'wan'
option src 'lan'
config zone
option name 'VPN'
option masq '1'
option mtu_fix '1'
option network 'vpn'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config forwarding
option dest 'newzone'
option src 'lan'
config forwarding
option dest 'newzone'
option src 'VPN'
route *after* 3G connects and VPN interface is brought up (no client access):
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
default 10.64.64.64 0.0.0.0 UG 0 0 0 3g-mobile
10.0.1.0 * 255.255.255.0 U 0 0 0 br-lan
10.8.0.0 10.8.0.1 255.255.255.0 UG 0 0 0 tun0
10.8.0.1 * 255.255.255.255 UH 0 0 0 tun0
10.64.64.64 * 255.255.255.255 UH 0 0 0 3g-mobile
128.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0
178.62.34.228 10.64.64.64 255.255.255.255 UGH 0 0 0 3g-mobile
VPN does connect successfully as shown in logs:
Wed Nov 11 15:53:37 2015 user.notice firewall: Reloading firewall due to ifup of mobile (3g-mobile)
Wed Nov 11 15:53:37 2015 daemon.notice openvpn(oneclass-dev)[2296]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Wed Nov 11 15:53:37 2015 daemon.notice openvpn(oneclass-dev)[2296]: UDPv4 link local: [undef]
Wed Nov 11 15:53:37 2015 daemon.notice openvpn(oneclass-dev)[2296]: UDPv4 link remote: [AF_INET]178.62.34.228:1194
Wed Nov 11 15:53:38 2015 daemon.notice openvpn(oneclass-dev)[2296]: TLS: Initial packet from [AF_INET]178.62.34.228:1194, sid=1c791093 12513747
Wed Nov 11 15:53:38 2015 daemon.notice openvpn(oneclass-dev)[2296]: VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Wed Nov 11 15:53:38 2015 daemon.notice openvpn(oneclass-dev)[2296]: VERIFY OK: nsCertType=SERVER
Wed Nov 11 15:53:38 2015 daemon.notice openvpn(oneclass-dev)[2296]: VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=me@myhost.mydomain
Wed Nov 11 15:53:41 2015 daemon.notice openvpn(oneclass-dev)[2296]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 11 15:53:41 2015 daemon.notice openvpn(oneclass-dev)[2296]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 11 15:53:41 2015 daemon.notice openvpn(oneclass-dev)[2296]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 11 15:53:41 2015 daemon.notice openvpn(oneclass-dev)[2296]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 11 15:53:41 2015 daemon.notice openvpn(oneclass-dev)[2296]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Nov 11 15:53:41 2015 daemon.notice openvpn(oneclass-dev)[2296]: [server] Peer Connection Initiated with [AF_INET]178.62.34.228:1194
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology p2p,ping 10,ping-restart 120,ifconfig 10.8.0.4 10.8.0.1'
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: OPTIONS IMPORT: timers and/or timeouts modified
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: OPTIONS IMPORT: --ifconfig/up options modified
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: OPTIONS IMPORT: route options modified
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: TUN/TAP device tun0 opened
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: TUN/TAP TX queue length set to 100
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: /sbin/ifconfig tun0 10.8.0.4 pointopoint 10.8.0.1 mtu 1500
Wed Nov 11 15:53:43 2015 daemon.notice netifd: Interface 'vpn' is enabled
Wed Nov 11 15:53:43 2015 daemon.notice netifd: Network device 'tun0' link is up
Wed Nov 11 15:53:43 2015 daemon.notice netifd: Interface 'vpn' has link connectivity
Wed Nov 11 15:53:43 2015 daemon.notice netifd: Interface 'vpn' is setting up now
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: /sbin/route add -net 178.62.34.228 netmask 255.255.255.255 gw 10.64.64.64
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
Wed Nov 11 15:53:43 2015 daemon.notice netifd: Interface 'vpn' is now up
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.1
Wed Nov 11 15:53:43 2015 daemon.notice openvpn(oneclass-dev)[2296]: Initialization Sequence Completed
Wed Nov 11 15:53:44 2015 user.notice firewall: Reloading firewall due to ifup of vpn (tun0)
If I try turning off VPN, clients can access then internet:
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.64.64.64 0.0.0.0 UG 0 0 0 3g-mobile
10.0.1.0 * 255.255.255.0 U 0 0 0 br-lan
10.64.64.64 * 255.255.255.255 UH 0 0 0 3g-mobile
178.62.34.228 10.64.64.64 255.255.255.255 UGH 0 0 0 3g-mobile
Any ideas to get traffic using the VPN?
I originally asked on the OpenWrt forums, but figured this would be a better place!
