DD-WRT Routing internet problem

Chebur

Apologize in advance if this is repetitive, but I couldn't find a working solutions to this in other posts.

I'm having issue browsing the internet after connecting to Open VPN. My set up is:

Primary router is Actiontec MI424WR set up with port forwarding of port 1194 to 192.168.1.2 and DMZ Zone of 192.168.1.2

192.168.1.2 is a Asus RT-N16 router running DD-WRT v24 sp2. It's configured as gateway with WAN port disabled, DCHP forwarding from 192.168.1.1; and no static routing defined in advanced rounding.

The Open VPN Server on DD-WRT is set up as follows:

push route 192.168.1.0 255.255.255.0
server 192.168.2.0 255.255.255.0
push redirect-gateway def1 
push dhcp-option DNS 8.8.8.8

cipher AES-256-CBC
comp-lzo

dev tun0
proto udp
port 1194

keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

My client is set up as follows:

client
dev tun
proto udp

remote XXXXX.dyndns.org 1194

resolv-retry infinite

nobind

persist-key
persist-tun

ca ca.crt
cert Client.crt
key Client.key

ns-cert-type server

cipher AES-256-CBC

comp-lzo

verb 5
;mute 20

With these settings I am able to establish a connection to the server, but then unable to browse the internet. tracert times out after reaching 192.168.2.1.

Please help...

TinCanTech

HOWTO: Routing all client traffic (including web-traffic) through the VPN

Chebur

Changing the server configuration to include iptables command:

push route 192.168.1.0 255.255.255.0
server 192.168.2.0 255.255.255.0
push redirect-gateway def1 
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE
push dhcp-option DNS 8.8.8.8

Bricks the router. What am I doing wrong?

SomeGuy

push route 192.168.1.0 255.255.255.0
server 192.168.2.0 255.255.255.0
push redirect-gateway def1
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE
push dhcp-option DNS 8.8.8.8

That is probably not a good idea. There is no openvpn config keyword (check man page) which uses "iptables" for direction.

It looks like you want this on the server. If you want that rule in the server,then check out what kind of support your OS has for keeping iptables rules persistent across reboots, and include your NAT rule in *that* config, not in the OpenVPN config. There are usually several options in each linux distro on managing your iptables rules, but they should all be separate from OpenVPN, and are outside of your server's openvpn config files.