Hi, everyone:
I'm attempting to set up an OpenVPN server on my DD-WRT router to allow my clients to have secure internet access when using public WiFi. I've been following the advice from such posts as
https://forums.openvpn.net/topic7806.html and
https://forums.openvpn.net/topic17208.html. So far I have my server working and I'm able to connect through a Windows 10 client and an Android client. However, my clients cannot access the internet.
I can access devices on my home network, however. For example, I have a wifi thermostat, and I can access it when connected to the VPN.
I've looked at quite a few posts regarding this issue (it seems to be a common problem), and I've followed a lot of advice, to no avail. I'm sure it's a simple config issue, but I must be overlooking it. So, I'm posting my config info hoping someone might see what I've missed. Any help is appreciated 🙂
server.ovpn
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.66.1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
server 192.168.66.0 255.255.255.0
dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001
comp-lzo
push "redirect-gateway"
client.ovpn:
client
dev tun
proto udp
remote myserver.duckdns.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
<ca>
-----BEGIN CERTIFICATE-----
BlahBlahBlah
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
BlahBlahBlah
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
BlahBlahBlah
-----END PRIVATE KEY-----
</key>
remote-cert-tls server
comp-lzo
verb 4
Output of
ipconfig on client:
Ethernet adapter Ethernet 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-92-C3-A2-04
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::24a7:1cf:e5d:23f0%9(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.66.6(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Lease Obtained. . . . . . . . . . : Sunday, January 24, 2016 12:17:33 PM
Lease Expires . . . . . . . . . . : Monday, January 23, 2017 12:17:33 PM
Default Gateway . . . . . . . . . : 192.168.66.5
DHCP Server . . . . . . . . . . . : 192.168.66.5
DHCPv6 IAID . . . . . . . . . . . : 151060370
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-10-07-1C-68-5D-43-6D-4B-74
DNS Servers . . . . . . . . . . . : 192.168.66.1
208.67.222.222
208.67.220.220
NetBIOS over Tcpip. . . . . . . . : Enabled
Wireless LAN adapter Wi-Fi:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Centrino(R) Wireless-N 2230
Physical Address. . . . . . . . . : 68-5D-43-6D-4B-74
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::7d72:f0ce:e822:36a0%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.43.250(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Sunday, January 24, 2016 12:17:21 PM
Lease Expires . . . . . . . . . . : Sunday, January 24, 2016 1:17:21 PM
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 192.168.43.1
DHCPv6 IAID . . . . . . . . . . . : 258497859
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-10-07-1C-68-5D-43-6D-4B-74
DNS Servers . . . . . . . . . . . : 192.168.43.1
NetBIOS over Tcpip. . . . . . . . : Enabled
(192.168.43.0 is the Public WiFi network)
output of
route print on client:
===========================================================================
Interface List
10...d4 be d9 3b 96 ec ......Realtek PCIe FE Family Controller
8...68 5d 43 6d 4b 75 ......Microsoft Wi-Fi Direct Virtual Adapter
9...00 ff 92 c3 a2 04 ......TAP-Windows Adapter V9
2...68 5d 43 6d 4b 74 ......Intel(R) Centrino(R) Wireless-N 2230
1...........................Software Loopback Interface 1
4...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
28...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.66.5 192.168.66.6 20
0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.250 25
24.5.53.190 255.255.255.255 192.168.43.1 192.168.43.250 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 192.168.66.5 192.168.66.6 20
192.168.43.0 255.255.255.0 On-link 192.168.43.250 281
192.168.43.250 255.255.255.255 On-link 192.168.43.250 281
192.168.43.255 255.255.255.255 On-link 192.168.43.250 281
192.168.66.1 255.255.255.255 192.168.66.5 192.168.66.6 20
192.168.66.4 255.255.255.252 On-link 192.168.66.6 276
192.168.66.6 255.255.255.255 On-link 192.168.66.6 276
192.168.66.7 255.255.255.255 On-link 192.168.66.6 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.43.250 281
224.0.0.0 240.0.0.0 On-link 192.168.66.6 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.43.250 281
255.255.255.255 255.255.255.255 On-link 192.168.66.6 276
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
2 281 fe80::/64 On-link
9 276 fe80::/64 On-link
9 276 fe80::24a7:1cf:e5d:23f0/128
On-link
2 281 fe80::7d72:f0ce:e822:36a0/128
On-link
1 306 ff00::/8 On-link
2 281 ff00::/8 On-link
9 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
firewall on server:
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
# These next two lines may or may not be necessary.
# I (dereks) did not need them, but bmatthewshea did.
# Thus, we include them so that this works for more people:
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
Thanks!
