Hello guys,
I just started meddling with OpenVPN and with generous help from TinCanTech I managed to connect the client to the VPN.
My goal is to give the client access to the internet that is used by the VPN and after that to assign him a fixed IP (required for further use).
First things first : Access to VPN internet. I posted the setup below.
Client: Windows 7 | OpenVPN on DDWRT
With the following config files, the client connects and he receives an IP (10.8.0.2) and he can reach the Internet but through the Public IP2.
server 10.8.0.0 255.255.255.0
dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
remote Public IP1 1194
client
ns-cert-type server
dev tun0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
cipher AES-256-CBC
verb 6
mute 8
ip route show | grep default >> default via 192.168.10.1 dev br0
DDWRT IP routing table (Client is connected)
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 192.168.10.1 0.0.0.0 UG 0 0 0 br0
Client Route Table (Client is connected)
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.10.2 192.168.10.50 20
10.8.0.0 255.255.255.0 On-link 10.8.0.2 286
10.8.0.2 255.255.255.255 On-link 10.8.0.2 286
10.8.0.255 255.255.255.255 On-link 10.8.0.2 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.10.0 255.255.255.0 On-link 192.168.10.50 276
192.168.10.50 255.255.255.255 On-link 192.168.10.50 276
192.168.10.255 255.255.255.255 On-link 192.168.10.50 276
192.168.56.0 255.255.255.0 On-link 192.168.56.1 266
192.168.56.1 255.255.255.255 On-link 192.168.56.1 266
192.168.56.255 255.255.255.255 On-link 192.168.56.1 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.10.50 276
224.0.0.0 240.0.0.0 On-link 192.168.56.1 266
224.0.0.0 240.0.0.0 On-link 10.8.0.2 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.10.50 276
255.255.255.255 255.255.255.255 On-link 192.168.56.1 266
255.255.255.255 255.255.255.255 On-link 10.8.0.2 286
===========================================================================
TAP Adapter (Client is connected)
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-CE-21-AB-7C
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::98f4:8f73:dd41:a62a%22(Preferred)
IPv4 Address. . . . . . . . . . . : 10.8.0.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 13 octombrie 2016 14:20:43
Lease Expires . . . . . . . . . . : 13 octombrie 2017 14:20:42
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 10.8.0.254
DHCPv6 IAID . . . . . . . . . . . : 369164238
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-52-0E-50-E4-11-5B-2E-FE-E5
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
Current issue : I can't ping 10.8.0.1 (the VPN server) and I still have access to the internet through 3G Router2.
The ip forwarding is enabled and I added in the tun forwarding in the iptables.Client-side firewall is off.
cat /proc/sys/net/ipv4/ip_forward returns 1
iptables -I INPUT 1 -p udp -dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
Shouldn't at this point be able to ping 10.8.0.1 ? Is the missing gateway for the TAP Adapter the issue?
Is something misconfigured or missing ?
I would appreciate a hint if possible.
I tried all different configurations based on the HowTo guide, none worked so I am trying to take it step by step.
With ping to 10.8.0.1 still not possible and to spare another post of my writings, I pasted below what I did, regarding the gateway, thinking that it may fix the problem.
Client file remained the same;
server 10.8.0.0 255.255.255.0
push "redirect-gateway"
push "dhcp-option DNS 10.8.0.1"
dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
# management parameter allows DD-WRT OpenVPN Status web page to access the server's management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001
DDWRT IP routing table (Client is connected)
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 192.168.10.1 0.0.0.0 UG 0 0 0 br0
Client Route Table (Client is connected)
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.8.0.1 10.8.0.2 30
10.8.0.0 255.255.255.0 On-link 10.8.0.2 286
10.8.0.2 255.255.255.255 On-link 10.8.0.2 286
10.8.0.255 255.255.255.255 On-link 10.8.0.2 286
Public IP1 255.255.255.255 192.168.10.2 192.168.10.50 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.10.0 255.255.255.0 On-link 192.168.10.50 276
192.168.10.50 255.255.255.255 On-link 192.168.10.50 276
192.168.10.255 255.255.255.255 On-link 192.168.10.50 276
192.168.56.0 255.255.255.0 On-link 192.168.56.1 266
192.168.56.1 255.255.255.255 On-link 192.168.56.1 266
192.168.56.255 255.255.255.255 On-link 192.168.56.1 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.10.50 276
224.0.0.0 240.0.0.0 On-link 192.168.56.1 266
224.0.0.0 240.0.0.0 On-link 10.8.0.2 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.10.50 276
255.255.255.255 255.255.255.255 On-link 192.168.56.1 266
255.255.255.255 255.255.255.255 On-link 10.8.0.2 286
===========================================================================
TAP Adapter (Client is connected)
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-CE-21-AB-7C
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::98f4:8f73:dd41:a62a%22(Preferred)
IPv4 Address. . . . . . . . . . . : 10.8.0.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 13 octombrie 2016 14:41:24
Lease Expires . . . . . . . . . . : 13 octombrie 2017 14:41:24
Default Gateway . . . . . . . . . : 10.8.0.1
DHCP Server . . . . . . . . . . . : 10.8.0.254
DHCPv6 IAID . . . . . . . . . . . : 369164238
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-52-0E-50-E4-11-5B-2E-FE-E5
DNS Servers . . . . . . . . . . . : 10.8.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
iptables -I INPUT 1 -p udp -dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o br0 -j MASQUERADE
At this point, since the client points to 10.8.0.1 as gateway, I no longer have access to the internet provided by the 3GRouter1.
I would really like some hints regarding in which direction should I dig in order to give the client net from the VPN, cos I am a bit lost here.
