Hi guys,
I am struggling on getting a proper OpenVPN to run on bridge mode (tap). My goal is to be able to stream DLNA to another house which I own (layer 2 tunneling). The settings would be the following.
When I try to connect to the server from the client, it seems to succeed, but I cannot ping, nor navigate through the VPN (ip check shows local IP).
SERVER (running on router)
Model: Asus AC1200G+, with stock firmware (3.0.0.4.380_3971), installed on USB drive Entware and OpenVPN. Up and running so far.
Router IP: 192.168.143.1 /255.255.255.0
DHCP Range: 192.168.143.1-192.168.143.199 -> I want these to be accesible from the WAN
Allocated for OpenVPN in bridge mode 192.168.143.200 -192.168.143.250
I have ipv4 forwarding enabled, and configured the ports to be reachable.
Port Forwarding
Destination Proto. Port range Redirect to Local port
ALL TCP 8443 192.168.143.1 8443
ALL TCP 1194 192.168.143.1 1194
ALL UDP 1194 192.168.143.1 1194
Routing table
Destination Gateway Genmask Flags Metric Ref Use Type Iface
192.168.144.1 * 255.255.255.255 UH 0 0 0 WAN0 ppp0
XXX.AAA.BBB.C 10.23.0.1 255.255.255.224 UG 4 0 0 vlan3
192.168.143.0 * 255.255.255.0 U 0 0 0 LAN br0
10.23.0.0 * 255.255.192.0 U 0 0 0 vlan3
169.254.0.0 * 255.255.0.0 U 0 0 0 MAN0 vlan6
default 192.168.144.1 0.0.0.0 UG 0 0 0 WAN0 ppp0
SERVER CONF
port 1194
tun-mtu 1420
mssfix 1380
proto tcp
dev tap0
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server-bridge 192.168.143.1 255.255.255.0 192.168.143.200 192.168.143.250
push "route 192.168.143.0 255.255.255.0"
push "redirect-gateway local def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
;push "route 0.0.0.0 255.255.255.0 default_gateway"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC #AES 256bit cipher
comp-lzo
max-clients 5
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3
SERVER LOG
Wed Nov 30 23:31:21 2016 OpenVPN 2.3.11 arm-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6]
Wed Nov 30 23:31:21 2016 library versions: OpenSSL 1.0.2j 26 Sep 2016, LZO 2.09
Wed Nov 30 23:31:22 2016 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Wed Nov 30 23:31:22 2016 Diffie-Hellman initialized with 2048 bit key
Wed Nov 30 23:31:22 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Nov 30 23:31:22 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 30 23:31:22 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 30 23:31:22 2016 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1420)
Wed Nov 30 23:31:22 2016 Socket Buffers: R=[87380->87380] S=[16384->16384]
Wed Nov 30 23:31:22 2016 TUN/TAP device tap0 opened
Wed Nov 30 23:31:22 2016 TUN/TAP TX queue length set to 100
Wed Nov 30 23:31:22 2016 Listening for incoming TCP connection on [undef]
Wed Nov 30 23:31:22 2016 TCPv4_SERVER link local (bound): [undef]
Wed Nov 30 23:31:22 2016 TCPv4_SERVER link remote: [undef]
Wed Nov 30 23:31:22 2016 MULTI: multi_init called, r=256 v=256
Wed Nov 30 23:31:22 2016 IFCONFIG POOL: base=192.168.143.200 size=51, ipv6=0
Wed Nov 30 23:31:22 2016 MULTI: TCP INIT maxclients=5 maxevents=9
Wed Nov 30 23:31:22 2016 Initialization Sequence Completed
Wed Nov 30 23:31:27 2016 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1420)
Wed Nov 30 23:31:27 2016 TCP connection established with [AF_INET]11.222.222.11:59655
Wed Nov 30 23:31:28 2016 11.222.222.11:59655 TLS: Initial packet from [AF_INET]11.222.222.11:59655, sid=fa4db39f 67529fa3
Wed Nov 30 23:31:28 2016 11.222.222.11:59655 VERIFY OK: blablabla
Wed Nov 30 23:31:28 2016 11.222.222.11:59655 VERIFY OK: blablabla
Wed Nov 30 23:31:29 2016 11.222.222.11:59655 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Nov 30 23:31:29 2016 11.222.222.11:59655 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 30 23:31:29 2016 11.222.222.11:59655 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Nov 30 23:31:29 2016 11.222.222.11:59655 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 30 23:31:29 2016 11.222.222.11:59655 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Nov 30 23:31:29 2016 11.222.222.11:59655 [client] Peer Connection Initiated with [AF_INET]11.222.222.11:59655
Wed Nov 30 23:31:29 2016 client/11.222.222.11:59655 MULTI_sva: pool returned IPv4=192.168.143.200, IPv6=(Not enabled)
Wed Nov 30 23:31:30 2016 client/11.222.222.11:59655 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov 30 23:31:30 2016 client/11.222.222.11:59655 send_push_reply(): safe_cap=940
Wed Nov 30 23:31:30 2016 client/11.222.222.11:59655 SENT CONTROL [client]: 'PUSH_REPLY,route 192.168.143.0 255.255.255.0,redirect-gateway local def1 bypass-dhcp,route-gateway 192.168.143.1,ping 10,ping-restart 120,ifconfig 192.168.143.200 255.255.255.0' (status=1)
Wed Nov 30 23:31:30 2016 client/11.222.222.11:59655 MULTI: Learn: 00:ff:b5:11:79:cc -> client/11.222.222.11:59655
CLIENT (running on laptop)
Model: ASUS K52JK, Windows 10 x64, Firewall Disabled, TAP Device v9
IP range on local network : 192.168.1.3 / 255.255.255.0
CLIENT CONF
client
dev tap
dev-node TAP-Win
proto tcp
tun-mtu 1420
mssfix 1380
remote my.remote.me 1194
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
cipher AES-256-CBC #AES 256bit cipher
comp-lzo
verb 3
CLIENT LOG
Thu Dec 01 00:31:32 2016 TCP connection established with [AF_INET]222.11.11.222:1194
Thu Dec 01 00:31:32 2016 TCP_CLIENT link local: (not bound)
Thu Dec 01 00:31:32 2016 TCP_CLIENT link remote: [AF_INET]222.11.11.222:1194
Thu Dec 01 00:31:32 2016 MANAGEMENT: >STATE:1480548692,WAIT,,,,,,
Thu Dec 01 00:31:32 2016 MANAGEMENT: >STATE:1480548692,AUTH,,,,,,
Thu Dec 01 00:31:32 2016 TLS: Initial packet from [AF_INET]222.11.11.222:1194, sid=00ecb54b 2b779338
Thu Dec 01 00:31:32 2016 VERIFY OK: blablabla
Thu Dec 01 00:31:32 2016 VERIFY OK: blablabla
Thu Dec 01 00:31:32 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Dec 01 00:31:32 2016 [server] Peer Connection Initiated with [AF_INET]222.11.11.222:1194
Thu Dec 01 00:31:33 2016 MANAGEMENT: >STATE:1480548693,GET_CONFIG,,,,,,
Thu Dec 01 00:31:33 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Dec 01 00:31:33 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.143.0 255.255.255.0,redirect-gateway local def1 bypass-dhcp,route-gateway 192.168.143.1,ping 10,ping-restart 120,ifconfig 192.168.143.200 255.255.255.0'
Thu Dec 01 00:31:33 2016 OPTIONS IMPORT: timers and/or timeouts modified
Thu Dec 01 00:31:33 2016 OPTIONS IMPORT: --ifconfig/up options modified
Thu Dec 01 00:31:33 2016 OPTIONS IMPORT: route options modified
Thu Dec 01 00:31:33 2016 OPTIONS IMPORT: route-related options modified
Thu Dec 01 00:31:33 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Dec 01 00:31:33 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 01 00:31:33 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Dec 01 00:31:33 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 01 00:31:33 2016 interactive service msg_channel=0
Thu Dec 01 00:31:33 2016 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=21 HWADDR=1c:4b:d6:8b:5e:e7
Thu Dec 01 00:31:33 2016 open_tun
Thu Dec 01 00:31:33 2016 TAP-WIN32 device [TAP-Win] opened: \\.\Global\{B51179CC-E4FC-433E-8932-688B41B88026}.tap
Thu Dec 01 00:31:33 2016 TAP-Windows Driver Version 9.21
Thu Dec 01 00:31:33 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.143.200/255.255.255.0 on interface {B51179CC-E4FC-433E-8932-688B41B88026} [DHCP-serv: 192.168.143.0, lease-time: 31536000]
Thu Dec 01 00:31:33 2016 Successful ARP Flush on interface [17] {B51179CC-E4FC-433E-8932-688B41B88026}
Thu Dec 01 00:31:33 2016 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Dec 01 00:31:33 2016 MANAGEMENT: >STATE:1480548693,ASSIGN_IP,,192.168.143.200,,,,
Thu Dec 01 00:31:38 2016 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Thu Dec 01 00:31:38 2016 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.143.1
Thu Dec 01 00:31:38 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Thu Dec 01 00:31:38 2016 Route addition via IPAPI succeeded [adaptive]
Thu Dec 01 00:31:38 2016 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.143.1
Thu Dec 01 00:31:38 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Thu Dec 01 00:31:38 2016 Route addition via IPAPI succeeded [adaptive]
Thu Dec 01 00:31:38 2016 MANAGEMENT: >STATE:1480548698,ADD_ROUTES,,,,,,
Thu Dec 01 00:31:38 2016 C:\WINDOWS\system32\route.exe ADD 192.168.143.0 MASK 255.255.255.0 192.168.143.1
Thu Dec 01 00:31:38 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Thu Dec 01 00:31:38 2016 Route addition via IPAPI succeeded [adaptive]
Thu Dec 01 00:31:38 2016 Initialization Sequence Completed
Thu Dec 01 00:31:38 2016 MANAGEMENT: >STATE:1480548698,CONNECTED,SUCCESS,192.168.143.200,222.11.11.222,1194,192.168.1.4,59655
Any hints would be much appreciated. Thank you beforehand.
Imanol Landa
