Good afternoon.
I've changed my ISP because the new one offers better speeds. Also I've received a "great" service called "grey" IP, which means I'm behind very strict NAT that doesn't allow my network to be reachable from the Internet.
So, I'm trying to set up a VPN tunnel using a VPS with "white" (static) IPv4-address to bypass my ISP's NAT. I've almost accomplished my goal, but... something went wrong, and I need help, because I'm not really experienced with networks and stuff — something like "advanced amateur", lol.
My home network config:
I have 3 routers which are connected to each other using WAN. I have the following subnets: 192.168.0.1, 192.168.1.1 and 192.168.2.1.
192.168.0.1 is 192.168.1.254 on 192.168.1.1, 192.168.1.1 is 192.168.2.254 on 192.168.2.1. Don't know if this is important.
192.168.2.1 is the router connected to my ISP with internal IP 10.29.3.35 and has an external IP 46.53.211.219.
192.168.0.1 — TP-Link TL-WR1043ND with stock FW, 192.168.1.1 — same router with OpenWRT, 192.168.2.1 — TP-Link TL-WR720N with stock firmware (no OpenWRT for this one, unfortunately).
OpenVPN is installed on my VPS (78.47.xxx.xxx) and on my OpenWRT router.
Server-side config:
#tun0.conf
#Main settings
port 1194
proto udp
dev tun
#Network settings
server 10.8.0.0 255.255.255.0
route 192.168.1.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
#Keys
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
#Logging
status openvpn-status.log
log /var/log/openvpn.log
verb 3
Server-side netstat -rn
root@Debian-82-jessie-64-LAMP ~ # netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 172.31.1.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
172.31.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.1.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
Client-side config:
#client.conf
client
dev tun
proto udp
remote 78.47.xxx.xxx 1194
resolv-retry infinite
ifconfig 10.8.0.6 10.8.0.1
nobind
persist-key
persist-tun
ca ca.crt
cert user.crt
key user.key
keepalive 60 180
ns-cert-type server
comp-lzo
log /var/log/openvpn.log
verb 3
My Android phone successfully connects to my server with this config and receives server's external IP-address. My router connects successfully to the server... but I get no Internet connection from any device that is connected to my router. Amazing is that the router itself has Internet connection and traceroute to Google hops from 10.8.0.1 to Google's IP address. opkg update also works flawlessly:
root@TPLinkTLWR1043ND2:~# traceroute google.com
traceroute to google.com (173.194.112.34), 30 hops max, 38 byte packets
1 10.8.0.1 (10.8.0.1) 50.181 ms 34.705 ms 34.750 ms
2 172.31.1.1 (172.31.1.1) 36.326 ms 35.973 ms 38.364 ms
3 cnode11.6.cpool.your-server.de (136.243.180.204) 36.018 ms 35.009 ms 36.325 ms
4 static.193.180.243.136.clients.your-server.de (136.243.180.193) 48.858 ms 36.379 ms 36.427 ms
5 core23.hetzner.de (213.239.203.229) 36.117 ms core24.hetzner.de (213.239.203.233) 35.406 ms 41.617 ms
6 core4.hetzner.de (213.239.203.149) 40.252 ms core1.hetzner.de (213.239.203.153) 40.819 ms core4.hetzner.de (213.239.203.149) 40.094 ms
7 de-cix20.net.google.com (80.81.193.108) 40.248 ms 40.586 ms 40.564 ms
8 216.239.56.110 (216.239.56.110) 45.841 ms 40.934 ms 40.468 ms
9 72.14.235.247 (72.14.235.247) 41.062 ms 41.224 ms 40.917 ms
10 fra07s28-in-f2.1e100.net (173.194.112.34) 42.194 ms 40.811 ms 40.764 ms
Router netstat -rn when not connected to VPN:
root@TPLinkTLWR1043ND2:~# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.2.1 0.0.0.0 UG 0 0 0 br-wan
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 br-wan
net.ipv4.ip_forward=1 is written to server's /etc/sysctl.conf
I also have /etc/iptables.up.rules created as executable (chmod +x) on my 192.168.1.1 enabled for autorun on boot to /etc/rc.local with the following contents:
#Allow forwarding via tunnel
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I OUTPUT -o tun0 -j ACCEPT
iptables -I FORWARD -o tun0 -j ACCEPT
So... what I need to do next? The only thing that doesn't really work is that I don't get internet connection when any device is connected to 192.168.0.1 and 192.168.1.1 routers. Of course, I have internet connection when connected to 192.168.2.1 because it is the last router in a chain in my home network.
I'll try to provide any information needed.
