Cannot get VPN to work. Spent WEEKS trying. Please help

windyboi

Hi,

I'll try and keep things simple for diagnosing purposes but I've tried so many different combinations and community boards to try and help fix the problem but I just cannot reach the resources on my LAN.

I am using DD-WRT OpenVPN Server, and Tunnelblick OpenVPN Client. I have also tried using OpenVPN Client in Windows to no avail.

Observations/Notes:

It seems that I can *connect* but I just cannot access any resources on my home LAN (i.e. my Freenas or Router by ping).
The connection seems to cut out every 5 mins or so. The logs I collected are over a 7 min ish period to demonstrate this.
It isn't a firewall problem because I have tried with and without opening 1194 implicitly on the iptables on ddw-rt (I'm informed that this is automatic anyway so not necessary to manually add this). My firewall on my mac is disabled.
My home network is a standard 192.168.1/24 , with DHCP running from .100-.149
192.168.1.100 is the IP of my client macbook

Server config:

root@DD-WRT:~# cat /tmp/openvpn/openvpn.conf
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp
cipher bf-cbc
auth md5
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
mtu-disc yes
server-bridge 192.168.1.1 255.255.255.0 192.168.1.50 192.168.1.60
dev tap2

Client config:

remote **DDNS HERE** 1194
client 
dev tap
proto udp 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
float
auth md5

verb 6

ca ca.crt
cert macbook.crt
key macbook.key
#tls-auth ta.key 1

ns-cert-type server

Client log:
http://pastebin.com/y2PqziN7

Server log:
http://pastebin.com/n6nPX9Te

Client routing table before connecting:

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            172.20.10.1        UGSc           78        0     en0
127                127.0.0.1          UCS             1        0     lo0
127.0.0.1          127.0.0.1          UH              7    18291     lo0
169.254            link#4             UCS             1        0     en0
172.20.10/28       link#4             UCS             2        0     en0
172.20.10.1/32     link#4             UCS             4        0     en0
172.20.10.1        3a:ca:da:ce:85:64  UHLWIir        57       12     en0   1144
172.20.10.2/32     link#4             UCS             1        0     en0
172.20.10.15       ff:ff:ff:ff:ff:ff  UHLWbI          1        2     en0
255.255.255.255/32 link#4             UCS             2        0     en0
255.255.255.255    ff:ff:ff:ff:ff:ff  UHLWbI          1        2     en0

Client routing table after connecting:

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            172.20.10.1        UGSc           82        0     en0
127                127.0.0.1          UCS             1        0     lo0
127.0.0.1          127.0.0.1          UH              9    18471     lo0
169.254            link#4             UCS             1        0     en0
172.20.10/28       link#4             UCS             2        0     en0
172.20.10.1/32     link#4             UCS             4        0     en0
172.20.10.1        3a:ca:da:ce:85:64  UHLWIir        58       23     en0   1102
172.20.10.2/32     link#4             UCS             1        0     en0
172.20.10.15       ff:ff:ff:ff:ff:ff  UHLWbI          1        3     en0
192.168.1          link#11            UC              4        0    tap0
192.168.1.4        link#11            UHLWIi          1        0    tap0
192.168.1.100      link#11            UHLWIi          1        0    tap0
255.255.255.255/32 link#4             UCS             2        0     en0
255.255.255.255    ff:ff:ff:ff:ff:ff  UHLWbI          1        3     en0

Further diagnostic information from the server:

Code:
iptables -vnL FORWARD
iptables -vnL INPUT
iptables -t nat -vnL
ifconfig
brctl show
route -n

http://pastebin.com/Frr7kt3z

Traffic

Does DD-WRT support bridge-utils ?

Remove --mtu 1500 from your server config.

Set logs to -- verb 4

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

windyboi

Hi Traffic

Thank you for your reply.

DD-WRT supports bridging. All of the OpenVPN Server settings are configured through it's GUI. I just copied the server config file from the raw openvpn.conf file that was generated as a result of the GUI Settings.

Unfortunately it wont allow me to have no value in the MTU setting.

I will change the verb level as you suggested

Thanks

Traffic

windyboi wroteUnfortunately it wont allow me to have no value in the MTU setting

Comment this option out of the config file that the GUI creates .. if possible. OpenVPN has no --mtu prerequisite.

windyboi

Ok,

I've commented the line as you suggested, and I have also changed my network subnet to be on 192.168.10/24 and have modified verb to 4.

Unfortunately, still no luck. Here is the output from my client log again: http://pastebin.com/smGfmSZA

Thank you Traffic

Traffic

From your client log:

2016-03-05 19:06:33 us=640375 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'

You can fix that 😃

windyboi

WOW. That has solved it. Thank you so much! I can't believe it was something so simple..