Asus RT-66U OpenVPN Routing all Internet Traffic across TUN

EgoProwler

Stumped on this one. I'm having a hell of a time getting ALL internet traffic to route across a TUN connection. I've looked through a bunch of similar issues here, but have not found any fix that works for my situation.

Asus RT-66U @ v3.0.0.4.378_9313
Interface Type = TUN
Direct clients to redirect Internet traffic = YES
Respond to DNS = NO
NO CUSTOM CONFIGURATIONS ON SERVER

The one thing I found odd is that there are TWO route statements getting pushed by the OpenVPN server, which makes me think that traffic destined for the Internet across the tunnel is getting black holed.

Any assistance/guidance would be appreciated. Thanks in advance!!

0 [route] [10.33.0.0] [255.255.255.0]
1 [dhcp-option] [DNS] [10.33.0.1]
2 [redirect-gateway] [def1]
3 [route] [10.7.0.1]
4 [topology] [net30]
5 [ping] [15]
6 [ping-restart] [60]
7 [ifconfig] [10.7.0.6] [10.7.0.5]

2015-12-26 11:37:41 LZO-ASYM init swap=0 asym=0
2015-12-26 11:37:41 EVENT: ASSIGN_IP
2015-12-26 11:37:41 Connected via tun
2015-12-26 11:37:41 EVENT: CONNECTED REDACTED:1194 (REDACTED) via /UDPv4 on tun/10.7.0.10/
2015-12-26 11:37:41 SetStatus Connected
2015-12-26 11:43:10 OS Event: SLEEP
2015-12-26 11:43:10 TUN reassert
2015-12-26 11:43:10 TUN reset routes
2015-12-26 11:43:10 EVENT: PAUSE
2015-12-26 11:44:52 OS Event: WAKEUP
2015-12-26 11:44:55 RESUME TEST: Internet:ReachableViaWWAN/WR t------ WiFi:NotReachable/WR t------
2015-12-26 11:44:55 EVENT: RESUME
2015-12-26 11:44:55 EVENT: RECONNECTING
2015-12-26 11:44:55 LZO-ASYM init swap=0 asym=0
2015-12-26 11:44:55 Contacting REDACTED:1194 via UDP
2015-12-26 11:44:55 EVENT: WAIT
2015-12-26 11:44:55 SetTunnelSocket returned 1
2015-12-26 11:44:55 Connecting to REDACTED:1194 (REDACTED) via UDPv4
2015-12-26 11:44:55 EVENT: CONNECTING
2015-12-26 11:44:55 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client
2015-12-26 11:44:55 Creds: Username/Password
2015-12-26 11:44:55 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 1.0.5-177
IV_VER=3.0
IV_PLAT=ios
IV_NCP=1
IV_LZO=1

2015-12-26 11:44:57 VERIFY OK: depth=1
cert. version    : 3
serial number    : C8:8A:CF:E3:7E:B8:33:46
issuer name      : C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC66U, emailAddress=me@myhost.mydomain
subject name      : C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC66U, emailAddress=me@myhost.mydomain
issued  on        : 2015-08-14 01:52:30
expires on        : 2025-08-11 01:52:30
signed using      : RSA with SHA1
RSA key size      : 1024 bits
basic constraints : CA=true

2015-12-26 11:44:57 VERIFY OK: depth=0
cert. version    : 3
serial number    : 01
issuer name      : C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC66U, emailAddress=me@myhost.mydomain
subject name      : C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC66U, emailAddress=me@myhost.mydomain
issued  on        : 2015-08-14 01:52:31
expires on        : 2025-08-11 01:52:31
signed using      : RSA with SHA1
RSA key size      : 1024 bits
basic constraints : CA=false
cert. type        : SSL Server
key usage        : Digital Signature, Key Encipherment
ext key usage    : TLS Web Server Authentication

2015-12-26 11:44:58 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2015-12-26 11:44:58 Session is ACTIVE
2015-12-26 11:44:58 EVENT: GET_CONFIG
2015-12-26 11:44:58 Sending PUSH_REQUEST to server...
2015-12-26 11:44:59 OPTIONS:
0 [route] [10.33.0.0] [255.255.255.0]
1 [dhcp-option] [DNS] [10.33.0.1]
2 [redirect-gateway] [def1]
3 [route] [10.7.0.1]
4 [topology] [net30]
5 [ping] [15]
6 [ping-restart] [60]
7 [ifconfig] [10.7.0.6] [10.7.0.5]

Traffic

As you are pushing DNS:

EgoProwler wrote1 [dhcp-option] [DNS] [10.33.0.1]

You may need to set this to YES:

EgoProwler wroteRespond to DNS = NO

EgoProwler

I actually tried both options; YES and NO. From the logs I provided, I'm actually pushing DNS for that particular test

From log file:
1 [dhcp-option] [DNS] [10.33.0.1]

Incidentally, this particular configuration works on an Asus RT-AC68U, the only difference is it DOES NOT have the multiple route statements. I also happen to be running OpenVPN Server from a QNAP NAS and it works without incident, again, the only difference I'm seeing is the double routes from the Asus RT-AC66U

Asus RT-AC66U
0 [redirect-gateway] [def1]
1 [dhcp-option] [DNS] [10.33.0.1]
2 [route] [10.33.0.0] [255.255.255.0]
3 [route] [10.8.0.1]
4 [topology] [net30]
5 [ping] [15]
6 [ping-restart] [60]
7 [ifconfig] [10.8.0.6] [10.8.0.5]

QNAP NAS w/ OpenVPN
0 [redirect-gateway] [def1]
1 [dhcp-option] [DNS] [10.10.0.1]
2 [route] [10.8.0.0] [255.255.255.0]
3 [topology] [net30]
4 [ping] [10]
5 [ping-restart] [60]
6 [ifconfig] [10.8.0.6] [10.8.0.5]

Traffic

EgoProwler wroteIncidentally, this particular configuration works on an Asus RT-AC68U, the only difference is it DOES NOT have the multiple route statements.

Thus it is not the same configuration ..

What is ip route of the server ?

EgoProwler

Traffic wrote
EgoProwler wroteIncidentally, this particular configuration works on an Asus RT-AC68U, the only difference is it DOES NOT have the multiple route statements.
Thus it is not the same configuration ..

What is ip route of the server ?

I understand what you're saying - they aren't the same configuration because they are on different devices. I was only pointing out that they are virtually the same with the exception of TWO route statements on the 66U, which don't exist in the 68U or OpenVPN Server on a QNAP device.

Below is the ip route of the Asus 66U I'm struggling with.

10.7.0.2 dev tun21  proto kernel  scope link  src 10.7.0.1
10.7.0.0/24 via 10.7.0.2 dev tun21
73.78.72.1 dev eth0  scope link
10.33.0.0/24 dev br0  proto kernel  scope link  src 10.33.0.1
73.78.72.0/23 dev eth0  proto kernel  scope link  src 73.78.72.50
127.0.0.0/8 dev lo  scope link
default via 73.78.72.1 dev eth0

Traffic

EgoProwler wroteBelow is the ip route of the Asus 66U I'm struggling with.

Code:
10.7.0.2 dev tun21 proto kernel scope link src 10.7.0.1
10.7.0.0/24 via 10.7.0.2 dev tun21
73.78.72.1 dev eth0 scope link
10.33.0.0/24 dev br0 proto kernel scope link src 10.33.0.1
73.78.72.0/23 dev eth0 proto kernel scope link src 73.78.72.50
127.0.0.0/8 dev lo scope link
default via 73.78.72.1 dev eth0

EgoProwler wroteI found odd is that there are TWO route statements getting pushed by the OpenVPN server

10.7.0.0/24 is your VPN route. 10.33.0.0/24 is your server LAN route.

Unfortunately, Asus implements bridge in a different way to standard Linux or Windows ..

However, your server is pushing redirect-gateway def1 so this ought to configure your client correctly.

Have you enabled IP_Forward on the server ?