[chiosc]

Hello guys,

What can i do to make OpenVPN work over UDP, it works fine from LAN(192.168.1.1) but not from outside. TCP works fine from outside.
I tried with the firewall disabled on both devices, different settings and firewall setting but nothing worked.
Since it works from LAN and i don't think the ONT is blocking, i feel like it needs some settings to pass the UDP data from the WAN to the LAN but i don't know networking so..

My network:
I have a ONT and a router, the OpenVPN is on the router.
The router is behind the ONT, linked using cable and gets the IP using Auto DHCP.
I added the router IP to the ONT DMZ so i can have all the ports open.

ONT FiberHome AN5506-02-FG - 10.10.10.9
Router Linksys e900 - 192.168.1.1 / OpenVpn 192.168.100.0
DD-WRT v3.0-r38570M mega (02/04/19), but i also tried with a slightly older build.

Here are my settings:

Setup Page:
https://i.imgur.com/jpreji0.png

OpenVpn page, no extra settings in the Additional Config
https://i.imgur.com/VWCbpRz.png

Route table:
https://i.imgur.com/7MOQafK.png

Firewall settings:
TCP works fine with nothing there, but this is what i have now.

iptables -I INPUT 1 -p udp --dport 33774 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.100.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun2 -j ACCEPT
iptables -I FORWARD -i tun2 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -j MASQUERADE


Client config:

remote xxxxxxx 33774

client
port 33774
remote-cert-tls server
dev tun
proto udp
resolv-retry infinite
nobind
float
persist-key
persist-tun
comp-lzo

ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1

tls-version-min 1.2
tls-cipher TLS-RSA-WITH-AES-128-CBC-SHA
cipher AES-128-CBC
auth SHA1
reneg-sec 180
redirect-gateway def1
auth-nocache
verb 4

The error i get:

Mon Feb 11 15:41:59 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]xxx.xxx.xxx.xxx:33774
Mon Feb 11 15:41:59 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Feb 11 15:41:59 2019 UDP link local: (not bound)
Mon Feb 11 15:41:59 2019 UDP link remote: [AF_INET]xxx.xxx.xxx.xxx:33774
Mon Feb 11 15:41:59 2019 MANAGEMENT: >STATE:1549892519,WAIT,,,,,,
Mon Feb 11 15:42:59 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Feb 11 15:42:59 2019 TLS Error: TLS handshake failed
Mon Feb 11 15:42:59 2019 TCP/UDP: Closing socket
Mon Feb 11 15:42:59 2019 SIGUSR1[soft,tls-error] received, process restarting

[egc]

First of all the only firewall rule you need is the POSTROUTING rule, ditch the other rules.

Your problem might be MTU related try lowering it from 1500 to 1400
see: https://forums.openvpn.net/viewtopic.php?t=21857

[chiosc]

Ok, i ditched the firewall rules and only let the POSTROUTING.

I tried the MTU thing yesterday, and now again with different combinations and values but didn't work.
When the client is trying to connect i can see the bold line in syslog, then fails with the TLS error.

Feb 11 17:18:50 DD-WRT daemon.notice openvpn[19600]: 10.10.10.12:53736 TLS: Initial packet from [AF_INET]10.10.10.12:53736, sid=2be051c7 d30d4741
Feb 11 17:19:50 DD-WRT daemon.err openvpn[19600]: 10.10.10.12:53736 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Feb 11 17:19:50 DD-WRT daemon.err openvpn[19600]: 10.10.10.12:53736 TLS Error: TLS handshake failed

[chiosc]

We got fiber to the door, the ONT is in the apartment.
The ONT WAN IP is Public, in the picture bellow you can see how the network looks.

I'm using the Public IP(5.13.221.xxx) to reach the OpenVPN on the router.
It might be ONT blocking, but the software is locked by the ISP and have limited access.

I don't know, i waste 2 days trying to get the UDP working because i get slightly better speeds than TCP but unless you guys have some ideas I'm kinda over it.

[Per Yngve Berg]

comp-lzo: Can be a mismatch between the client and server side.

proto udp: Is changed to proto udp4 in OpenVPN version 2.4.

[atmozphera]

[Per Yngve Berg]

@chiosc

You will not be able to reach the E900 unless you port forward on the ONT or DMZ.

@atmozphera

I cannot find build 33525. It may have been pulled.

If the server does not start, you have a syntax error in the configuration file.

[atmozphera]

Hi @Per Yngve Berg

I do not think there is something wrong in my configuration, but I will check the parameters again and see if there are even "dirty" (copy & paste effects) in the advanced configuration.

this build is a bit older:

DD-WRT v3.0-r33525 mega (10/17/17)

I pulled it straight from the FTP of "dd-wrt.com" and he is not published on last release, if you look in "Router Database" by the E900.

I choose him, after searching the forum for fix the issues on the E900's Wifi, from some builds (including the newest one) and I came to the conclusion that this was the last stable, and indeed it is...at least on Wifi point.