Hello,
I am trying to setup an OpenVPN connection between my home and my office. I am currently using an OpenWRT router as the server (which is NOT the main router/gateway) on the office and an ASUS router flashed with the Merlin firmware as the client (this is the main router/gateway on my home).
I managed to connect the 2 of them successfully and I can ping the VPN IPs (10.8.0.1 and 10.8.0.2) from the routers. I can also ping the server LAN IP (10.168.0.99/24) from the client.
Problem1:
I can't ping any of the client's LAN IPs (192.168.1.0/24) from any of the office's machines (including the OpenVPN server itself). No matter what I've tried I wasn't able to do this, the client does not receive any packages when I try to monitor with tcpdump -i tun11.
Problem2:
I can only ping the server's LAN IP (10.168.0.99) from the client's LAN (excluding the client itself) if I enable "Create NAT on tunnel" in Asus' configuration but of course the server thinks the request is coming from 10.8.0.2 instead of the "real" LAN IP that I am pinging from. That would be fine for me but I have a SIP phone that doesn't work and I suspect the reason is NAT
Problem3:
This only started happening when I flashed OpenWRT, it was working fine with DD-WRT so I suspect it is a simpler problem. I can't reach any of the server's LAN machines (except the server itself) even if I have NAT enabled. I can see the packages reaching the OpenVPN server with tcpdump but I guess they are not forwarded to the LAN.
My configuration:
Server LAN: 10.168.0.0/24
Client LAN: 192.168.1.0/24
VPN subnet: 10.8.0.0/24
First of all I have a static route on the server side gateway to forward all requests to 10.8.0.0/24 and 192.168.1.0/24 to the OpenWRT router. I can see the packets reaching OpenWRT when I am trying to ping from the server's LAN to any of the client's (or VPN's) IPs.
Server conf (uci config file, I wasn't sure how to get the actual config but the settings are obvious):
config openvpn 'myvpn'
option enabled '1'
option verb '3'
option port '1194'
option proto 'udp'
option dev 'tun'
option server '10.8.0.0 255.255.255.0'
option keepalive '10 120'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/server.crt'
option key '/etc/openvpn/server.key'
option dh '/etc/openvpn/dh2048.pem'
option 'comp_lzo' 'no' # this will break the tunnel in chaos calmer
option 'fragment' '1472'
option 'topology' 'subnet'
option 'cipher' 'AES-256-CBC'
option 'auth' 'SHA256'
option 'client-config-dir' '/etc/openvpn/ccd/'
list 'route' '192.168.1.0 255.255.255.0'
list 'push' 'route 10.168.0.0 255.255.255.0'
list 'push' 'route 192.168.1.0 255.255.255.0'
option 'client-to-client' '1'
Server routes:
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.168.0.1 0.0.0.0 UG 0 0 0 br-lan
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
10.168.0.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.1.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
Client conf:
# Automatically generated configuration
daemon
client
dev tun11
proto udp
remote socrates.iktinosate.eu 1194
resolv-retry infinite
nobind
persist-key
persist-tun
compress
ncp-disable
cipher AES-256-CBC
auth SHA256
script-security 2
route-delay 2
route-up vpnrouting.sh
route-pre-down vpnrouting.sh
verb 3
ca ca.crt
cert client.crt
key client.key
verify-x509-name "WNDR3700" name
status-version 2
status status 10
# Custom Configuration
fragment 1472
comp-lzo no
Client routes:
Destination Gateway Genmask Flags Metric Ref Use Iface
82.28.204.1 * 255.255.255.255 UH 0 0 0 eth0
10.8.0.0 * 255.255.255.0 U 0 0 0 tun11
192.168.1.0 * 255.255.255.0 U 0 0 0 br0
10.168.0.0 10.8.0.1 255.255.255.0 UG 0 0 0 tun11
82.28.204.0 * 255.255.252.0 U 0 0 0 eth0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default cpc108441-cowc8 0.0.0.0 UG 0 0 0 eth0
Can you please help me with this? I am not sure what else I can do. I have tried disabling the firewalls on both sides but still get the same results
Thank you in advance!
