Dear all,
I contact you because i've problem with openvpn on my openwrt router .
I was installed openvpn, and configure it, my clients (ubuntu, android) can connect to the server well but my clients can't ping their defaut gateway, and from my router I can't ping my clients.
/ect/config/openvpn
config openvpn 'openvpn'
option enable '1'
option port '1194'
option proto 'udp'
option dev 'tun'
option ca '/etc/easy-rsa/keys/ca.crt'
option cert '/etc/easy-rsa/keys/server1.crt'
option key '/etc/easy-rsa/keys/server1.key'
option dh '/etc/easy-rsa/keys/dh2048.pem'
#option ifconfig_pool_persist '/tmp/ipp.txt'
option keepalive '10 120'
option comp_lzo 'no'
option persist_key '1'
option persist_tun '1'
option status '/var/log/openvpn-status.log'
option verb '3'
option server '10.0.0.0 255.255.255.0'
option client_to_client '1'
list push 'redirect-gateway def1'
list push 'dhcp-option DNS 8.8.8.8'
list push 'route 192.168.3.0 255.255.255.0' #My LAN
/etc/openvpn/openvpn.conf
mode server
tls-server
### network options
port 1194
proto udp
dev tun
### Certificate and key files
ca /etc/easy-rsa/keys/ca.crt
cert /etc/easy-rsa/keys/server.crt
key /etc/easy-rsa/keys/server.key
dh /etc/easy-rsa/keys/dh2048.pem
client-to-client
server 10.0.0.0 255.255.255.0 #VPN Network
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.3.254" #LAN IP of my router
push "route 192.168.3.0 255.255.255.0" #My LAN
### (optional) compression (Can be slow). If not used specifically set to no and do not comment out.
### with no comp-lzo can result in write to TUN/TAP : Invalid argument (code=22) error
comp-lzo no
#comp-lzo yes
persist-key
persist-tun
verb 3
keepalive 10 120
log-append /var/log/openvpn.log
Client config file :
client
tls-client
dev tun
proto udp
remote MY-PUBLIC-IP-ADDRESS 1194 # Change to your router's External IP
resolv-retry infinite
nobind
ca ca.crt
cert Client1.crt
key Client1.key
dh dh2048.pem
#comp-lzo
persist-tun
persist-key
verb 3
My router :
- LAN : 192.168.3.0/24 : ip of my router .254
WAN : private network 192.168.1.0/24 => go to internet trough another router .1
VPN : 10.0.0.0/24 tun0 : 10.0.0.1
You can find the log bellow :
Wed Mar 16 21:28:21 2016 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul 25 2015
Wed Mar 16 21:28:21 2016 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Wed Mar 16 21:28:21 2016 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Wed Mar 16 21:28:21 2016 Diffie-Hellman initialized with 2048 bit key
Wed Mar 16 21:28:21 2016 Socket Buffers: R=[163840->131072] S=[163840->131072]
Wed Mar 16 21:28:21 2016 TUN/TAP device tun0 opened
Wed Mar 16 21:28:21 2016 TUN/TAP TX queue length set to 100
Wed Mar 16 21:28:21 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Mar 16 21:28:21 2016 /sbin/ifconfig tun0 10.0.0.1 pointopoint 10.0.0.2 mtu 1500
Wed Mar 16 21:28:21 2016 /sbin/route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.2
Wed Mar 16 21:28:21 2016 UDPv4 link local (bound): [undef]
Wed Mar 16 21:28:21 2016 UDPv4 link remote: [undef]
Wed Mar 16 21:28:21 2016 MULTI: multi_init called, r=256 v=256
Wed Mar 16 21:28:21 2016 IFCONFIG POOL: base=10.0.0.4 size=62, ipv6=0
Wed Mar 16 21:28:21 2016 Initialization Sequence Completed
Wed Mar 16 21:29:11 2016 77.154.204.112:65150 TLS: Initial packet from [AF_INET]77.154.204.112:65150, sid=97b218e5 291fef3f
Wed Mar 16 21:29:22 2016 77.154.204.112:65150 VERIFY OK: depth=1, C=FR, ST=A, L=B, O=C, OU=Y, CN=OpenWrt, name=MyServer, emailAddress=toto@toto.fr
Wed Mar 16 21:29:23 2016 77.154.204.112:65150 VERIFY OK: depth=0, C=FR, ST=A, L=B, O=C, OU=Y, CN=OpenWrt, name=Client1, emailAddress=toto@toto.fr
Wed Mar 16 21:29:24 2016 77.154.204.112:65150 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 16 21:29:24 2016 77.154.204.112:65150 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 16 21:29:24 2016 77.154.204.112:65150 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 16 21:29:24 2016 77.154.204.112:65150 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 16 21:29:25 2016 77.154.204.112:65150 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Mar 16 21:29:25 2016 77.154.204.112:65150 [OpenWrt] Peer Connection Initiated with [AF_INET]77.154.204.112:65150
Wed Mar 16 21:29:25 2016 OpenWrt/77.154.204.112:65150 MULTI_sva: pool returned IPv4=10.0.0.6, IPv6=(Not enabled)
Wed Mar 16 21:29:25 2016 OpenWrt/77.154.204.112:65150 MULTI: Learn: 10.0.0.6 -> OpenWrt/77.154.204.112:65150
Wed Mar 16 21:29:25 2016 OpenWrt/77.154.204.112:65150 MULTI: primary virtual IP for OpenWrt/77.154.204.112:65150: 10.0.0.6
Wed Mar 16 21:29:27 2016 OpenWrt/77.154.204.112:65150 PUSH: Received control message: 'PUSH_REQUEST'
Wed Mar 16 21:29:27 2016 OpenWrt/77.154.204.112:65150 send_push_reply(): safe_cap=940
Wed Mar 16 21:29:27 2016 OpenWrt/77.154.204.112:65150 SENT CONTROL [OpenWrt]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.3.254,route 192.168.3.0 255.255.255.0,route 10.0.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.0.0.6 10.0.0.5' (status=1)
Routing table of my client :
Table de routage IP du noyau
Destination Passerelle Genmask Indic Metric Ref Use Iface
0.0.0.0 10.0.0.5 0.0.0.0 UG 0 0 0 tun0
10.0.0.0 10.0.0.5 255.255.255.0 UG 0 0 0 tun0
10.0.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
86.233.XX.XXX 192.168.43.1 255.255.255.255 UGH 0 0 0 wlan0 86.233.XX.XXX is my public IP to go to the internet
172.16.29.0 0.0.0.0 255.255.255.0 U 0 0 0 vmnet8
192.168.3.0 10.0.0.5 255.255.255.0 UG 0 0 0 tun0
192.168.43.0 0.0.0.0 255.255.255.0 U 9 0 0 wlan0 => my private network where is connected my client (different network than my LAN used another public IP address)
192.168.81.0 0.0.0.0 255.255.255.0 U 0 0 0 vmnet1
Client tun0 interface :
IP : 10.0.0.6
Netmask : /32
P-t-P : 10.0.0.5
Thanks in advance for your feedback.
