Asus RT-AC68U site-to-site TAP bridge issue

matej

Hello,

I have two Asus routers and I am trying to create a site-to-site ethernet bridge link between the two routers.
At my parents home, I enabled the Openvpn server on the RT-AC66U router in TAP mode.
I am trying to connect from my house to the server by the RT AC68U in VPN client mode.
My goal is to create a link between the two networks and have full access to them.

When I am trying to connect from my home to the server I always get the following log:

Jan  7 14:21:10 rc_service: httpd 421:notify_rc restart_vpncall
Jan  7 14:21:12 openvpn[8692]: OpenVPN 2.3.2 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Dec  1 2015
Jan  7 14:21:12 openvpn[8692]: Socket Buffers: R=[122880->131072] S=[122880->131072]
Jan  7 14:21:12 openvpn[8730]: UDPv4 link local: [undef]
Jan  7 14:21:12 openvpn[8730]: UDPv4 link remote: [AF_INET]89.143.67.212:1194
Jan  7 14:21:12 openvpn[8730]: TLS: Initial packet from [AF_INET]89.143.67.212:1194, sid=02369915 5090ddb9
Jan  7 14:21:12 openvpn[8730]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Jan  7 14:21:13 openvpn[8730]: VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC66U, emailAddress=me@myhost.mydomain
Jan  7 14:21:13 openvpn[8730]: VERIFY OK: nsCertType=SERVER
Jan  7 14:21:13 openvpn[8730]: VERIFY OK: depth=0, C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC66U, emailAddress=me@myhost.mydomain
Jan  7 14:21:16 openvpn[8730]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan  7 14:21:16 openvpn[8730]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan  7 14:21:16 openvpn[8730]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan  7 14:21:16 openvpn[8730]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan  7 14:21:16 openvpn[8730]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Jan  7 14:21:16 openvpn[8730]: [RT-AC66U] Peer Connection Initiated with [AF_INET]89.143.67.212:1194
Jan  7 14:21:19 openvpn[8730]: SENT CONTROL [RT-AC66U]: 'PUSH_REQUEST' (status=1)
Jan  7 14:21:19 openvpn[8730]: PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 net_gateway,dhcp-option DNS 192.168.4.1,route-gateway 192.168.4.1,redirect-gateway def1,route-gateway dhcp,ping 15,ping-restart 60'
Jan  7 14:21:19 openvpn[8730]: OPTIONS IMPORT: timers and/or timeouts modified
Jan  7 14:21:19 openvpn[8730]: OPTIONS IMPORT: route options modified
Jan  7 14:21:19 openvpn[8730]: OPTIONS IMPORT: route-related options modified
Jan  7 14:21:19 openvpn[8730]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Jan  7 14:21:19 openvpn[8730]: TUN/TAP device tap15 opened
Jan  7 14:21:19 openvpn[8730]: TUN/TAP TX queue length set to 100
Jan  7 14:21:24 kernel: DROP IN=ppp0 OUT= MAC= SRC=212.47.254.233 DST=95.233.93.249 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=24721 PROTO=TCP SPT=52642 DPT=21320 SEQ=2954915360 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 
Jan  7 14:21:27 kernel: DROP IN=eth0 OUT= MAC=1c:87:2c:66:3f:10:e0:3f:49:a9:92:50:08:00 SRC=192.168.1.1 DST=192.168.1.22 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=33166 DPT=137 LEN=58 
Jan  7 14:21:27 kernel: DROP IN=eth0 OUT= MAC=1c:87:2c:66:3f:10:e0:3f:49:a9:92:50:08:00 SRC=192.168.1.1 DST=192.168.1.22 LEN=78 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=33166 DPT=137 LEN=58 
Jan  7 14:21:38 kernel: DROP IN=ppp0 OUT= MAC= SRC=103.10.4.209 DST=95.233.93.249 LEN=1476 TOS=0x00 PREC=0x00 TTL=242 ID=43774 DF PROTO=TCP SPT=80 DPT=55009 SEQ=1981543036 ACK=1447806993 WINDOW=4637 RES=0x00 ACK URGP=0 OPT (0101080A1C3FF1053337E3AE) 
Jan  7 14:21:38 kernel: DROP IN=ppp0 OUT= MAC= SRC=103.10.4.209 DST=95.233.93.249 LEN=1476 TOS=0x00 PREC=0x00 TTL=242 ID=21614 DF PROTO=TCP SPT=80 DPT=55010 SEQ=1976450286 ACK=2627374990 WINDOW=4637 RES=0x00 ACK URGP=0 OPT (0101080A1C3FF1473337E3AB) 
Jan  7 14:21:39 kernel: DROP IN=eth0 OUT= MAC=01:00:5e:00:00:01:04:18:d6:ea:88:e8:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=10348 PROTO=2 
Jan  7 14:21:39 openvpn[8730]: /sbin/route add -net 89.143.67.212 netmask 255.255.255.255 gw 192.168.100.1
Jan  7 14:21:39 openvpn[8730]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 192.168.4.1
Jan  7 14:21:39 openvpn[8730]: ERROR: Linux route add command failed: external program exited with error status: 1
Jan  7 14:21:39 openvpn[8730]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 192.168.4.1
Jan  7 14:21:39 openvpn[8730]: ERROR: Linux route add command failed: external program exited with error status: 1
Jan  7 14:21:39 openvpn[8730]: /sbin/route add -net 0.0.0.0 netmask 255.255.255.255 gw 192.168.100.1
Jan  7 14:21:39 openvpn[8730]: Initialization Sequence Completed

The strange thing is that the OpenVPN clients on my mac (viscosity) and android are working like a charm and I can have full access to my parents network.

Thank you!

Traffic

Please post your server and client config information.

matej

This is my server configuration inside the router. Download the screenshot please

https://dl.dropboxusercontent.com/u/13481241/VPN1.jpg

This is the client configuration. I masked the certificate and the key with ****

client
dev tap
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
proto udp
remote matejankaranvpn.dyndns.org 1194
float
comp-lzo yes
route-delay 20
keepalive 15 60
auth-user-pass
ns-cert-type server
<ca>
-----BEGIN CERTIFICATE-----
***************************
censored
***************************
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
***************************
censored
***************************
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
***************************
censored
***************************
-----END PRIVATE KEY-----
</key>
resolv-retry infinite
nobind

Please, help meee 🙂

Traffic

matej wroteJan 7 14:21:19 openvpn[8730]: PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 net_gateway,dhcp-option DNS 192.168.4.1,route-gateway 192.168.4.1,redirect-gateway def1,route-gateway dhcp,ping 15,ping-restart 60 {*Note: no ifconfig statement here}'

It looks like you need a DHCP server to give your client an ip address because your server is not pushing one to your client.

matej

Hi,

The router with the Openvpn server has a DHCP server enabled. As you can see from the attached code, I am able to connect successfully with the mac client and I receive an ip address from the dhcp

Jan 10 11:09:59: Viscosity Mac 1.5.11 (1314)
Jan 10 11:09:59: Viscosity OpenVPN Engine Started
Jan 10 11:09:59: Running on Mac OS X 10.11.2
Jan 10 11:09:59: ---------
Jan 10 11:09:59: Controllo la raggiungibilità della connessione…
Jan 10 11:09:59: Connessione raggiungibile, inizio connessione.
Jan 10 11:10:00: OpenVPN 2.3.8 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Sep 23 2015
Jan 10 11:10:00: library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.09
Jan 10 11:10:03: UDPv4 link local: [undef]
Jan 10 11:10:03: UDPv4 link remote: [AF_INET]86.61.82.132:1194
Jan 10 11:10:03: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Jan 10 11:10:06: [RT-AC66U] Peer Connection Initiated with [AF_INET]86.61.82.132:1194
Jan 10 11:10:09: TUN/TAP device /dev/tap0 opened
Jan 10 11:10:10: DHCP enabled on tap interface tap0
Jan 10 11:10:29: Initialization Sequence Completed

Do I need to add some instructions to the .ovpn file of the asus client?

Traffic

matej wroteThe router with the Openvpn server has a DHCP server enabled

Does the client router have a DHCP client enabled to get a DHCP address ?

matej

Hi,

The client router has a dhcp server enabled and I cannot find any dhcp client in the router interface.

As "dhcp client" do you mean the wan connection type? please, look at the attached screenshot
https://dl.dropboxusercontent.com/u/13481241/VPN3.jpg

Do I need to set it on "automatic ip" instead of ppoe?

In the "internet connection" section I have also the following settings:
https://dl.dropboxusercontent.com/u/13481241/VPN4.jpg

Traffic

Those settings are for your WAN interface ..

Take a look in VPN instead ..

Sorry, I don't know much about Asus RT-x

matej

These are the screens I can see by clicking on the "VPN" menù inside the Asus RT:

https://dl.dropboxusercontent.com/u/13481241/vpn5.jpg

By clicking on "modify .ovpn" box I see the following screen:

https://dl.dropboxusercontent.com/u/13481241/VPN6.jpg

matej

UP :cry: :cry: :cry: :cry: :cry: :cry:

Traffic

matej wroteI have two Asus routers and I am trying to create a site-to-site ethernet bridge link between the two routers

I suggest you try standard TUN mode instead. Otherwise, you need to review the Asus documentation.

You are welcome to post any further details 8-)

matej

Do you really think I should switch to Tun type? I need to access other devices on the remote lan where the von server is

Traffic

Clearly, there is an issue with a TAP bridge which I cannot help with. If you use TUN this may resolve the problem for you .. you can still access remote devices over a tunnel with routing by implementing this setup: HOWTO: Expanding the scope of the VPN to include additional machines

brepo

hi, we have the same problem

rt-ac68(server) to debian = it works
rt-ac68(server) to 4G-AC68U = did not work
log is ok, ip a, is ok. .

did you find a solution?

brepo

solved:

https://forums.openvpn.net/viewtopic.php?f=6&t=24560&p=76634#p76634