[b]Background:[/b] Setting up a site to site VPN using 2 x Asus RT-AC68R routers. Stock firmware (not Merlin's AsusWRT). Firmware version is 9.0.0.4.380.2695 (latest). Client and server subnet do not overlap. I can access everything (windows shares, server router page by IP in browser, rdp, etc) just fine from the client -> server but not vice versa (server ->client) I know this issue has been posted with others but I'm not sure I quite understand how they were successful in getting it to work. Especially since I'm not using DDWRT or Merlin's AsusWRT firmware. This is the closest that I could find to my issue https://forums.openvpn.net/topic19572.html however I still do not understand how to set up the client config when there is no option for a client or server config on the server. Only Allowed Clients and a single box called Custom Configuration which I'm assuming is where the server config can go? [b]Details:[/b] Router 1 = VPN Server:192.168.2.1 Netmask: 255.255.255.0 Subnet 192.168.2.0/24 Router 2 =VPN Client IP: 192.168.3.1 Netmask: 255.255.255.0 Subnet 192.168.3.0/24 VPN Subnet = 10.8.0.0 [b]Advanced Settings:[/b] Interface Type: [color=#0000FF]TUN[/color] Protocol: [color=#0000FF]UDP[/color] Server Port: [color=#0000FF]1194[/color] Firewall: [color=#0000FF]Auto[/color] Authorization Mode: [color=#0000FF]TLS[/color] Username / Password Auth. Only: [color=#0000FF]No[/color] Extra HMAC authorization: [color=#0000FF]Disable[/color] VPN Subnet / Netmask: [color=#0000FF]10.8.0.0 255.255.255.0[/color] Poll Interval: [color=#0000FF]0[/color] Push LAN to clients: [color=#0000FF]Yes[/color] Direct clients to redirect Internet traffic: [color=#0000FF]No[/color] Respond to DNS: [color=#0000FF]Yes[/color] Advertise DNS to clients: [color=#0000FF]No[/color] Encryption cipher: [color=#0000FF]AES-256-CBC[/color] Compression: [color=#0000FF]Adaptive[/color] TLS Renegotiation Time: [color=#0000FF]-1[/color] Manage Client-Specific Options: [color=#0000FF]Yes[/color] Allow Client Client: [color=#0000FF]Yes[/color] Allow only specified clients: [color=#0000FF]No [/color] Allowed Clients Username: [color=#0000FF]xxx [/color] IP Address: [color=#0000FF]192.168.3.0[/color] Subnet Mask: [color=#0000FF]255.255.255.0 [/color] Push: [color=#0000FF]Yes[/color] Any ideas how to get it to route from the Server side of the LAN to the Client side of the LAN? [b]Additional Notes:[/b] Another detail when the client connects to the server it shows in the Connection Status box on the client router a yellow exclamation with IP/Routing conflict but everything still works fine from the Client -> Server side. [u]Routing table from the server gui shows[/u] Destination Gateway Genmask Flags Metric Ref Use Type Iface xxxxxxxxxx(my personal IP) * 255.255.255.255 UH 0 0 0 WAN0 eth0 10.8.0.2 * 255.255.255.255 UH 0 0 0 tun21 192.168.3.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21 192.168.2.0 * 255.255.255.0 U 0 0 0 LAN br0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21 xxxxxxxxxx(my personal IP subnet) * 255.255.254.0 U 0 0 0 WAN0 eth0 default xxxxxxxxxx(my personal IP) 0.0.0.0 UG 0 0 0 WAN0 eth0 [u]Routing table from the client gui shows[/u] Destination Gateway Genmask Flags Metric Ref Use Type Iface 10.8.0.5 * 255.255.255.255 UH 0 0 0 tun15 xxxxxxxxxx(my personal IP) * 255.255.255.255 UH 0 0 0 WAN0 eth0 192.168.3.0 * 255.255.255.0 U 0 0 0 LAN br0 192.168.2.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun15 10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun15 xxxxxxxxxx(my personal IP subnet) * 255.255.252.0 U 0 0 0 WAN0 eth0 default xxxxxxxxxx(my personal IP) 0.0.0.0 UG 0 0 0 WAN0 eth0

[quote="wingsfan87"]I can access everything (windows shares, server router page by IP in browser, rdp, etc) just fine from the client -> server but not vice versa (server ->client)[/quote]This is the official HOWTO you need to read: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url] Or you can opt for a simpler P2P mode --[b]topology p2p[/b] which only allows for one client. (e.g your client router)

[quote="wingsfan87"]Setting up a site to site VPN using 2 x Asus RT-AC68R routers. Stock firmware (not Merlin's AsusWRT).[/quote]According to the Asus Manual your router does [u]not[/u] support OpenVPN.

Asus RT-AC68R Stock firmware: Route Both Ways

wingsfan87

Background:
Setting up a site to site VPN using 2 x Asus RT-AC68R routers. Stock firmware (not Merlin's AsusWRT). Firmware version is 9.0.0.4.380.2695 (latest). Client and server subnet do not overlap. I can access everything (windows shares, server router page by IP in browser, rdp, etc) just fine from the client -> server but not vice versa (server ->client) I know this issue has been posted with others but I'm not sure I quite understand how they were successful in getting it to work. Especially since I'm not using DDWRT or Merlin's AsusWRT firmware. This is the closest that I could find to my issue https://forums.openvpn.net/topic19572.html however I still do not understand how to set up the client config when there is no option for a client or server config on the server. Only Allowed Clients and a single box called Custom Configuration which I'm assuming is where the server config can go?

Details:
Router 1 = VPN Server:192.168.2.1 Netmask: 255.255.255.0 Subnet 192.168.2.0/24
Router 2 =VPN Client IP: 192.168.3.1 Netmask: 255.255.255.0 Subnet 192.168.3.0/24
VPN Subnet = 10.8.0.0

Advanced Settings:
Interface Type: TUN
Protocol: UDP
Server Port: 1194
Firewall: Auto
Authorization Mode: TLS
Username / Password Auth. Only: No
Extra HMAC authorization: Disable
VPN Subnet / Netmask: 10.8.0.0 255.255.255.0
Poll Interval: 0
Push LAN to clients: Yes
Direct clients to redirect Internet traffic: No
Respond to DNS: Yes
Advertise DNS to clients: No
Encryption cipher: AES-256-CBC
Compression: Adaptive
TLS Renegotiation Time: -1
Manage Client-Specific Options: Yes
Allow Client <-> Client: Yes
Allow only specified clients: No

Allowed Clients
Username: xxx IP Address: 192.168.3.0 Subnet Mask: 255.255.255.0 Push: Yes

Any ideas how to get it to route from the Server side of the LAN to the Client side of the LAN?

Additional Notes:
Another detail when the client connects to the server it shows in the Connection Status box on the client router a yellow exclamation with IP/Routing conflict but everything still works fine from the Client -> Server side.

Routing table from the server gui shows
Destination Gateway Genmask Flags Metric Ref Use Type Iface
xxxxxxxxxx(my personal IP) * 255.255.255.255 UH 0 0 0 WAN0 eth0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun21
192.168.3.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
192.168.2.0 * 255.255.255.0 U 0 0 0 LAN br0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
xxxxxxxxxx(my personal IP subnet) * 255.255.254.0 U 0 0 0 WAN0 eth0
default xxxxxxxxxx(my personal IP) 0.0.0.0 UG 0 0 0 WAN0 eth0

Routing table from the client gui shows
Destination Gateway Genmask Flags Metric Ref Use Type Iface
10.8.0.5 * 255.255.255.255 UH 0 0 0 tun15
xxxxxxxxxx(my personal IP) * 255.255.255.255 UH 0 0 0 WAN0 eth0
192.168.3.0 * 255.255.255.0 U 0 0 0 LAN br0
192.168.2.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun15
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun15
xxxxxxxxxx(my personal IP subnet) * 255.255.252.0 U 0 0 0 WAN0 eth0
default xxxxxxxxxx(my personal IP) 0.0.0.0 UG 0 0 0 WAN0 eth0

Traffic

wingsfan87 wroteI can access everything (windows shares, server router page by IP in browser, rdp, etc) just fine from the client -> server but not vice versa (server ->client)

This is the official HOWTO you need to read:
HOWTO: Expanding the scope of the VPN to include additional machines

Or you can opt for a simpler P2P mode --topology p2p which only allows for one client. (e.g your client router)

wingsfan87

Hi

Thank you for the quick reply. I did read that already before posting this. But the issue is I have no idea how to update the client config file on the VPN server. The VPN server is on a router not a PC so I don't have a directory I can access. Also I am using stock Asus firmware and not Merlin's so I don't have extra jiffs options etc.

Any additional help is much appreciated.

Traffic

wingsfan87 wroteSetting up a site to site VPN using 2 x Asus RT-AC68R routers. Stock firmware (not Merlin's AsusWRT).

According to the Asus Manual your router does not support OpenVPN.

wingsfan87

That makes no sense as its included in the GUI of the router a PPTP VPN and Open VPN server/client.

Traffic

OK .. It is not documented in the manual .. unless you have a link you can post or a screenshot ..

wingsfan87

See this link for what the GUI looks for the Open VPN client on the router https://torguard.net/knowledgebase.php?action=displayarticle&id=148

See this link for Manual for AC5300 that has same screens for RT-AC68 http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC5300/E10434_RT_AC5300_Manual.pdf?_ga=1.88286043.1503188828.1454457378

See section 4.5 for VPN server shows you the option for VPN including PPTP and OpenVPN.

And below for the advanced settings screen for Open VPN on the Asus Router

ekachaiz

wingsfan87 wroteHi

Thank you for the quick reply. I did read that already before posting this. But the issue is I have no idea how to update the client config file on the VPN server. The VPN server is on a router not a PC so I don't have a directory I can access. Also I am using stock Asus firmware and not Merlin's so I don't have extra jiffs options etc.

Any additional help is much appreciated.

you can access the openvpn directory in your router by using telnet or ssh

wingsfan87

Yeah I figured out how to get this working. See https://www.snbforums.com/threads/openvpn-server-cant-see-clients-lan-on-site-to-site-connection.24268/page-5#post-313576