Hey guys,
so far I try to install an OpenVPN Server on DD-WRT v3.0-r31277 (latest build from Feb 2017) on an Asus RT-N18U.
So far I am able to connect to the server but I get always an MTU Error after I connected successfully. Also I am not able to route into in my internal network nor can I ping or reach the server.
Some useful background information
- - OpenVPN is running on my second 'firewall' (DMZ)
- first firewall forwards the port 1194 to the second firewall
- local adress OpenVPN Server 192.168.178.1, WAN adress is 10.255.0.2 but shouldn't be necessary
- OpenVPN net should be 172.31.0.0./24 and the server should have the 172.31.0.1
Thu Feb 16 08:57:44 2017 OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Dec 27 2016
Thu Feb 16 08:57:44 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Feb 16 08:57:44 2017 library versions: OpenSSL 1.0.2i 22 Sep 2016, LZO 2.09
Thu Feb 16 08:57:44 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Feb 16 08:57:44 2017 Need hold release from management interface, waiting...
Thu Feb 16 08:57:44 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Feb 16 08:57:44 2017 MANAGEMENT: CMD 'state on'
Thu Feb 16 08:57:44 2017 MANAGEMENT: CMD 'log all on'
Thu Feb 16 08:57:44 2017 MANAGEMENT: CMD 'hold off'
Thu Feb 16 08:57:44 2017 MANAGEMENT: CMD 'hold release'
Thu Feb 16 08:57:45 2017 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1300)
Thu Feb 16 08:57:45 2017 MANAGEMENT: >STATE:1487231865,RESOLVE,,,,,,
Thu Feb 16 08:57:45 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]XXXX:1194
Thu Feb 16 08:57:45 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Feb 16 08:57:45 2017 UDP link local: (not bound)
Thu Feb 16 08:57:45 2017 UDP link remote: [AF_INET]XXXX:1194
Thu Feb 16 08:57:45 2017 MANAGEMENT: >STATE:1487231865,WAIT,,,,,,
Thu Feb 16 08:57:45 2017 MANAGEMENT: >STATE:1487231865,AUTH,,,,,,
Thu Feb 16 08:57:45 2017 TLS: Initial packet from [AF_INET]XXXX:1194, sid=0a9b34a9 e34efb83
Thu Feb 16 08:57:45 2017 VERIFY OK: depth=1, XXX
Thu Feb 16 08:57:45 2017 Validating certificate key usage
Thu Feb 16 08:57:45 2017 ++ Certificate has key usage 00a0, expects 00a0
Thu Feb 16 08:57:45 2017 VERIFY KU OK
Thu Feb 16 08:57:45 2017 Validating certificate extended key usage
Thu Feb 16 08:57:45 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 16 08:57:45 2017 VERIFY EKU OK
Thu Feb 16 08:57:45 2017 VERIFY OK: depth=0, XXX
Thu Feb 16 08:57:45 2017 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1369', remote='link-mtu 1370'
Thu Feb 16 08:57:45 2017 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Thu Feb 16 08:57:45 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES128-SHA, 2048 bit RSA
Thu Feb 16 08:57:45 2017 [just-insane.com] Peer Connection Initiated with [AF_INET]XXX:1194
Thu Feb 16 08:57:46 2017 MANAGEMENT: >STATE:1487231866,GET_CONFIG,,,,,,
Thu Feb 16 08:57:46 2017 SENT CONTROL [XXX]: 'PUSH_REQUEST' (status=1)
Thu Feb 16 08:57:46 2017 PUSH: Received control message: 'PUSH_REPLY,route 172.31.0.0 255.255.255.0,route-gateway 172.31.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.31.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 16 08:57:46 2017 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 16 08:57:46 2017 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 16 08:57:46 2017 OPTIONS IMPORT: route options modified
Thu Feb 16 08:57:46 2017 OPTIONS IMPORT: route-related options modified
Thu Feb 16 08:57:46 2017 OPTIONS IMPORT: peer-id set
Thu Feb 16 08:57:46 2017 OPTIONS IMPORT: adjusting link_mtu to 1424
Thu Feb 16 08:57:46 2017 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 16 08:57:46 2017 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 16 08:57:46 2017 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 16 08:57:46 2017 interactive service msg_channel=596
Thu Feb 16 08:57:46 2017 ROUTE_GATEWAY 10.100.0.1/255.255.0.0 I=7 HWADDR=XXX
Thu Feb 16 08:57:46 2017 open_tun
Thu Feb 16 08:57:46 2017 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{56DC2E6B-076E-4141-A264-66361E8605D1}.tap
Thu Feb 16 08:57:46 2017 TAP-Windows Driver Version 9.21
Thu Feb 16 08:57:46 2017 Set TAP-Windows TUN subnet mode network/local/netmask = 172.31.0.0/172.31.0.2/255.255.255.0 [SUCCEEDED]
Thu Feb 16 08:57:46 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.31.0.2/255.255.255.0 on interface {56DC2E6B-076E-4141-A264-66361E8605D1} [DHCP-serv: 172.31.0.254, lease-time: 31536000]
Thu Feb 16 08:57:46 2017 Successful ARP Flush on interface [10] {56DC2E6B-076E-4141-A264-66361E8605D1}
Thu Feb 16 08:57:46 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Feb 16 08:57:46 2017 MANAGEMENT: >STATE:1487231866,ASSIGN_IP,,172.31.0.2,,,,
Thu Feb 16 08:57:51 2017 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Thu Feb 16 08:57:51 2017 MANAGEMENT: >STATE:1487231871,ADD_ROUTES,,,,,,
Thu Feb 16 08:57:51 2017 C:\Windows\system32\route.exe ADD 172.31.0.0 MASK 255.255.255.0 172.31.0.1
Thu Feb 16 08:57:51 2017 Route addition via service succeeded
Thu Feb 16 08:57:51 2017 Initialization Sequence Completed
Thu Feb 16 08:57:51 2017 MANAGEMENT: >STATE:1487231871,CONNECTED,SUCCESS,172.31.0.2,XXX,1194,,
Thu Feb 16 08:58:07 2017 write to TUN/TAP : Der an einen Systemaufruf übergebene Datenbereich ist zu klein. (code=122)
This is my server config
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 1194
proto udp4
cipher aes-256-cbc
auth sha256
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /tmp/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA
fast-io
tun-mtu 1300
mtu-disc yes
server 172.31.0.0 255.255.255.0
dev tun2
push "route 172.31.0.0 255.255.255.0"
Client-Config
client
dev tun
proto udp
remote XXX 1194
resolv-retry infinite
nobind
tun-mtu 1300
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client1.crt"
key "C:\\Program Files\\OpenVPN\\config\\client1.key"
remote-cert-tls server
#tls-auth ta.key 1
auth SHA256
cipher AES-256-CBC
verb 3
I have some basic knowledge about networking and vpn but I have no idea about OpenVPN configs and I am not sure what I did wrong. I followed alot of guides (mainly for DD-WRT routers) but I am kinda missing a point. I would appreciate any help.
Edit: I am sorry about the messed up formatting, not sure how to fix it.
