Hi all, cross post between lede forum and openvpn form, I'm having a likely routing issue with openvpn/openwrt Server is openvpn 2.4.5 on OpenWrt 18.06-SNAPSHOT r6984-fa0275bd90 on a netgear r7800. Clients are android 7.1.2 and android 8, openvpn connect 3.0.5(1816) though both clients have the same config file (except the keys) and exact same errors and problem. Config files below [oconf=etc-config-firewall, using - as forward slash not allowed in ovpn config code] config zone option name 'vpnserver' option network 'vpnserver' option input 'ACCEPT' option output 'ACCEPT' option masq '1' option forward 'ACCEPT' config zone option name 'lan' list network 'lan' option input 'ACCEPT' option output 'ACCEPT' option forward 'ACCEPT' config zone option name 'wan' list network 'wan' list network 'wan6' option input 'REJECT' option output 'ACCEPT' option forward 'REJECT' option masq '1' option mtu_fix '1' config forwarding option src 'lan' option dest 'wan' option forward 'ACCEPT' config redirect option target 'DNAT' option src 'wan' option src_dport '443' option dest_ip '192.168.1.1' option dest_port '443' option name 'vpn' option proto 'udp' option dest 'lan' config forwarding option dest 'lan' option src 'vpnserver' config forwarding option dest 'wan' option src 'vpnserver' config fowarding option dest 'vpnserver' option src 'lan' [/oconf] [oconf=etc-config-network - to set the interface] config interface 'vpnserver' option proto 'none' option auto '1' option ifname 'tun0' [/oconf] [oconf=etc-openvpn-openvpn.conf - the server config] port 443 proto udp4 dev tun0 server 192.168.5.0 255.255.255.0 push "redirect-gateway def1" client-to-client push "dhcp-option DNS 192.168.1.1" compress keepalive 10 60 log /tmp/log/openvpn.log verb 7 # for now... user nobody group nogroup persist-key persist-tun # crypto settings cipher AES-256-GCM auth SHA512 tls-version-min 1.2 tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 [/oconf] [oconf=android client config] remote 192.168.1.1 443 client remote-cert-tls server dev tun0 resolv-retry infinite nobind persist-key persist-tun float compress tls-version-min 1.2 tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 cipher AES-256-GCM auth SHA512 [/oconf] The clients can connect to the VPN server/router but can't ping anything or surf the web. I've enabled ip forwarding, tweaked the /etc/config/firewall and interfaces, but the devices still can't connect or reachout once on the VPN, though when they're not on they are fine. I've read through several tutorials, and specfically https://openwrt.org/docs/guide-user/services/vpn/openvpn/server.setup. Any suggestions - thanks!

openvpn on openwrt connects but no ping

[deleted]

Hi all, cross post between lede forum and openvpn form, I'm having a likely routing issue with openvpn/openwrt

Server is openvpn 2.4.5 on OpenWrt 18.06-SNAPSHOT r6984-fa0275bd90 on a netgear r7800.
Clients are android 7.1.2 and android 8, openvpn connect 3.0.5(1816) though both clients have the same config file (except the keys) and exact same errors and problem.

Config files below

config zone
option name 'vpnserver'
option network 'vpnserver'
option input 'ACCEPT'
option output 'ACCEPT'
option masq '1'
option forward 'ACCEPT'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'
option forward 'ACCEPT'

config redirect
option target 'DNAT'
option src 'wan'
option src_dport '443'
option dest_ip '192.168.1.1'
option dest_port '443'
option name 'vpn'
option proto 'udp'
option dest 'lan'

config forwarding
option dest 'lan'
option src 'vpnserver'

config forwarding
option dest 'wan'
option src 'vpnserver'

config fowarding
option dest 'vpnserver'
option src 'lan'

config interface 'vpnserver'
option proto 'none'
option auto '1'
option ifname 'tun0'

port 443
proto udp4
dev tun0
server 192.168.5.0 255.255.255.0
push "redirect-gateway def1"
client-to-client
push "dhcp-option DNS 192.168.1.1"
compress
keepalive 10 60
log /tmp/log/openvpn.log
verb 7 # for now...
user nobody
group nogroup
persist-key
persist-tun
# crypto settings
cipher AES-256-GCM
auth SHA512
tls-version-min 1.2
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
<inlined certs & keys>

remote 192.168.1.1 443
client
remote-cert-tls server
dev tun0
resolv-retry infinite
nobind
persist-key
persist-tun
float
compress
tls-version-min 1.2
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
cipher AES-256-GCM
auth SHA512
<inlined certs & keys>

The clients can connect to the VPN server/router but can't ping anything or surf the web. I've enabled ip forwarding, tweaked the /etc/config/firewall and interfaces, but the devices still can't connect or reachout once on the VPN, though when they're not on they are fine. I've read through several tutorials, and specfically https://openwrt.org/docs/guide-user/services/vpn/openvpn/server.setup.

Any suggestions - thanks!

TinCanTech

See your logs at verb 4

[deleted]

openvpn.log at verb 4, both server inializing (after a restart) and the device (not actually a nexus9 anymore but still an android) connecting. It connects, but still doesn't ping or surf the net.

Mon May 28 09:58:35 2018 us=516366 OpenVPN 2.4.5 arm-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Mon May 28 09:58:35 2018 us=516560 library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
Mon May 28 09:58:35 2018 us=518465 Diffie-Hellman initialized with 4096 bit key
Mon May 28 09:58:35 2018 us=520736 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Mon May 28 09:58:35 2018 us=520923 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon May 28 09:58:35 2018 us=521071 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Mon May 28 09:58:35 2018 us=521221 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon May 28 09:58:35 2018 us=521804 TLS-Auth MTU parms [ L:1622 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Mon May 28 09:58:35 2018 us=523784 TUN/TAP device tun0 opened
Mon May 28 09:58:35 2018 us=524352 TUN/TAP TX queue length set to 100
Mon May 28 09:58:35 2018 us=524537 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon May 28 09:58:35 2018 us=525317 /sbin/ifconfig tun0 192.168.5.1 pointopoint 192.168.5.2 mtu 1500
Mon May 28 09:58:35 2018 us=543188 /sbin/route add -net 192.168.5.0 netmask 255.255.255.0 gw 192.168.5.2
Mon May 28 09:58:35 2018 us=549841 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Mon May 28 09:58:35 2018 us=550260 Socket Buffers: R=[163840->163840] S=[163840->163840]
Mon May 28 09:58:35 2018 us=550432 UDPv4 link local (bound): [AF_INET][undef]:443
Mon May 28 09:58:35 2018 us=550569 UDPv4 link remote: [AF_UNSPEC]
Mon May 28 09:58:35 2018 us=550719 GID set to nogroup
Mon May 28 09:58:35 2018 us=550883 UID set to nobody
Mon May 28 09:58:35 2018 us=551076 MULTI: multi_init called, r=256 v=256
Mon May 28 09:58:35 2018 us=551331 IFCONFIG POOL: base=192.168.5.4 size=62, ipv6=0
Mon May 28 09:58:35 2018 us=551681 Initialization Sequence Completed
Mon May 28 09:58:53 2018 us=273156 MULTI: multi_create_instance called
Mon May 28 09:58:53 2018 us=273684 192.168.1.139:48525 Re-using SSL/TLS context
Mon May 28 09:58:53 2018 us=275317 192.168.1.139:48525 Control Channel MTU parms [ L:1622 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Mon May 28 09:58:53 2018 us=275589 192.168.1.139:48525 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Mon May 28 09:58:53 2018 us=276042 192.168.1.139:48525 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-server'
Mon May 28 09:58:53 2018 us=276260 192.168.1.139:48525 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-client'
Mon May 28 09:58:53 2018 us=276633 192.168.1.139:48525 TLS: Initial packet from [AF_INET]192.168.1.139:48525, sid=55edc369 011e5d3a
Mon May 28 09:58:53 2018 us=649695 192.168.1.139:48525 VERIFY OK: depth=1, CN=Network, name=Network
Mon May 28 09:58:53 2018 us=652836 192.168.1.139:48525 VERIFY OK: depth=0, CN=Nexus 9, name=Key, emailAddress=.
Mon May 28 09:58:53 2018 us=691417 192.168.1.139:48525 peer info: IV_GUI_VER=OC30Android
Mon May 28 09:58:53 2018 us=691558 192.168.1.139:48525 peer info: IV_VER=3.2
Mon May 28 09:58:53 2018 us=691630 192.168.1.139:48525 peer info: IV_PLAT=android
Mon May 28 09:58:53 2018 us=691697 192.168.1.139:48525 peer info: IV_NCP=2
Mon May 28 09:58:53 2018 us=691761 192.168.1.139:48525 peer info: IV_TCPNL=1
Mon May 28 09:58:53 2018 us=691827 192.168.1.139:48525 peer info: IV_PROTO=2
Mon May 28 09:58:53 2018 us=691892 192.168.1.139:48525 peer info: IV_LZO=1
Mon May 28 09:58:53 2018 us=691958 192.168.1.139:48525 peer info: IV_LZO_SWAP=1
Mon May 28 09:58:53 2018 us=692024 192.168.1.139:48525 peer info: IV_LZ4=1
Mon May 28 09:58:53 2018 us=692088 192.168.1.139:48525 peer info: IV_LZ4v2=1
Mon May 28 09:58:53 2018 us=692153 192.168.1.139:48525 peer info: IV_COMP_STUB=1
Mon May 28 09:58:53 2018 us=692305 192.168.1.139:48525 peer info: IV_COMP_STUBv2=1
Mon May 28 09:58:53 2018 us=692379 192.168.1.139:48525 peer info: IV_AUTO_SESS=1
Mon May 28 09:58:53 2018 us=692509 192.168.1.139:48525 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1550', remote='link-mtu 1522'
Mon May 28 09:58:53 2018 us=692765 192.168.1.139:48525 WARNING: 'auth' is used inconsistently, local='auth [null-digest]', remote='auth SHA512'
Mon May 28 09:58:53 2018 us=693452 192.168.1.139:48525 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon May 28 09:58:53 2018 us=693542 192.168.1.139:48525 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon May 28 09:58:53 2018 us=701318 192.168.1.139:48525 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Mon May 28 09:58:53 2018 us=701509 192.168.1.139:48525 [Nexus 9] Peer Connection Initiated with [AF_INET]192.168.1.139:48525
Mon May 28 09:58:53 2018 us=701653 Nexus 9/192.168.1.139:48525 MULTI_sva: pool returned IPv4=192.168.5.6, IPv6=(Not enabled)
Mon May 28 09:58:53 2018 us=701947 Nexus 9/192.168.1.139:48525 MULTI: Learn: 192.168.5.6 -> Nexus 9/192.168.1.139:48525
Mon May 28 09:58:53 2018 us=702026 Nexus 9/192.168.1.139:48525 MULTI: primary virtual IP for Nexus 9/192.168.1.139:48525: 192.168.5.6
Mon May 28 09:58:53 2018 us=702397 Nexus 9/192.168.1.139:48525 PUSH: Received control message: 'PUSH_REQUEST'
Mon May 28 09:58:53 2018 us=702612 Nexus 9/192.168.1.139:48525 SENT CONTROL [Nexus 9]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.1.1,route 192.168.5.0 255.255.255.0,topology net30,ping 10,ping-restart 60,ifconfig 192.168.5.6 192.168.5.5,peer-id 0' (status=1)