Problem with routing Internet from VPN Server to VPN Client

derdigge

Hello!

After reading for hours the posts of this forum i need still help with my setup.
The VPN Conection wents fine and my openwrt router (VPNIP 10.8.0.6) can ping the VPS (VPNIP 10.8.0.1).
Ping from Laptop to 10.8.0.6 are replyed, but Laptop to 10.8.0.1 arent.
Ping from openwrt to 10.8.0.1 are replyed, but openwrt to google.com arent. (Hostnames solved correct.)

My VPS Provider is Hostingparadise.de Virtualization tech is OpenVZ (yes i know allways, allways, allway use xen 😉 but hey, this one is 30 day free )
The specs are 1024mb of ram/ 25gb of harddisk / xeon Procc. ubuntu 11 minimal is running on it.

Here a small sheme how stuff is connected (all LAN Ips, not VPN)

___Laptop_____> ___Openwrt___> ____Fritz!Box_____>____Internet____>_____VPS Server
10.66.0.241______10.66.77.1_______100.100.100.15___________________jupi.luppi.schuppi.wuppie:1194

At a later point i decide to carry this Openwrt router arround. Annywhere i connect it to the internet it have to use
the VPN as a default gateway. So when any Laptop / ipad / iphone / ARdrone or my vacuum cleaner connects to
that Openwrt router it uses the vpn gateway by default.

Cheers
derdigge

Serverconfig:

port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt #notsure what it does or if i need it
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8" #maybe there are better ones
push "dhcp-option DNS 8.8.4.4" #maybe there are better ones
keepalive 10 120
comp-lzo
max-clients 3
persist-key #notsure what it does or if i need it
persist-tun #notsure what it does or if i need it
status openvpn-status.log
verb 3

Serverlog:

root@v110814053552124:/etc/openvpn# openvpn server.conf
Tue Aug 16 13:35:21 2011 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] buil
t on Mar 11 2011
Tue Aug 16 13:35:21 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or exec
utables
Tue Aug 16 13:35:21 2011 Diffie-Hellman initialized with 1024 bit key
Tue Aug 16 13:35:21 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Tue Aug 16 13:35:21 2011 TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Aug 16 13:35:21 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Aug 16 13:35:21 2011 ROUTE: default_gateway=UNDEF
Tue Aug 16 13:35:21 2011 TUN/TAP device tun0 opened
Tue Aug 16 13:35:21 2011 TUN/TAP TX queue length set to 100
Tue Aug 16 13:35:21 2011 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Tue Aug 16 13:35:21 2011 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Tue Aug 16 13:35:21 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Aug 16 13:35:21 2011 Listening for incoming TCP connection on [undef]
Tue Aug 16 13:35:21 2011 TCPv4_SERVER link local (bound): [undef]
Tue Aug 16 13:35:21 2011 TCPv4_SERVER link remote: [undef]
Tue Aug 16 13:35:21 2011 MULTI: multi_init called, r=256 v=256
Tue Aug 16 13:35:21 2011 IFCONFIG POOL: base=10.8.0.4 size=62
Tue Aug 16 13:35:21 2011 IFCONFIG POOL LIST
Tue Aug 16 13:35:21 2011 MULTI: TCP INIT maxclients=3 maxevents=7
Tue Aug 16 13:35:21 2011 Initialization Sequence Completed
Tue Aug 16 13:38:00 2011 MULTI: multi_create_instance called
Tue Aug 16 13:38:00 2011 Re-using SSL/TLS context
Tue Aug 16 13:38:00 2011 LZO compression initialized
Tue Aug 16 13:38:00 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Aug 16 13:38:00 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Aug 16 13:38:00 2011 Local Options hash (VER=V4): 'c0103fa8'
Tue Aug 16 13:38:00 2011 Expected Remote Options hash (VER=V4): '69109d17'
Tue Aug 16 13:38:00 2011 TCP connection established with [AF_INET]92.76.116.52:46908
Tue Aug 16 13:38:00 2011 TCPv4_SERVER link local: [undef]
Tue Aug 16 13:38:00 2011 TCPv4_SERVER link remote: [AF_INET]92.76.116.52:46908
Tue Aug 16 13:38:01 2011 92.76.116.52:46908 TLS: Initial packet from [AF_INET]92.76.116.52:46908, sid=b0d3c168 efd81070
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 VERIFY OK: depth=1, /C=DE/ST=SA/L=Magdeburg/O=Broitzem/CN=openvpn-ca/emailAd
dress=stephan.oelze@googlemail.com
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 VERIFY OK: depth=0, /C=DE/ST=SA/L=Magdeburg/O=Broitzem/CN=client1/emailAddre
ss=stephan.oelze@googlemail.com
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authenticat
ion
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authenticat
ion
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Aug 16 13:38:02 2011 92.76.116.52:46908 [client1] Peer Connection Initiated with [AF_INET]92.76.116.52:46908
Tue Aug 16 13:38:02 2011 client1/92.76.116.52:46908 MULTI: Learn: 10.8.0.6 -> client1/92.76.116.52:46908
Tue Aug 16 13:38:02 2011 client1/92.76.116.52:46908 MULTI: primary virtual IP for client1/92.76.116.52:46908: 10.8.0.6
Tue Aug 16 13:38:04 2011 client1/92.76.116.52:46908 PUSH: Received control message: 'PUSH_REQUEST'
Tue Aug 16 13:38:04 2011 client1/92.76.116.52:46908 SENT CONTROL [client1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhc
p,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0
.6 10.8.0.5' (status=1)
Tue Aug 16 13:45:16 2011 client1/92.76.116.52:46908 Connection reset, restarting [0]
Tue Aug 16 13:45:16 2011 client1/92.76.116.52:46908 SIGUSR1[soft,connection-reset] received, client-instance restarting
Tue Aug 16 13:45:16 2011 TCP/UDP: Closing socket
Tue Aug 16 14:22:20 2011 TCP/UDP: Closing socket
Tue Aug 16 14:22:20 2011 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Tue Aug 16 14:22:20 2011 Closing TUN/TAP interface
Tue Aug 16 14:22:20 2011 /sbin/ifconfig tun0 0.0.0.0
Tue Aug 16 14:22:20 2011 SIGINT[hard,] received, process exiting

Clientconfig:

client
dev tun
proto tcp
remote jupi.luppi.schuppi.wuppie 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client1.crt
key /etc/openvpn/client1.key
ns-cert-type server
comp-lzo
verb 3

Clientlog:

root@OpenWrt:/etc/openvpn# openvpn client.conf
Tue Aug 16 11:35:55 2011 OpenVPN 2.1.4 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Aug 12 2011
Tue Aug 16 11:35:55 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 16 11:35:55 2011 WARNING: file '/etc/openvpn/client1.key' is group or others accessible
Tue Aug 16 11:35:55 2011 LZO compression initialized
Tue Aug 16 11:35:55 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Aug 16 11:35:55 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Aug 16 11:35:55 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Aug 16 11:35:55 2011 Attempting to establish TCP connection with jupi.luppi.schuppi.wuppie:1194 [nonblock]
Tue Aug 16 11:35:56 2011 TCP connection established with jupi.luppi.schuppi.wuppie:1194
Tue Aug 16 11:35:56 2011 TCPv4_CLIENT link local: [undef]
Tue Aug 16 11:35:56 2011 TCPv4_CLIENT link remote: jupi.luppi.schuppi.wuppie:1194
Tue Aug 16 11:35:56 2011 TLS: Initial packet from jupi.luppi.schuppi.wuppie:1194, sid=ff346af4 bf689510
Tue Aug 16 11:35:57 2011 VERIFY OK: depth=1, /C=DE/ST=SA/L=Magdeburg/O=Broitzem/CN=openvpn-ca/emailAddress=Freak@cage.com
Tue Aug 16 11:35:57 2011 VERIFY OK: nsCertType=SERVER
Tue Aug 16 11:35:57 2011 VERIFY OK: depth=0, /C=DE/ST=SA/L=Magdeburg/O=Broitzem/CN=server/emailAddress=Freak@cage.com
Tue Aug 16 11:35:58 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 11:35:58 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 16 11:35:58 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 11:35:58 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 16 11:35:58 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Aug 16 11:35:58 2011 [server] Peer Connection Initiated with jupi.luppi.schuppi.wuppie:1194
Tue Aug 16 11:36:00 2011 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Aug 16 11:36:00 2011 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Aug 16 11:36:00 2011 OPTIONS IMPORT: timers and/or timeouts modified
Tue Aug 16 11:36:00 2011 OPTIONS IMPORT: --ifconfig/up options modified
Tue Aug 16 11:36:00 2011 OPTIONS IMPORT: route options modified
Tue Aug 16 11:36:00 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Aug 16 11:36:00 2011 TUN/TAP device tun0 opened
Tue Aug 16 11:36:00 2011 TUN/TAP TX queue length set to 100
Tue Aug 16 11:36:00 2011 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Tue Aug 16 11:36:00 2011 /sbin/route add -net jupi.luppi.schuppi.wuppie netmask 255.255.255.255 gw 100.100.100.15
Tue Aug 16 11:36:00 2011 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Tue Aug 16 11:36:00 2011 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Tue Aug 16 11:36:00 2011 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Tue Aug 16 11:36:00 2011 Initialization Sequence Completed

Clients Ifconfig

root@OpenWrt:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr 00:18:E7:89:8D:3B
          inet addr:10.66.77.1  Bcast:10.66.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:35876 errors:0 dropped:1825 overruns:0 frame:0
          TX packets:34420 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:4964810 (4.7 MiB)  TX bytes:10067055 (9.6 MiB)

eth0      Link encap:Ethernet  HWaddr 00:18:E7:89:8D:3B
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:221109 errors:0 dropped:11 overruns:12 frame:0
          TX packets:171562 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:99883882 (95.2 MiB)  TX bytes:87316214 (83.2 MiB)
          Interrupt:4

eth0.1    Link encap:Ethernet  HWaddr 00:18:E7:89:8D:3B
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:221026 errors:0 dropped:4 overruns:0 frame:0
          TX packets:171553 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:96777514 (92.2 MiB)  TX bytes:86628210 (82.6 MiB)

eth1      Link encap:Ethernet  HWaddr 00:18:E7:89:8D:3C
          inet addr:100.100.100.20  Bcast:100.101.255.255  Mask:255.254.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:110513 errors:0 dropped:741 overruns:0 frame:0
          TX packets:109091 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:45865991 (43.7 MiB)  TX bytes:12708947 (12.1 MiB)
          Interrupt:5

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:160 errors:0 dropped:0 overruns:0 frame:0
          TX packets:160 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:11402 (11.1 KiB)  TX bytes:11402 (11.1 KiB)

mon.wlan0 Link encap:UNSPEC  HWaddr 00-18-E7-89-8D-39-00-47-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:145509 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27850469 (26.5 MiB)  TX bytes:0 (0.0 B)

mon.wlan1 Link encap:UNSPEC  HWaddr 00-18-E7-89-8D-3A-00-47-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:75 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6258 (6.1 KiB)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:12 errors:0 dropped:0 overruns:0 frame:0
          TX packets:173 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:1008 (1008.0 B)  TX bytes:14459 (14.1 KiB)

wlan0     Link encap:Ethernet  HWaddr 00:18:E7:89:8D:39
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4391 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:1138784 (1.0 MiB)

wlan1     Link encap:Ethernet  HWaddr 00:18:E7:89:8D:3A
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:771 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4966 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:222863 (217.6 KiB)  TX bytes:1247796 (1.1 MiB)

Mimiko

Hello.

Ping from openwrt to 10.8.0.1 are replyed, but openwrt to google.com arent. (Hostnames solved correct.)

It's common problem with OpenVZ, it does not permit to route internet traffic thru OpenVPN server. Read this: https://forums.openvpn.net/topic8538-45.html

Ping from Laptop to 10.8.0.6 are replyed, but Laptop to 10.8.0.1 arent.

Show iptables from your openrt box:

iptables -L

derdigge

Thanks for you quick reply!!

It's common problem with OpenVZ, it does not permit to route internet traffic thru OpenVPN server. Read this: https://forums.openvpn.net/topic8538-45.html

i will read it now an check

Ping from Laptop to 10.8.0.6 are replyed, but Laptop to 10.8.0.1 arent.

Show iptables from your openrt box:

iptables -L

[/quote]

Hope this Helps:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
syn_flood  tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN
input_rule  all  --  anywhere             anywhere
input      all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
zone_wan_MSSFIX  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
forwarding_rule  all  --  anywhere             anywhere
forward    all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
output_rule  all  --  anywhere             anywhere
output     all  --  anywhere             anywhere

Chain forward (1 references)
target     prot opt source               destination
zone_lan_forward  all  --  anywhere             anywhere
zone_wan_forward  all  --  anywhere             anywhere

Chain forwarding_lan (1 references)
target     prot opt source               destination

Chain forwarding_rule (1 references)
target     prot opt source               destination
nat_reflection_fwd  all  --  anywhere             anywhere

Chain forwarding_wan (1 references)
target     prot opt source               destination

Chain input (1 references)
target     prot opt source               destination
zone_lan   all  --  anywhere             anywhere
zone_wan   all  --  anywhere             anywhere

Chain input_lan (1 references)
target     prot opt source               destination

Chain input_rule (1 references)
target     prot opt source               destination

Chain input_wan (1 references)
target     prot opt source               destination

Chain nat_reflection_fwd (1 references)
target     prot opt source               destination

Chain output (1 references)
target     prot opt source               destination
zone_lan_ACCEPT  all  --  anywhere             anywhere
zone_wan_ACCEPT  all  --  anywhere             anywhere

Chain output_rule (1 references)
target     prot opt source               destination

Chain reject (5 references)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain syn_flood (1 references)
target     prot opt source               destination
RETURN     tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
DROP       all  --  anywhere             anywhere

Chain zone_lan (1 references)
target     prot opt source               destination
input_lan  all  --  anywhere             anywhere
zone_lan_ACCEPT  all  --  anywhere             anywhere

Chain zone_lan_ACCEPT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain zone_lan_DROP (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain zone_lan_MSSFIX (0 references)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU

Chain zone_lan_REJECT (1 references)
target     prot opt source               destination
reject     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere

Chain zone_lan_forward (1 references)
target     prot opt source               destination
zone_wan_ACCEPT  all  --  anywhere             anywhere
forwarding_lan  all  --  anywhere             anywhere
zone_lan_REJECT  all  --  anywhere             anywhere

Chain zone_wan (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere            udp dpt:bootpc
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
input_wan  all  --  anywhere             anywhere
zone_wan_REJECT  all  --  anywhere             anywhere

Chain zone_wan_ACCEPT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain zone_wan_DROP (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain zone_wan_MSSFIX (1 references)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU

Chain zone_wan_REJECT (2 references)
target     prot opt source               destination
reject     all  --  anywhere             anywhere
reject     all  --  anywhere             anywhere

Chain zone_wan_forward (1 references)
target     prot opt source               destination
forwarding_wan  all  --  anywhere             anywhere
zone_wan_REJECT  all  --  anywhere             anywhere
root@OpenWrt:~#

EDIT

i have looked arrount your Post and the script.
As i read what the Install script does, i had an idea.
I have done nearly all things the script does instead of:

 
echo
echo "################################################"
echo "Forwarding IPv4 and Enabling It On boot"
echo "################################################"
echo 1 > /proc/sys/net/ipv4/ip_forward
# saves ipv4 forwarding and and enables it on-boot
cat >> /etc/sysctl.conf <<END
net.ipv4.ip_forward=1
END
sysctl -p
 
echo
echo "################################################"
echo "Updating IPtables Routing and Enabling It On boot"
echo "################################################"
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $ip
# saves iptables routing rules and enables them on-boot
iptables-save > /etc/iptables.conf
cat > /etc/network/if-pre-up.d/iptables <<END
#!/bin/sh
iptables-restore < /etc/iptables.conf
END
chmod +x /etc/network/if-pre-up.d/iptables

i will give it a try now.

derdigge

The script does the job!
My only Problem that lasts is that the client behind the Openwrt box arent "online" now!
I am not fit enough in that Route add thing to solve this on my own

The openwrtbox ist online now throug the Tunnel:

root@OpenWrt:~# traceroute heise.de
traceroute to heise.de (193.99.144.80), 30 hops max, 38 byte packets
 1  10.8.0.1 (10.8.0.1)  31.193 ms  30.560 ms  30.466 ms
 2  cloud-7v3.hostingparadise.de (213.218.178.13)  30.982 ms  30.860 ms  30.704                         ms
 3  dssd-s2-rou-1022.DE.eurorings.net (134.222.122.61)  31.020 ms  31.358 ms  31                        .449 ms
 4  hmb-s2-rou-1022.DE.eurorings.net (134.222.229.58)  39.442 ms  38.883 ms  39.                        075 ms
 5  hmb-s3-rou-1041.DE.eurorings.net (134.222.229.202)  51.160 ms  38.477 ms  38                        .066 ms
 6  TenGigabitEthernet6-3.ar3.HAM1.gblx.net (208.178.244.157)  38.668 ms  38.415                         ms  38.605 ms
 7  ae10-20G.scr1.HAM1.gblx.net (67.17.78.14)  38.889 ms  38.803 ms  38.779 ms
 8  ae1.scr3.FRA4.gblx.net (67.16.145.230)  46.086 ms  ae4.scr3.FRA4.gblx.net (6                        7.16.146.10)  45.708 ms  ae1.scr3.FRA4.gblx.net (67.16.145.230)  45.621 ms
 9  lag1.ar4.fra4.gblx.net (67.16.145.238)  45.702 ms  45.672 ms  51.170 ms
10  plusline.ethernet14-1.ar4.fra4.gblx.net (64.214.147.250)  173.484 ms  257.16                        8 ms  308.610 ms
11  *  heise1.f.de.plusline.net (82.98.98.98)  42.134 ms !A  *
12  heise1.f.de.plusline.net (82.98.98.98)  41.718 ms !A  *  42.358 ms !A
root@OpenWrt:~# ping heise.de
PING heise.de (193.99.144.80): 56 data bytes
64 bytes from 193.99.144.80: seq=0 ttl=247 time=42.651 ms
64 bytes from 193.99.144.80: seq=1 ttl=247 time=42.635 ms
64 bytes from 193.99.144.80: seq=2 ttl=247 time=42.530 ms
64 bytes from 193.99.144.80: seq=3 ttl=247 time=42.993 ms
^C
--- heise.de ping statistics ---
5 packets transmitted, 4 packets received, 20% packet loss
round-trip min/avg/max = 42.530/42.702/42.993 ms
root@OpenWrt:~#

derdigge

Route with vpn on

root@OpenWrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
default         fritz.box       0.0.0.0         UG    0      0        0 eth1
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        *               255.255.255.255 UH    0      0        0 tun0
10.66.0.0       *               255.255.0.0     U     0      0        0 br-lan
100.100.0.0     *               255.254.0.0     U     0      0        0 eth1
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
213.218.178.144 fritz.box       255.255.255.255 UGH   0      0        0 eth1

Route with vpn off

root@OpenWrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         fritz.box       0.0.0.0         UG    0      0        0 eth1
10.66.0.0       *               255.255.0.0     U     0      0        0 br-lan
100.100.0.0     *               255.254.0.0     U     0      0        0 eth1

derdigge

Prolem is solved now.
It was inside the firewall settings of the open WRT Box!
I Will post an complete Openwrt+Openwrt howto tommorow here:

https://forum.openwrt.org/viewtopic.php?pid=141488#p141488

Mimiko

Excellent, you made it almost youself. Please post the iptables list on openwrt after you modified.