Have used OpenVPN for years w/o issues. Now with a new router running DD-WRT, trying to get the latest version of OpenVPN running with redirect gateway is impossible.
The client connects w/o any issues, but can not surf internet via the VPN connection
Router LAN IP: 192.168.0.1
OpenVPN Server Configuration: 10.8.0.0/255.255.255.0 Protocol UDP, Port 1194, Encryption: AES-256 CBC, Hash: SHA1, LZO: Adaptive, MTU: 1500. Dev: TUN
Additional configuration lines in the server:
(Have tried several in combination, including push "redirect-gateway def1 bypass-dhcp"
push "route 192.168.0.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 8.8.8.8"
push "route 10.8.0.0 255.255.255.0"
push "route-gateway 192.168.0.1"
keepalive 10 120
persist-key
persist-tun
Client Config file:
tls-client
dev tun
proto udp
tun-mtu 1500
float
nobind
ca ca.crt
cert client1.crt
key client1.key
cipher AES-256-CBC
comp-lzo adaptive
resolv-retry infinite
persist-key
persist-tun
remote XXXXXXX.dyndns.org 1194
remote-cert-tls server
auth-nocache
verb 3
DD-WRT Firewall Options: (Tried various combinations/options:
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.0.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A PREROUTING -s $trusted_ip/24 -j NETMAP --to 10.8.0.10/24
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
Client Log file:
2019-12-15 14:27:16 1
2019-12-15 14:27:16 ----- OpenVPN Start ----- OpenVPN core 3.git::2ae73415 ios arm64 64-bit PT_PROXY built on Dec 2 2019 14:44:28
2019-12-15 14:27:16 OpenVPN core 3.git::2ae73415 ios arm64 64-bit PT_PROXY built on Dec 2 2019 14:44:28
2019-12-15 14:27:16 Frame=512/2048/512 mssfix-ctrl=1250
2019-12-15 14:27:16 UNUSED OPTIONS
6 [nobind]
9 [resolv-retry] [infinite]
10 [persist-key]
11 [persist-tun]
2019-12-15 14:27:16 EVENT: RESOLVE
2019-12-15 14:27:16 Contacting [XX.XX.19.118]:1194/UDP via UDP
2019-12-15 14:27:16 EVENT: WAIT
2019-12-15 14:27:16 Connecting to [xxxxxxx.dyndns.org]:1194 (XX.XX.19.118) via UDPv4
2019-12-15 14:27:16 EVENT: CONNECTING
2019-12-15 14:27:16 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client
2019-12-15 14:27:16 Creds: UsernameEmpty/PasswordEmpty
2019-12-15 14:27:16 Peer Info:
IV_GUI_VER=net.openvpn.connect.ios 3.1.1-2819
IV_VER=3.git::2ae73415
IV_PLAT=ios
IV_LZO=1
IV_IPv6=0
IV_AUTO_SESS=1
2019-12-15 14:27:17 VERIFY OK : depth=1
cert. version : 3
serial number : F8:CA:3A:05:AA:6F:C9:E6
issuer name : C=US, ST=CA, L=Redding, O=TPMC, OU=RAAMG, CN=OpenVPN-CA, ??=changeme, emailAddress=
sdhruva@gmail.com
subject name : C=US, ST=CA, L=Redding, O=TPMC, OU=RAAMG, CN=OpenVPN-CA, ??=changeme, emailAddress=
sdhruva@gmail.com
issued on : 2019-12-09 01:14:30
expires on : 2029-12-06 01:14:30
signed using : RSA with SHA-256
RSA key size : 4096 bits
basic constraints : CA=true
2019-12-15 14:27:17 VERIFY OK : depth=0
cert. version : 3
serial number : 01
issuer name : C=US, ST=CA, L=Redding, O=TPMC, OU=RAAMG, CN=OpenVPN-CA, ??=changeme, emailAddress=
sdhruva@gmail.com
subject name : C=US, ST=CA, L=Redding, O=TPMC, OU=RAAMG, CN=server, ??=changeme, emailAddress=
sdhruva@gmail.com
issued on : 2019-12-09 01:15:40
expires on : 2029-12-06 01:15:40
signed using : RSA with SHA-256
RSA key size : 4096 bits
basic constraints : CA=false
cert. type : SSL Server
key usage : Digital Signature, Key Encipherment
ext key usage : TLS Web Server Authentication
2019-12-15 14:27:18 SSL Handshake: TLSv1.2/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2019-12-15 14:27:18 Session is ACTIVE
2019-12-15 14:27:18 EVENT: GET_CONFIG
2019-12-15 14:27:18 Sending PUSH_REQUEST to server...
2019-12-15 14:27:18 OPTIONS:
0 [redirect-gateway] [def1]
1 [route] [192.168.0.0] [255.255.255.0]
2 [route] [10.8.0.0] [255.255.255.0]
3 [dhcp-option] [DNS] [10.8.0.1]
4 [dhcp-option] [DNS] [8.8.8.8]
5 [route] [10.8.0.0] [255.255.255.0]
6 [route-gateway] [192.168.0.1]
7 [route-gateway] [10.8.0.1]
8 [topology] [subnet]
9 [ping] [10]
10 [ping-restart] [120]
11 [ifconfig] [10.8.0.2] [255.255.255.0]
12 [block-ipv6]
2019-12-15 14:27:18 PROTOCOL OPTIONS:
cipher: AES-256-CBC
digest: SHA1
compress: LZO
peer ID: -1
2019-12-15 14:27:18 EVENT: ASSIGN_IP
2019-12-15 14:27:18 NIP: preparing TUN network settings
2019-12-15 14:27:18 NIP: init TUN network settings with endpoint: XX.XX.19.118
2019-12-15 14:27:18 NIP: adding IPv4 address to network settings 10.8.0.2/255.255.255.0
2019-12-15 14:27:18 NIP: adding (included) IPv4 route 10.8.0.0/24
2019-12-15 14:27:18 NIP: adding (included) IPv4 route 192.168.0.0/24
2019-12-15 14:27:18 NIP: adding (included) IPv4 route 10.8.0.0/24
2019-12-15 14:27:18 NIP: adding (included) IPv4 route 10.8.0.0/24
2019-12-15 14:27:18 NIP: redirecting all IPv4 traffic to TUN interface
2019-12-15 14:27:18 NIP: adding DNS 10.8.0.1
2019-12-15 14:27:18 NIP: adding DNS 8.8.8.8
2019-12-15 14:27:18 NIP: blocking all IPv6 traffic
2019-12-15 14:27:18 NIP: setting MTU to 1500
2019-12-15 14:27:18 Connected via NetworkExtensionTUN
2019-12-15 14:27:18 LZO-ASYM init swap=0 asym=0
2019-12-15 14:27:18 EVENT: CONNECTED XXXXXXXX.dyndns.org:1194 (xx.xx.19.118) via /UDPv4 on NetworkExtensionTUN/10.8.0.2/ gw=[/]
DD-WRT OpenVPN Status:
State
Server: CONNECTED SUCCESS
Local Address: 10.8.0.1
Remote Address: 10.8.0.1
Status
VPN Server Stats: nclients=1, bytesin=5853, bytesout=5815
Client: client6
Remote IP:Port 1xx.1xx.41.119:43494
Bytes Received 5853
Bytes Sent 5815
Connected Since Sun Dec 15 14:43:02 2019
VPN Server Routing Table
Client: client6
Virtual Address 10.8.0.2
Real Address 1xx.1xx.41.119:43494
Last Ref Sun Dec 15 14:43:08 2019
Log
20191215 14:43:02 1xx.1xx.41.119:43494 TLS: Initial packet from [AF_INET]1xx.1xx.41.119:43494 sid=f54693b9 c6ae88fe
20191215 14:43:04 1xx.1xx.41.119:43494 VERIFY OK: depth=1 C=US ST=CA L=Redding O=TPMC OU=RAAMG CN=OpenVPN-CA name=changeme emailAddress=
sdhruva@gmail.com
20191215 14:43:04 1xx.1xx.41.119:43494 VERIFY OK: depth=0 C=US ST=CA L=Redding O=TPMC OU=RAAMG CN=client6 name=changeme emailAddress=
sdhruva@gmail.com
20191215 14:43:04 I 1xx.1xx.41.119:43494 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.1.1-2819
20191215 14:43:04 I 1xx.1xx.41.119:43494 peer info: IV_VER=3.git::2ae73415
20191215 14:43:04 I 1xx.1xx.41.119:43494 peer info: IV_PLAT=ios
20191215 14:43:04 I 1xx.1xx.41.119:43494 peer info: IV_LZO=1
20191215 14:43:04 I 1xx.1xx.41.119:43494 peer info: IV_IPv6=0
20191215 14:43:04 I 1xx.1xx.41.119:43494 peer info: IV_AUTO_SESS=1
20191215 14:43:05 1xx.1xx.41.119:43494 Control Channel: TLSv1.2 cipher SSLv3 DHE-RSA-AES256-SHA 4096 bit RSA
20191215 14:43:05 I 1xx.1xx.41.119:43494 [client6] Peer Connection Initiated with [AF_INET]1xx.1xx.41.119:43494
20191215 14:43:05 I client6/1xx.1xx.41.119:43494 MULTI_sva: pool returned IPv4=10.8.0.2 IPv6=(Not enabled)
20191215 14:43:05 client6/1xx.1xx.41.119:43494 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_5bfb1cc229e4f64e.tmp
20191215 14:43:05 client6/1xx.1xx.41.119:43494 MULTI: Learn: 10.8.0.2 -> client6/1xx.1xx.41.119:43494
20191215 14:43:05 client6/1xx.1xx.41.119:43494 MULTI: primary virtual IP for client6/1xx.1xx.41.119:43494: 10.8.0.2
20191215 14:43:05 client6/1xx.1xx.41.119:43494 PUSH: Received control message: 'PUSH_REQUEST'
20191215 14:43:05 client6/1xx.1xx.41.119:43494 SENT CONTROL [client6]: 'PUSH_REPLY redirect-gateway def1 route 192.168.0.0 255.255.255.0 route 10.8.0.0 255.255.255.0 dhcp-option DNS 10.8.0.1 dhcp-option DNS 8.8.8.8 route 10.8.0.0 255.255.255.0 route-gateway 192.168.0.1 route-gateway 10.8.0.1 topology subnet ping 10 ping-restart 120 ifconfig 10.8.0.2 255.255.255.0' (status=1)
20191215 14:43:05 client6/1xx.1xx.41.119:43494 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
20191215 14:43:05 client6/1xx.1xx.41.119:43494 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
20191215 14:43:05 client6/1xx.1xx.41.119:43494 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
20191215 14:43:05 client6/1xx.1xx.41.119:43494 NOTE: --mute triggered...
20191215 14:43:11 1 variation(s) on previous 3 message(s) suppressed by --mute
20191215 14:43:11 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20191215 14:43:11 D MANAGEMENT: CMD 'state'
20191215 14:43:11 MANAGEMENT: Client disconnected
20191215 14:43:11 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20191215 14:43:11 D MANAGEMENT: CMD 'state'
20191215 14:43:11 MANAGEMENT: Client disconnected
20191215 14:43:11 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20191215 14:43:11 D MANAGEMENT: CMD 'state'
20191215 14:43:11 MANAGEMENT: Client disconnected
20191215 14:43:11 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20191215 14:43:11 MANAGEMENT: Client disconnected
20191215 14:43:11 NOTE: --mute triggered...
20191215 14:43:11 1 variation(s) on previous 3 message(s) suppressed by --mute
20191215 14:43:11 D MANAGEMENT: CMD 'status 2'
20191215 14:43:11 MANAGEMENT: Client disconnected
20191215 14:43:11 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20191215 14:43:11 D MANAGEMENT: CMD 'status 2'
20191215 14:43:11 MANAGEMENT: Client disconnected
20191215 14:43:11 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20191215 14:43:11 D MANAGEMENT: CMD 'log 500'
============
Sorry for the long post, but I have essentially included all the information. Any help will be appreciated to fix the issues. (Wife is upset that I have been in the front of PC for the last week and not with her - Priorities) lol
