Setup OpenVPN on Tomtao router but cannot access samba

Waynosan

Hi folks, total noob here but I've managed to setup the OpenVPN server on my Linksys E3000 router running Tomato v1.28.

Connected with the OpenVPN client on my android phone (over 4G) I'm able to ping all devices on my home network and control things like my home theater receiver. Unfortunately I'm not able to access the samba shares running on a D-link DNS321 NAS with Alt-F firmware and a Pogoplug running Archlinux (with a few HDs attached to it). I can ping both the DNS321 and the Pogoplug but cannot seem to be able to access the shares through ES File Explorer (I've also tried a few other file managers with no luck). When the phone is connected directly to the LAN via Wifi I can see the shares no problem.

I have the server setup with TUN interface (as required for android) using the UDP protocol 443 port (as strongly recommended). Firewall is set to automatic. VPN subnet/netmask is 10.8.0.0 / 255.255.255.0. Push LAN to clients is selected as is Respond to DNS and Advertise DNS to clients. The router's address is 192.168.1.1 with subnet mask 255.255.255.0. Add devices connected to the LAN have an 192.168.1.x IP address.

AFAIK the client is setup OK but there are 2 messages in the log that perhaps I need to remedy:

OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ipconfig-ipv6 options

OpenVPN ROUTE: failed to parse/resolve route for host/network: ::/0

I do not think this is causing the problem in this case but I'm not certain.

On the server side I added this line in the "Customer Configuration" box in the Advanced Tab of the VPN Server Configuration:

push "route 192.168.1.0 255.255.255.0"

per the OpenVPN Howto guide.

Would appreciate if someone could help me out with this... I hope it's something simple that I overlooked.

Much thanks.

Traffic

Waynosan wroteI hope it's something simple that I overlooked

That would be nice .. 🙁

Please see the [b][color=#A40000]Forum rules[/color][/b] (top of this page)

Waynosan

Traffic wrote

Please see the [b][color=#A40000]Forum rules[/color][/b] (top of this page)

Thank you for your response Traffic.

Ahh yes, the configurations. It took me a little while to find how to extract that off of the router since I was using the GUI in Tomato to configure the server side. I stripped out the keys, comments, and identity stuff (hopefully).

Server Config:

vpn_server1_c2c=0
vpn_server1_ca=-----BEGIN CERTIFICATE----- 
Blah Blah 
-----END CERTIFICATE-----
vpn_server1_ccd=0
vpn_server1_ccd_excl=0
vpn_server1_ccd_val=
vpn_server1_cipher=default
vpn_server1_comp=adaptive
vpn_server1_crt=-----BEGIN CERTIFICATE----- 
Blah Blah 
 -----END CERTIFICATE-----
vpn_server1_crypt=tls
vpn_server1_custom=push "route 192.168.1.0 255.255.255.0"
vpn_server1_dh=-----BEGIN DH PARAMETERS----- 
Blah Blah 
 -----END DH PARAMETERS-----
vpn_server1_dhcp=1
vpn_server1_firewall=auto
vpn_server1_hmac=0
vpn_server1_if=tun
vpn_server1_key=-----BEGIN PRIVATE KEY----- 
Blah Blah 
 -----END PRIVATE KEY-----
vpn_server1_local=10.8.0.1
vpn_server1_nm=255.255.255.0
vpn_server1_pdns=1
vpn_server1_plan=1
vpn_server1_poll=0
vpn_server1_port=443
vpn_server1_proto=udp
vpn_server1_r1=192.168.1.50
vpn_server1_r2=192.168.1.55
vpn_server1_remote=10.8.0.2
vpn_server1_reneg=-1
vpn_server1_rgw=0
vpn_server1_sn=10.8.0.0
vpn_server1_static=# # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 
Blah Blah 
 -----END OpenVPN Static key V1-----
root@unknown:/tmp/home/root#

And on the client side:

# Enables connection to GUI
management /data/data/de.blinkt.openvpn/cache/mgmtsocket unix
management-client
management-query-passwords
management-hold

setenv IV_GUI_VER "de.blinkt.openvpn 0.6.50"
setenv IV_PLAT_VER "21 5.0 armeabi-v7a Verizon MSM8974 SM-G900V"
machine-readable-output
ifconfig-nowarn
client
verb 4
connect-retry-max 5
connect-retry 5
resolv-retry 60
dev tun
remote myname.duckdns.org 443 udp
connect-timeout 60
auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
Blah blah
-----END CERTIFICATE-----

</ca>
<key>
-----BEGIN PRIVATE KEY-----
Blah blah
-----END PRIVATE KEY-----

</key>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=MI, L=Detroit, O=SterlingHeights, OU=Borzecin, CN=SterlingHeights-CA/name=EasyRSA/emailAddress=myname@gmail.com
Validity
Not Before: Mar 25 00:37:55 2016 GMT
Not After : Mar 23 00:37:55 2026 GMT
Subject: C=US, ST=MI, L=Detroit, O=SterlingHeights, OU=Borzecin, CN=client1/name=EasyRSA/emailAddress=myname@gmail.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
Blah blah
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
Blah blah
X509v3 Authority Key Identifier:
keyid:Blah blah
DirName:/C=US/ST=MI/L=Detroit/O=SterlingHeights/OU=Borzecin/CN=SterlingHeights-CA/name=EasyRSA/emailAddress=myname@gmail.com
serial:Blah blah

X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
X509v3 Subject Alternative Name:
DNS:client1
Signature Algorithm: sha256WithRSAEncryption
Blah blah
-----BEGIN CERTIFICATE-----
Blah blah
-----END CERTIFICATE-----

</cert>
comp-lzo
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
Blah blah
-----END OpenVPN Static key V1-----

</tls-auth>
key-direction 1
route-ipv6 ::/0
route 0.0.0.0 0.0.0.0 vpn_gateway
remote-cert-tls server
persist-tun
preresolve
push-peer-info

Traffic

Waynosan wroteI'm not able to access the samba shares running on a D-link DNS321 NAS with Alt-F firmware and a Pogoplug running Archlinux (with a few HDs attached to it). I can ping both the DNS321 and the Pogoplug but cannot seem to be able to access the shares through ES File Explorer (I've also tried a few other file managers with no luck)

You cannot access samba shares with a file explorer using --dev tun .. (Unless you have a WINS server)

Try:

net use //ip.add.of.host/share_name

Waynosan

Traffic wrote
Waynosan wroteI'm not able to access the samba shares running on a D-link DNS321 NAS with Alt-F firmware and a Pogoplug running Archlinux (with a few HDs attached to it). I can ping both the DNS321 and the Pogoplug but cannot seem to be able to access the shares through ES File Explorer (I've also tried a few other file managers with no luck)
You cannot access samba shares with a file explorer using --dev tun .. (Unless you have a WINS server)

Try:
net use //ip.add.of.host/share_name

Hi Traffic,
I think I figured it out late last night. Not sure if I have a WINS server but I forgot to add the VPN subnet address and mask to the samba configuration on the NAS. After that I was able to access the shares and files on it. I was really late so I only tried it on the DNS321 but I'm hoping this is the same thing I need to do to the pogoplug shares to enable the capability.

Thank you again for your time and help. If the same fix doesn't work on the Pogoplug then I'll look into the WINS option or reflash the router with one with more VPN options.

Regards!

Traffic

Waynosan wroteI forgot to add the VPN subnet address and mask to the samba configuration on the NAS. After that I was able to access the shares and files on it

Sure .. actually I forgot, you can browse shares on the VPN server but not the entire network.