[Solved] Install issues | OpenVPN with DD-WRT

Coada

Hello guys,

As a total beginner, I decided to try and install a VPN using OpenVPN, a router with 3G Internet and a router (Linksys E2500) with DD-WRT installed.
As expected, when I tried to establish a connection I had a few errors, rendering the connection unusable.
Before mentioning what errors I am getting I would like to describe the setup and the steps that I followed. There is a high chance that I did something wrong during the setup.

Setup :

External IP was replaced with xxx.xxx.xxx.xxx
3G router | External IP : xxx.xxx.xxx.xxx | Local IP Address : 192.168.10.1 | Subnet Mask : 255.255.255.0
DDWRT router | External IP : Same as above | Local IP Address : 192.168.10.99 | Subnet Mask : 255.255.255.0 | Gateaway : 192.168.10.1

The DD-WRT is linked with the 3G Internet router through an Ethernet cable, so the access to the VPN server (on the DD-WRT) will be done through the 3G router.
I started with installing OpenVPN (v 2.1.4 with easy-rsa built in) and I generated the keys ( the certificate authority and key, the server key and certificate, the client key and certificate, diffie hellman parameters). Everything went smooth here.
Now the "fun" part began.

I started by adding a port forwarding to the 3G router for port 1194 (UDP connection) corresponding to the DDWRT IP ( 192.168.10.99).
Then I went to the DDWRT menu (Services >> VPN) and started configuring the server.
Here I found confusing information on what option "Start type" and "Config as" should be.
In the end, I went with "Start type" = WAN up and "Config as" = Server.
I copied the certificates and keys required (just the part between --Begin CERTIFICATE-- and ---END CERTIFICATE--) and all that was left was to add the config details and set a few others parameters.
For the "Public Server Cert" I used the server.cert.
For the "CA Cert" I used the ca.crt.
For the "Private Server Key" I used the server.key.
For the "DH PEM" I used the dh1024.pem.
Then I added rules to the DDWRT's firewall.
After, I moved to config the client file.
All the files are attached below.

#
push "route 192.168.10.1 255.255.255.0"
server xxx.xxx.xxx.xxx 255.255.255.0

dev tun0
proto udp
keepalive 10 120
comp-lzo
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

# Only use crl-verify if you are using the revoke list - otherwise leave it commented out
# crl-verify /tmp/openvpn/ca.crl

# management parameter allows DD-WRT OpenVPN Status web page to access the server\s management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001 iptables -I INPUT 1 -p udp -dport 1194 -j ACCEPT
iptables -I FORWARD 1 -source 192.168.10.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT #
remote xxx.xxx.xxx.xxx 1194
client
remote-cert-tls server
dev tun0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
comp-lzo
verb 4 Please let me know if other files/logs are required.

The errors that I get when I try to connect to the VPN:
Connection log 1194 UDP#

Thu Oct 06 15:51:40 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct  3 2016
Thu Oct 06 15:51:40 2016 Windows version 6.1 (Windows 7) 64bit
Thu Oct 06 15:51:40 2016 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Thu Oct 06 15:51:40 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Oct 06 15:51:40 2016 Need hold release from management interface, waiting...
Thu Oct 06 15:51:40 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Oct 06 15:51:40 2016 MANAGEMENT: CMD 'state on'
Thu Oct 06 15:51:40 2016 MANAGEMENT: CMD 'log all on'
Thu Oct 06 15:51:40 2016 MANAGEMENT: CMD 'hold off'
Thu Oct 06 15:51:40 2016 MANAGEMENT: CMD 'hold release'
Thu Oct 06 15:51:41 2016 LZO compression initialized
Thu Oct 06 15:51:41 2016 Control Channel MTU parms [ L:1558 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Oct 06 15:51:41 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Oct 06 15:51:41 2016 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Oct 06 15:51:41 2016 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Oct 06 15:51:41 2016 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Oct 06 15:51:41 2016 Local Options hash (VER=V4): '22188c5b'
Thu Oct 06 15:51:41 2016 Expected Remote Options hash (VER=V4): 'a8f55717'
Thu Oct 06 15:51:41 2016 UDPv4 link local: [undef]
Thu Oct 06 15:51:41 2016 UDPv4 link remote: [AF_INET]xxx.xxx.xxxx.xxx:1194
Thu Oct 06 15:51:41 2016 MANAGEMENT: >STATE:1475758301,WAIT,,,
Thu Oct 06 15:52:41 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Oct 06 15:52:41 2016 TLS Error: TLS handshake failed
Thu Oct 06 15:52:41 2016 TCP/UDP: Closing socket
Thu Oct 06 15:52:41 2016 SIGUSR1[soft,tls-error] received, process restarting
Thu Oct 06 15:52:41 2016 MANAGEMENT: >STATE:1475758361,RECONNECTING,tls-error,,
Thu Oct 06 15:52:41 2016 Restart pause, 2 second(s)

I am a bit baffled at this point since I don't know what else to change or if the setup was correct, especially regarding the IPs.
I thought that even if the port forwarding is done, maybe the 1194 port is still closed so I did a check with nmap and it was closed.
I tried using port 80 which was shown open by nmap, on both UDP and tcp. I got the following messages.
Connection log Port 80 TCP#

Thu Oct 06 16:09:21 2016 us=660980 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct  3 2016
Thu Oct 06 16:09:21 2016 us=660980 Windows version 6.1 (Windows 7) 64bit
Thu Oct 06 16:09:21 2016 us=660980 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Enter Management Password:
Thu Oct 06 16:09:21 2016 us=660980 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Oct 06 16:09:21 2016 us=660980 Need hold release from management interface, waiting...
Thu Oct 06 16:09:22 2016 us=144580 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Oct 06 16:09:22 2016 us=253781 MANAGEMENT: CMD 'state on'
Thu Oct 06 16:09:22 2016 us=253781 MANAGEMENT: CMD 'log all on'
Thu Oct 06 16:09:22 2016 us=347381 MANAGEMENT: CMD 'hold off'
Thu Oct 06 16:09:22 2016 us=347381 MANAGEMENT: CMD 'hold release'
Thu Oct 06 16:09:22 2016 us=721781 LZO compression initialized
Thu Oct 06 16:09:22 2016 us=721781 Control Channel MTU parms [ L:1560 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Thu Oct 06 16:09:22 2016 us=721781 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Oct 06 16:09:22 2016 us=721781 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Oct 06 16:09:22 2016 us=721781 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Oct 06 16:09:22 2016 us=721781 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Oct 06 16:09:22 2016 us=721781 Local Options hash (VER=V4): '958c5492'
Thu Oct 06 16:09:22 2016 us=721781 Expected Remote Options hash (VER=V4): '79ef4284'
Thu Oct 06 16:09:22 2016 us=721781 Attempting to establish TCP connection with [AF_INET]xxx.xxx.xxx.xxx:80 [nonblock]
Thu Oct 06 16:09:22 2016 us=721781 MANAGEMENT: >STATE:1475759362,TCP_CONNECT,,,
Thu Oct 06 16:09:23 2016 us=735783 TCP connection established with [AF_INET]xxx.xxx.xxxx.xxx:80
Thu Oct 06 16:09:23 2016 us=735783 TCPv4_CLIENT link local: [undef]
Thu Oct 06 16:09:23 2016 us=735783 TCPv4_CLIENT link remote: [AF_INET]xxx.xxx.xxx.xxx:80
Thu Oct 06 16:09:23 2016 us=735783 MANAGEMENT: >STATE:1475759363,WAIT,,,
Thu Oct 06 16:09:23 2016 us=813783 WARNING: Bad encapsulated packet length from peer (18516), which must be > 0 and <= 1563 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Thu Oct 06 16:09:23 2016 us=813783 Connection reset, restarting [0]
Thu Oct 06 16:09:23 2016 us=813783 TCP/UDP: Closing socket
Thu Oct 06 16:09:23 2016 us=813783 SIGUSR1[soft,connection-reset] received, process restarting
Thu Oct 06 16:09:23 2016 us=813783 MANAGEMENT: >STATE:1475759363,RECONNECTING,connection-reset,,
Thu Oct 06 16:09:23 2016 us=813783 Restart pause, 5 second(s)[/oconf]
[oconf=Connection log Port 80 UDP]#
Thu Oct 06 16:10:47 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct  3 2016
Thu Oct 06 16:10:47 2016 Windows version 6.1 (Windows 7) 64bit
Thu Oct 06 16:10:47 2016 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Thu Oct 06 16:10:47 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Oct 06 16:10:47 2016 Need hold release from management interface, waiting...
Thu Oct 06 16:10:47 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Oct 06 16:10:47 2016 MANAGEMENT: CMD 'state on'
Thu Oct 06 16:10:47 2016 MANAGEMENT: CMD 'log all on'
Thu Oct 06 16:10:47 2016 MANAGEMENT: CMD 'hold off'
Thu Oct 06 16:10:47 2016 MANAGEMENT: CMD 'hold release'
Thu Oct 06 16:10:48 2016 LZO compression initialized
Thu Oct 06 16:10:48 2016 Control Channel MTU parms [ L:1558 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Oct 06 16:10:48 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Oct 06 16:10:48 2016 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Oct 06 16:10:48 2016 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Oct 06 16:10:48 2016 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Oct 06 16:10:48 2016 Local Options hash (VER=V4): '22188c5b'
Thu Oct 06 16:10:48 2016 Expected Remote Options hash (VER=V4): 'a8f55717'
Thu Oct 06 16:10:48 2016 UDPv4 link local: [undef]
Thu Oct 06 16:10:48 2016 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:80
Thu Oct 06 16:10:48 2016 MANAGEMENT: >STATE:1475759448,WAIT,,,
Thu Oct 06 16:10:48 2016 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

** In the upcoming days, I will also try with another router instead of the 3G one, to see if something changes.
As mentioned above, please let me know if additions files/logs are required. I hope I didn't miss a thing.
Any advice or hints on what the issues may be ?

TinCanTech

Coada wrote3G router | External IP : xxx.xxx.xxx.xxx | Local IP Address : 192.168.10.1 | Subnet Mask : 255.255.255.0
DDWRT router | External IP : Same as above | Local IP Address : 192.168.10.99 | Subnet Mask : 255.255.255.0 | Gateaway : 192.168.10.1

Both devices cannot have the ISP assigned Real Internet address at the same time. Your DDWRT is probably behind your 3G router but you must make sure what is where and if the cables are in fact in the correct ports.

Coada

The DDWRT router is behind the 3g router. The 3g router has the DHCP server and the DDWRT have the DHCP server deactivated. We used to have this router in the past working as PPTP VPN server and now we want to use it with OPENVPN. The port is correctly forwarded to the ddwrt from the 3g router.
However we don't realize what could be the issue.
Any advice where to dig or how to make a deep analysis is welcome :-)

TinCanTech

Coada wroteAll the files are attached below.
Image

This image (your original post) OpenVPN Server Daemon, where it says

Network: | xxx.xxx.xxx.xxx | External IP given by the 3G Router

This is incorrect, your network should be a unique and currently unused subnet,
the default of which is 10.8.0.0/24

IE:server 10.8.0.0 255.255.255.0

Coada

First of all, thx for stopping bye and providing the much needed help. I forgot to mentioned it earlier.
Also, sorry for the delay in answering; I was caught with some other problems.

I will be honest, I don't know or I am not sure exactly of what do you mean when u are saying unused subnet.
I decided to draw a sketch of the setup with some ip examples and my current understanding.
I would really enjoy identifying the root cause so I can start digging more specifically.

The External IP (public IP) is the same for both since the DDWRT is behind the 3G. So I can't change it.
The numbers aren't real but the structure is identical. I wanted you to see it.

Guideline from the "HowTo" post : "If you want to use a virtual IP address range other than 10.8.0.0/24, you should modify the server directive. Remember that this virtual IP address range should be a private range which is currently unused on your network."
In my understanding and considering the guideline plus what you said about the unused subnet the NETWORK parameter that has to be set in the DDWRT and also represent the server should be 192.168.10.99. Am I right or miles away ?
If I'm right, how would the client know where to connect since the NETWORK/SERVER would be a subnet ?
Shouldn't the public IP, be the address of the server written in the client and server config file ?

Coada

My subnet is in the form of 192.168.xxx.xxx
That's why I asked about setting the network/server to 192.168.10.99

TinCanTech

Coada wroteIn my understanding and considering the guideline plus what you said about the unused subnet the NETWORK parameter that has to be set in the DDWRT and also represent the server should be 192.168.10.99. Am I right or miles away ?

No, you are wrong .. The --server parameter is for the VPN subnet. Just try 10.8.0.0 in that field and carry on from there.

Coada

It worked. The client connected and he received an IP. Many thanks !

TinCanTech

Good news and thanks for letting us know the solution 8-)