Hi i have an issue getting my OpenVPN to do what I want it. My goal. I have an openvpn server running on Linksys wrt1900ac router. I want to use this in 'full tunnel' mode, meaning that ALL traffic i generate on my iphone, will be tunneled to my wrt1900, and from that point it must be routed into my lan or onto the internet. My challenge. Currently, my I can reach my LAN ip addresses (so i do get tunnel/connection to my router), but traffic to the internet goes from my device straight onto internet and not through my wrt1900 (whatsmyip.com shows the IP addy I got from 3G provider, even when connection is on). Thus, it seems i have only split tunnel. My situation I run the lastest version of OpenVPN connect on iphone 5. I have ovpn configs for two servers I run - the wrt1900 server, this behaves as described abot - an openvpn server on a synology nas in my lan. this connection DOES give me full tunneling, to be verified by the IP addy shown in whatsmyip.com (which is same as my ISP WAN side addy, as one would expect). I have been in contact with linksys for quite some time now, but apart from talking a lot to them about my current setup, I have not really made any progress. As a result from some thinking i did (and some reading on various openvpn-pages), my think this behaviour (full tunnel vs split tunnel) is a setting in the config files my ovpn server provides to load onto my iphone app. below is the text I have in my ovpn from wrt1900. it appears (when comparing with the synoloy config file) that i need to use "redirect-gateway def1". but if i enter that line in my wrt1900 client side config file, i dont have ANY response from ANY site (so split tunnel doesnt work anymore). I guess i need more config options, but have trouble finding out which ones. What do I need to achieve full tunneling on my WRT1900 vpn connection, just like i can have it on my synology vpn? (in case you may wonder why i dont just run VPN from my synology - i dont wana abuse my NAS to run a service which I think belongs in a router) BASIC INFO REGARDING MY WRT1900 (OVPN) SETTINGS ================================= Subnet for WRT1900: 10.157.147.xxx VPN IP range: 172.19.1.(2-6) ConfigFile: client dev tun proto tcp remote 1194 tun-mtu 6000 mssfix 0 resolv-retry infinite nobind persist-key persist-tun ns-cert-type server auth-user-pass verb 3 blablabla blabla blablabla

You should find in your router openvpn configuration menus an option to "redirect all client data over the VPN" or something like that. Enable that option and download the client config to your client device and try again.

No, i dont have that option :-( all i get is an option to set VPN server addy, vpn IP subnet (to some extent), port number and protocol. so I was hoping i could find out which settings to add to the generated config file which i then load into my phone. essentially, this is a client side setting (as the vpn client app decides to send to the vpn server or not). at least, i believe this is how it works

[quote="mchp92"]No, i dont have that option[/quote]Then I suggest you demand your money back from Linksys. As far as I am concerned that product is over priced garbage. :o

That observation doesnt get me any closer to a full tunnel

Linksys offer this paltry document .. [url]http://www.linksys.com/us/support-article?articleNum=157327[/url] So I suggest you contact them.

I did all thats in the doc I can connect to vpn But only split tunnel I did also contact them My case is with 3rd line support now but its s l o w

[quote="mchp92"]i need to use "redirect-gateway def1". but if i enter that line in my wrt1900 client side config file, i dont have ANY response from ANY site[/quote]add this to your client, then connect and post output of [b]ip route[/b]

How do i get that output on my iphone?

@Traffic Bump. What exactly are you asking me to do?

[quote="Traffic"][quote="mchp92"]i need to use "redirect-gateway def1". but if i enter that line in my wrt1900 client side config file, i dont have ANY response from ANY site[/quote]add this to your client, then connect and post output of [b]ip route[/b][/quote] Elaborate, please?

Linksys wrt1900ac router: How to achieve full tunnel?

mchp92

@Traffic
This is similar log, but if i do NOT use the redirect-gateway

[quote]

2016-02-13 23:06:28 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2016-02-13 23:06:28 Session is ACTIVE
2016-02-13 23:06:28 EVENT: GET_CONFIG
2016-02-13 23:06:28 Sending PUSH_REQUEST to server...
2016-02-13 23:06:28 OPTIONS:
0 [dhcp-option] [DNS] [10.157.147.5]
1 [topology] [subnet]
2 [route-gateway] [172.19.1.1]
3 [route] [10.157.147.0] [255.255.255.0]
4 [ping] [10]
5 [ping-restart] [120]
6 [ifconfig] [172.19.1.2] [255.255.255.0]

2016-02-13 23:06:28 EVENT: ASSIGN_IP
2016-02-13 23:06:28 Connected via tun
2016-02-13 23:06:28 EVENT: CONNECTED USER_ID@MY_WAN_IP:1194 (192.168.1.113) via /TCPv4 on tun/172.19.1.2/
2016-02-13 23:06:28 SetStatus Connected

[\quote]

Pippin

SSH to your router and post output as suggested:

ip route

iptables -L

Traffic

mchp92 wrote@Traffic
This is similar log, but if i do NOT use the redirect-gateway

You will need --redirect-gateway .. leave it enabled.

mchp92

I am not sure if i can ssh
Do i need to say "ssh 10.157.147.5"?

Pippin

PuTTY ;-)
http://www.synology-forum.nl/algemeen/nas-benaderen-met-ssh-winscp-putty/

Edit:
Ah, forget it. SSH not possible with this router...

mchp92

Ok then how do i proceed?
Anything else i can do?

mchp92

Any thoughts?

Traffic

mchp92 wrote
Traffic wroteDoes your router have iptables installed ?
What to I need to do to verify this?

See your router manual.

jones77622

at least you can get connected

KoCMoHaBTa

This works for WRT1900ACS - https://community.linksys.com/t5/Wireless-Routers/WRT-1900-ACS-Impossible-to-route-web-traffic-via-openvpn/m-p/1054366/highlight/true#M327438

You can try if it works for WRT1900AC.

Jlennemann

I had the same router before I switched to Asus. You can achieve a full tunnel, but the configuration change needs to be made in the OpenVPN client file. Use a text editor and add the following lines:

dhcp-option DNS 192.168.1.1 Note: Replace the IP with your DNS servers IP address
redirect-gateway def1

Once you've saved the configuration, delete the old configuration from your VPN client and add the new one in.

Jlennemann

Update: This was done on a FreeNAS jail. I remember now that I could not get the Linksys router to achieve a full tunnel. It looks like it will only do split tunnel. You could setup a Raspberry Pi and run OpenVPN on it and forward the necessary ports on your router to the Pi.

aljo00

Thank you Traffic and KoCMoHaBTa

It works!!! on Linksys WRT1200AC , adding -redirect-gateway def1

now i have full tunnel 🙂 🙂

svss

Hey, has anyone managed to get this to work on a WRT1900AC?

I'm seeing the same behavior. My client traffic is not routed through the VPN.

This is my config file:

client
dev tun
proto tcp
remote <my_host....> 1194
tun-mtu 6000
# fragment 0 can be used to improve performance in some instances but
# breaks compatibility with some Android apps
# fragment 0
mssfix 0
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
auth-user-pass
verb 3
push dhcp-option DNS 192.168.1.1
redirect-gateway def1

Jlennemann

What type of traffic are you seeing being routed through your VPN? LAN traffic? Also, why did you set the MTU size at 6000?

svss

Jlennemann wroteWhat type of traffic are you seeing being routed through your VPN? LAN traffic? Also, why did you set the MTU size at 6000?

Hi,

I am only seeing the LAN traffic routed via the VPN. If I want to open a website or an external connection, it never loads my content and times out.
The MTU size has been adjusted by the router and I didn't set it manually to 6000.

Thanks

svss

I just set the MTU to 1482 on the router as well as in the OVPN config file and nothing has changed.

Jlennemann

Remove line "push dhcp-option DNS 192.168.1.1" and replace it with "push dhcp-option DNS 8.8.8.8" and then go to google and type in what's my IP and see if it matches the public IP of your network. Be sure to remove the quotations on the command I asked you to replace.

Jlennemann

Also, ensure that your Linksys router is using TCP as you have proto tcp setup in your user config. file.

svss

Something's just not right...

client
dev tun
proto tcp
remote my_server 1194
tun-mtu 1482
# fragment 0 can be used to improve performance in some instances but
# breaks compatibility with some Android apps
# fragment 0
mssfix 0
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
auth-user-pass
verb 3
push dhcp-option DNS 8.8.8.8
redirect-gateway def1  <<<------- if I add this, no external pages are loaded at all...

<ca>
-----BEGIN CERTIFICATE-----

« Previous Page Next Page »