Hi!
Apologies. Something like this has probably been asked a thousand times, I just can't find the right words to query Google.
I have a server at <some provider> that has just a single address. I set up OpenVPN for this on my router, running OpenWRT Barrier Breaker, and it worked fine. Now I've upgraded to LEDE 17.01.4 and this particular tunnel stopped working. My second tunnel to a server blessed with another IP address I can use to terminate the tunnel, still works.
So something changed between the OpenVPN releases for OpenWRT Barrier Breaker and for LEDE 17.01.4. I want to find out what part of my config needs changing and how. Here are the config files addresses and names obfuscated:
client
nobind
persist-key
persist-local-ip
persist-remote-ip
persist-tun
ping-timer-rem
tls-client
ca /lib/uci/upload/cbid.openvpn.client.ca
cert /lib/uci/upload/cbid.openvpn.client.cert
cipher AES-256-CBC
dev tun
down /usr/local/scripts/client-routes
key /lib/uci/upload/cbid.openvpn.client.key
ns-cert-type server
ping 15
ping-restart 60
proto udp
remote 1.2.3.4 9876
route-up /usr/local/scripts/client-routes
script-security 2
verb 3
#!/bin/sh
TAG='openvpn(client)'
FROM=172.16.0.0/16
TABLE=tunnel
TABLE=7
case $script_type in
*up) OP=add;;
*down) OP=delete;;
esac
logger -t $TAG "ip rule $OP to $trusted_ip/32 from $FROM lookup $TABLE"
ip rule $OP to $trusted_ip/32 from $FROM lookup $TABLE | logger -t $TAG
logger -t $TAG "ip route $OP $trusted_ip/32 dev $dev table $TABLE"
ip route $OP $trusted_ip/32 dev $dev table $TABLE | logger -t $TAG
echo "ARGV: $*" | logger
env | logger
config tls-server.conf
client-config-dir /etc/openvpn/tls-server.clients
server 10.129.2.0 255.255.255.0
# Client routes
route 172.16.0.0 255.255.255.0
port 9876
proto udp
cipher AES-256-CBC
dh /etc/openvpn/easy-rsa/keys/dh4096.pem
iroute 172.16.0.0 255.255.255.0
When I ping 1.2.3.4, I can see the ICMP packets enter the tunnel on the router, but they do not seem to leave the router, a tcpdump on the WAN interface shows far fewer packets, probably only overhead packets between the two OpenVPN instances. I can imagine the problem is in the /usr/local/scripts/client-routes script. It wasn't easy to get this working when I set the tunnel up, but now it only looks like it is working. Also this looks OK:
ip route get from 172.16.0.19 iif br-lan to 1.2.3.4
1.2.3.4 from 172.16.0.19 dev tun1 table 7
cache iif br-lan
Help is very much appreciated.
Lupe
