I have a rather complex setup at home with 2 routers: 1) "parent" router provides connection to ISP and internet 2) "child" router (ASUS RT N18U) has built-in OpenVPN client and I am trying to get the "child" router to become a client of the remote OpenVPN server The client config works directly from a PC, but when I use this same config file in the route, even though a connection is made, the server reports [quote]bad source address from client[/quote] The reason is that the source address that the server receives is the IP assigned by the "parent" router to the "child" router (192.168.100.120), which of course, makes no sense to the server The client config is: [code]client dev tun proto tcp remote [ip + port] resolv-retry infinite nobind persist-key persist-tun ns-cert-type server cipher AES-256-CBC verb 3 # v.ca.crt -----BEGIN CERTIFICATE----- etc etc[/code] The server config on remote Linux machine is: [code]port [port] proto tcp dev tun ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/server.crt key /etc/openvpn/easy-rsa/keys/server.key dh /etc/openvpn/easy-rsa/keys/dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" # Google DNS duplicate-cn keepalive 10 120 cipher AES-256-CBC user nobody group nobody persist-key persist-tun status openvpn-status.log log-append /var/log/openvpn.log verb 4 float ping-timer-rem resolv-retry infinite[/code] I'm sure that this is a routing problem a little beyond my experience - so help to resolve would be appreciated

Many thanks. I've set this up, but have a problem still. When I include in the server configuration: [code]push "redirect-gateway def1 bypass-dhcp"[/code] this results in the client logging [quote]Ignore conflicted routing rule: [public ip of vpn server] 255.255.255.255[/quote] and the connection fails Without this configuration the connection succeeds, but traffic is not directed through the vpn :(

After reading around I managed to get it to work by adding "local" to the configuration: [code]push "redirect-gateway local def1 bypass-dhcp"[/code]

Client passing the IP given by "parent" router rather WAN IP

dzseti

I have a rather complex setup at home with 2 routers:

1) "parent" router provides connection to ISP and internet
2) "child" router (ASUS RT N18U) has built-in OpenVPN client and I am trying to get the "child" router to become a client of the remote OpenVPN server

The client config works directly from a PC, but when I use this same config file in the route, even though a connection is made, the server reports

bad source address from client

The reason is that the source address that the server receives is the IP assigned by the "parent" router to the "child" router (192.168.100.120), which of course, makes no sense to the server

The client config is:

client
dev tun
proto tcp
remote [ip + port]
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
cipher AES-256-CBC
verb 3

# v.ca.crt
<ca>
-----BEGIN CERTIFICATE-----
etc etc

The server config on remote Linux machine is:

port [port]
proto tcp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4" # Google DNS
duplicate-cn
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4
float
ping-timer-rem
resolv-retry infinite

I'm sure that this is a routing problem a little beyond my experience - so help to resolve would be appreciated

TinCanTech

dzseti wrote bad source address from client

Is caused by packets being sent to the server via the VPN from a source address that the server does not recognise.

You need to setup --iroute (Internal route) for that to work.

This is explained here:
https://community.openvpn.net/openvpn/wiki/HOWTO#ExpandingthescopeoftheVPNtoincludeadditionalmachinesoneithertheclientorserversubnet.

dzseti

Many thanks. I've set this up, but have a problem still.

When I include in the server configuration:

push "redirect-gateway def1 bypass-dhcp"

this results in the client logging

Ignore conflicted routing rule: [public ip of vpn server] 255.255.255.255

and the connection fails

Without this configuration the connection succeeds, but traffic is not directed through the vpn 🙁

dzseti

After reading around I managed to get it to work by adding "local" to the configuration:

push "redirect-gateway local def1 bypass-dhcp"