Hi everyone. I'm new to OpenVpn and just can't seem to figure out how to get my TP-link AC1900 working as a client. I'm "ok" with networking but far from an expert.
I have the OpenVPN server running on my home Orbi rbr50 router. I'm use dyndns for access to this server and it is working great with the windows GUI OpenVPN client. Using the Windows Gui I connect with no issues, am getting IP assigned by home router, and have full internet access.
Now, I would like to use the OpenVPN client functionality in my TP-Link AC1900 router flashed with DD-WRT (remote network). I would like this router to to more or less appear as a switch on my home network. I.E. any device I connect (via ethernet, don't care about wireless but would be cool if that worked to) to the TP-Link router is automatically assigned an IP from my Orbi home router and has full access to all resources on my home network.
Here is where I'm at. I have configured the remote DD-WRT client settings on the TP-Link client router, added my certificates (same that I used with the windows gui client), and am able to get "Connected Success" when I try to connect. However, I never get an IP assigned and the devices behind the DD-WRT client do not get an IP assigned either.
Home network router IP is 10.0.0.1. I have DHCP turned off on the DD-WRT client and set the LAN IP to a static address that fits the convention of my home network (10.0.0.9). I have the WAN interface set to "Static IP" and assign it an IP that fits the convention of the network it is hard wired to(10.1.20.19). This is the same network that I have no issues connecting through with the Windows GUI client. Summary of network info:
Home Orbi Router running built in OpenVPN server:
--Public IP address as of today (obviously this changes but using dyndns): 24.51.185.179
--Orbi internal lan IP: 10.0.0.1, same IP for gateway/dhcp/dns server, subnet: 255.255.0.0
Remote setup on DD-WRT client router:
--WAN: static IP set to 10.1.20.19, subnet: 255.255.0.0, gateway:10.1.50.101, dns1:10.1.200.105, dns2:10.12.100.6 (these are the network settings given when connecting via DHCP on a windows machined so I used them for the router as well)
--LAN: DHCP turned off. assigned router IP: 10.0.0.9, subnet:255.255.255.0, gateway 10.0.0.1, dns: 10.0.0.1
Here is my client config file:
client
dev tap
proto tcp
remote x.ddns.net 12974
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-128-CBC
comp-lzo
verb 0
sndbuf 393216
rcvbuf 393216
route-method exe
auth-nocache
data-ciphers AES-256-GCM:AES-128-GCM:AES-128-CBC
#link-mtu 1590
remote-cert-tls server
#route-gateway 10.0.0.1
#server-bridge 10.0.0.1 255.255.255 10.0.0.90 10.0.0.99
verb 3
Here are my client OpenVPN settings on the DD-WRT remote router
Here is my client OpenVPN log after connecting:
Clientlog:
20211031 08:23:51 W WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
20211031 08:23:51 W WARNING: Using --management on a TCP port WITHOUT passwords is STRONGLY discouraged and considered insecure
20211031 08:23:51 W WARNING: Using --management on a TCP port WITHOUT passwords is STRONGLY discouraged and considered insecure
20211031 08:23:51 W WARNING: file '/tmp/openvpncl/client.key' is group or others accessible
20211031 08:23:51 I OpenVPN 2.5.0 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Nov 3 2020
20211031 08:23:51 I library versions: OpenSSL 1.1.1h 22 Sep 2020 LZO 2.09
20211031 08:23:51 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:16
20211031 08:23:51 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20211031 08:23:53 I TCP/UDP: Preserving recently used remote address: [AF_INET]24.51.185.179:12974
20211031 08:23:53 Socket Buffers: R=[87380->360448] S=[16384->360448]
20211031 08:23:53 I Attempting to establish TCP connection with [AF_INET]24.51.185.179:12974 [nonblock]
20211031 08:23:53 I TCP connection established with [AF_INET]24.51.185.179:12974
20211031 08:23:53 W --mtu-disc is not supported on this OS
20211031 08:23:53 I TCP_CLIENT link local: (not bound)
20211031 08:23:53 I TCP_CLIENT link remote: [AF_INET]24.51.185.179:12974
20211031 08:23:53 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:23:53 D MANAGEMENT: CMD 'state'
20211031 08:23:53 MANAGEMENT: Client disconnected
20211031 08:23:53 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:23:53 D MANAGEMENT: CMD 'state'
20211031 08:23:53 MANAGEMENT: Client disconnected
20211031 08:23:53 TLS: Initial packet from [AF_INET]24.51.185.179:12974 sid=d42b2a76 c6ffcdb7
20211031 08:23:53 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:23:53 D MANAGEMENT: CMD 'status 2'
20211031 08:23:53 MANAGEMENT: Client disconnected
20211031 08:23:53 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:23:53 D MANAGEMENT: CMD 'log 500'
20211031 08:23:53 MANAGEMENT: Client disconnected
20211031 08:23:53 VERIFY KU OK
20211031 08:23:53 Validating certificate extended key usage
20211031 08:23:53 ++ Certificate has EKU (str) TLS Web Server Authentication expects TLS Web Server Authentication
20211031 08:23:53 NOTE: --mute triggered...
20211031 08:23:54 3 variation(s) on previous 3 message(s) suppressed by --mute
20211031 08:23:54 I [netgear] Peer Connection Initiated with [AF_INET]24.51.185.179:12974
20211031 08:23:55 SENT CONTROL [netgear]: 'PUSH_REQUEST' (status=1)
20211031 08:23:55 PUSH: Received control message: 'PUSH_REPLY ping 10 ping-restart 120 route-delay 10 route-gateway 10.0.0.1 redirect-gateway def1 peer-id 0 cipher AES-256-GCM'
20211031 08:23:55 OPTIONS IMPORT: timers and/or timeouts modified
20211031 08:23:55 NOTE: --mute triggered...
20211031 08:23:55 5 variation(s) on previous 3 message(s) suppressed by --mute
20211031 08:23:55 Data Channel: using negotiated cipher 'AES-256-GCM'
20211031 08:23:55 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
20211031 08:23:55 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
20211031 08:23:55 net_route_v4_best_gw query: dst 0.0.0.0
20211031 08:23:55 net_route_v4_best_gw result: via 10.1.50.101 dev vlan2
20211031 08:23:55 I TUN/TAP device tap0 opened
20211031 08:24:02 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:02 D MANAGEMENT: CMD 'state'
20211031 08:24:02 MANAGEMENT: Client disconnected
20211031 08:24:02 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:02 D MANAGEMENT: CMD 'state'
20211031 08:24:02 MANAGEMENT: Client disconnected
20211031 08:24:02 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:02 D MANAGEMENT: CMD 'status 2'
20211031 08:24:02 MANAGEMENT: Client disconnected
20211031 08:24:02 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:02 D MANAGEMENT: CMD 'log 500'
20211031 08:24:02 MANAGEMENT: Client disconnected
20211031 08:24:05 net_route_v4_add: 24.51.185.179/32 via 10.1.50.101 dev [NULL] table 0 metric -1
20211031 08:24:05 net_route_v4_add: 0.0.0.0/1 via 10.0.0.1 dev [NULL] table 0 metric -1
20211031 08:24:05 net_route_v4_add: 128.0.0.0/1 via 10.0.0.1 dev [NULL] table 0 metric -1
20211031 08:24:05 I Initialization Sequence Completed
20211031 08:24:06 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:06 D MANAGEMENT: CMD 'state'
20211031 08:24:06 MANAGEMENT: Client disconnected
20211031 08:24:06 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:06 D MANAGEMENT: CMD 'state'
20211031 08:24:06 MANAGEMENT: Client disconnected
20211031 08:24:06 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:06 D MANAGEMENT: CMD 'status 2'
20211031 08:24:06 MANAGEMENT: Client disconnected
20211031 08:24:06 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20211031 08:24:06 D MANAGEMENT: CMD 'log 500'
19691231 19:00:00
Here is the "Open VPN state" summary after connecting
State
Server:
Local Address:
Remote Address:
Client: CONNECTED SUCCESS
TAP mode: Bridged
MAC Address:
Local IP:
NAT: On
What is supposed to happen on the client side when everything works correctly? Can I assume if I ever get to the point of getting an IP assigned that everything is working?
Can you please point me in the right direction of what i need to do here? Thanks in advance for any help.
