I'm trying to setup OpenVPN on my TP-Link 1043DN router. using Windows as VPN client (using tap). I have a lot of problems, and tried a lot of combinations :-( So maybe it would be a good idea to make sure my basic understanding of it all is corrent, so I made this diagram. Can anyone confirm this or give me corrections? [img]https://wiki.openwrt.org/_media/media/doc/howtos/openvpn_openwrt2.jpg[/img] ([i][url=https://wiki.openwrt.org/_media/media/doc/howtos/openvpn_openwrt2.jpg]Link[/url] to image. The [url=https://docs.google.com/drawings/d/1lIFSOmA8hHpGew_xdylErEl2plGHpXJ3ekK-WKDTtEA/edit?usp=sharing]diagram[/url] can be edited on Google drive, public access[/i]) [u]TAP/TUN Windows:[/u] This setup is not using bridging, neither on the router or the Windows client. It seems I cannot use a tun setup when using Windows clients as no tun device is available, right? Second, all the guides and documentation I've read only describes setups using bridging when using tap.....but you can just as well use the above setup (believe this is a routing setup, right) I don't need netbios etc. so I guess tun would have been preferable. [u]Firewall[/u] In regards to firewall rule 2 (data from OpenVPN-service to WAN)....I have no rule for this, but it seems to work fine anyway (my VPN client can connect).....is this NAT on the WAN zone that take care of this?

[quote="MrCLV"]The diagram can be edited on Google drive, public access[/quote]I would advise you remove your public IP. According to your apparent setup, it looks correct. [quote="MrCLV"]It seems I cannot use a tun setup when using Windows clients as no tun device is available, right?[/quote]Wrong .. The TAP Adapter is also the TUN Device. [quote="MrCLV"]This setup is not using bridging[/quote]I do not know how a TP-Link 1043DN router does it but on a normal installation using any common OS (Linux/Windows etc) your server must use a --[b]server-bridge[/b]. [quote="MrCLV"]Second, all the guides and documentation I've read only describes setups using bridging when using tap.....but you can just as well use the above setup (believe this is a routing setup, right)[/quote]The physical setup is as normal but if you want to use routing then --[b]dev tun[/b] is advisable. [quote="MrCLV"]it seems to work fine anyway (my VPN client can connect).....is this NAT on the WAN zone that take care of this?[/quote]No, your client is using --[b]dev tap[/b] and is given a local IP address (192.168.2.2) therefore it is seen as a local machine to your server LAN. You may find this helpful: [url=http://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html]Ethernet Bridging[/url] Otherwise you need to read this: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url] For your TP-Link Firewall, please see documentation from your router provider.

Oh....I also just found the [url=https://openvpn.net/index.php/open-source/documentation/install.html]installation notes[/url] for the windows TAP driver, and it surely do support TUN :-) The public IP is fake :D .....all the rest is real. I will now try to use TUN and not bridging. I don't think my router have any problems with that. I got it to work using TAB without bridging, at least in regards to the TAP adapter. I does bridge the LAN and WIFI (but that's another story) I just have trouble to set the [b]ifconfig[/b] option. 1: If I use "topology subnet" do I need to set the ifconfig? 2: If so how should it look like.....I don't quite understand the documentation in this regard (do I have to set a local and remote endpoint in both client and server config, and should they be the same? I mean every client will have a different IP (and is this IP the local or remote endpoint))? And in regards to data from the VPN-Service to WAN I forgot all output is of course accepted :oops: Thanks for your comments :-)

Okay..status is now this: -[color=#008000]VPN client PC can connect and ping the server TUN adapter (192.168.2.1) and router's LAN (192.168.1.1) -VPN client can SSH to router and connect to router webserver (192.168.1.1) :-)[/color] -[color=#FF0000]VPN client cannot ping the LAN Windows PC (192.168.1.112) (I can of cource ping the LAN PC from the router (console/rutty))[/color] -[color=#FF0000]VPN client cannot use DNS server on the router (e.g. "nslookup openvpn.net 192.168.1.1" I get a timeout)?[/color] Did I forgot something in regards to the firewall rules? When I write "all traffic" in the diagram it's actually all ports, protocol TCP/UDP and icmp If I can ping and connect to the router LAN (192.168.1.1) why not the LAN PC (192.168.1.[b]112[/b]) And DNS use "normal" UDP port 53 so it should also be covered by the rules.

You must ensure you have done this: [quote="TinCanTech"]Otherwise you need to read this: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url][/quote] All computers which are [u]not[/u] a client of the VPN [b]must[/b] have a route to the VPN and any other computers you want to contact.

OpenVPN server basic understanding

MrCLV

I'm trying to setup OpenVPN on my TP-Link 1043DN router. using Windows as VPN client (using tap).
I have a lot of problems, and tried a lot of combinations :-(
So maybe it would be a good idea to make sure my basic understanding of it all is corrent, so I made this diagram. Can anyone confirm this or give me corrections?

(Link to image. The diagram can be edited on Google drive, public access)

TAP/TUN Windows:
This setup is not using bridging, neither on the router or the Windows client.
It seems I cannot use a tun setup when using Windows clients as no tun device is available, right?
Second, all the guides and documentation I've read only describes setups using bridging when using tap.....but you can just as well use the above setup (believe this is a routing setup, right)
I don't need netbios etc. so I guess tun would have been preferable.

Firewall
In regards to firewall rule 2 (data from OpenVPN-service to WAN)....I have no rule for this, but it seems to work fine anyway (my VPN client can connect).....is this NAT on the WAN zone that take care of this?

TinCanTech

MrCLV wroteThe diagram can be edited on Google drive, public access

I would advise you remove your public IP.

According to your apparent setup, it looks correct.

MrCLV wroteIt seems I cannot use a tun setup when using Windows clients as no tun device is available, right?

Wrong .. The TAP Adapter is also the TUN Device.

MrCLV wroteThis setup is not using bridging

I do not know how a TP-Link 1043DN router does it but on a normal installation using any common OS (Linux/Windows etc) your server must use a --server-bridge.

MrCLV wroteSecond, all the guides and documentation I've read only describes setups using bridging when using tap.....but you can just as well use the above setup (believe this is a routing setup, right)

The physical setup is as normal but if you want to use routing then --dev tun is advisable.

MrCLV wroteit seems to work fine anyway (my VPN client can connect).....is this NAT on the WAN zone that take care of this?

No, your client is using --dev tap and is given a local IP address (192.168.2.2) therefore it is seen as a local machine to your server LAN.

You may find this helpful:
Ethernet Bridging

Otherwise you need to read this:
HOWTO: Expanding the scope of the VPN to include additional machines

For your TP-Link Firewall, please see documentation from your router provider.

MrCLV

Oh....I also just found the installation notes for the windows TAP driver, and it surely do support TUN :-)

The public IP is fake 😃 .....all the rest is real.

I will now try to use TUN and not bridging. I don't think my router have any problems with that. I got it to work using TAB without bridging, at least in regards to the TAP adapter. I does bridge the LAN and WIFI (but that's another story)
I just have trouble to set the ifconfig option.
1: If I use "topology subnet" do I need to set the ifconfig?
2: If so how should it look like.....I don't quite understand the documentation in this regard (do I have to set a local and remote endpoint in both client and server config, and should they be the same? I mean every client will have a different IP (and is this IP the local or remote endpoint))?

And in regards to data from the VPN-Service to WAN I forgot all output is of course accepted :oops:

Thanks for your comments :-)

MrCLV

Okay..status is now this:
-VPN client PC can connect and ping the server TUN adapter (192.168.2.1) and router's LAN (192.168.1.1)
-VPN client can SSH to router and connect to router webserver (192.168.1.1) :-)
-VPN client cannot ping the LAN Windows PC (192.168.1.112) (I can of cource ping the LAN PC from the router (console/rutty))
-VPN client cannot use DNS server on the router (e.g. "nslookup openvpn.net 192.168.1.1" I get a timeout)?

Did I forgot something in regards to the firewall rules?
When I write "all traffic" in the diagram it's actually all ports, protocol TCP/UDP and icmp
If I can ping and connect to the router LAN (192.168.1.1) why not the LAN PC (192.168.1.112)
And DNS use "normal" UDP port 53 so it should also be covered by the rules.

TinCanTech

You must ensure you have done this:

TinCanTech wroteOtherwise you need to read this:
HOWTO: Expanding the scope of the VPN to include additional machines

All computers which are not a client of the VPN must have a route to the VPN and any other computers you want to contact.