[ndewan]

All,

I managed to setup OpenVPN on a WRT54Gv4 running dd-wrt v24sp2 vpn-small build 15200.

I can establish connectivity to my home network from the 'outside' and can see the devices on the internal network .. Major progress (thanks to a forum member) from 24 hrs ago when I was literally pulling my hair out.

Had a question though...

When I first establish connection, I get a 'local and internet' connection to the VPN server while the 'enternal' connection goes into a 'local only' mode. This is what I would expect.

A visit to whatsmyip.org shows the internet IP of the VPN server ... Great.

What is stumping me is that after 5-10 minutes, the 'external' and 'VPN' connection, BOTH start showing 'Local and Internet' connectivity. A visit to whatsmyip.org now starts showing the internet IP address of the 'external' connection.

Any clues as to what could be going wrong and how could I correct it?

Thanks in advance.

[Sash]

plz read the guidelines and give us appropiate info

[ndewan]

Here is a high level overview of the setup.

Internet Gateway - ISP Provided
External IP=DynDns.org Hostname
Internal IP=10.100.1.200/24
DHCP Range =10.100.1.101-150

VPN Server - Linksys WRT54Gv4 Router Running DD-WRT sp2 vpn-small build 15200
LAN IP=10.100.1.203 (Static)
Gateway=10.100.1.200 (IP Address of the Internet Gateway)

DHCP Server=Enabled
Local IP =10.100.2.200/24
Gateway =10.100.1.200 (IP Address of the Internet Gateway)
Local DNS =10.100.1.200 (IP Address of the Internet Gateway)

What am I trying to do: Create a secure channel to connect from the internet to my network at home. Use the home devices (NAS, Printer etc) and connect to the internet too, using the ISP provided gateway. I am trying to create the 10.100.2.* address area for clients coming over the VPN. All the devices (NAS, printer etc) are in the 10.100.1.* address space.

OpenVPN Server Config

[Sash]

first thing should be that u corret your firewall rules and remove unnecessary stuff

[ndewan]

What do you suggest I remove ? I dont have a need for the scripts beyond the setup of OpenVPN.

Thanks

[ndewan]

nudge ..

any thoughts .. ?

[tedm]

I think what is going on is classic split tunnelling, your openvpn client on your Vista system is probably creating 2 default routes under vista, one pointing to the "real" ethernet interface under Vista and the other pointing to the vpn to your home network. When it first creates the "new" default route on connection that takes priority for the "internal local" traffic and then after a while that default route expires and the "real" default route takes over. Run the route command a few times over the 10-25 minutes in a command window in Vista and I suspect you will see the route table change.

In summary what your trying to do is rather ugly networking. Your sending Internet-destined traffic to a remote that is then u-turning it and doubling the amount of traffic on the remote's pipe. I'm sure you probably have your reasons for doing this such as the Internet connection that your remote is using is crapped up, maybe filtered, whatever. Maybe your trying to subvert the Great Firewall of China or some such. Whatever it is, Microsoft had to do some special coding in their Vista/Windows 7 ppp client (that isn't in Win XP) to properly support this. There's a checkbox in their client to enable and disable this that most people don't know about or understand what it does. Your OpenVPN client your running under Vista has to have a similar type of thing for this to even work - and it has to be working if it is there.

I don't know enough about the OpenVPN implementation under Vista to know, but I'm sure the OpenVPN mailing list can help you out a lot better. I can tell you though that this problem almost certainly has nothing to do with the OpenVPN server under dd-wrt. You could, just for testing sake, duplicate the OpenVPN server on a PC running Debian or some such, and I am sure you would see the exact same problem happening.

Good luck with it!

[ndewan]

Yup.. I figured that it was something on the client end and not on the router running DD-WRT. The only thing i was wondering was if there is a command that can be 'pushed' from the server side to persist the internet tunnel for the life of the VPN connection from the client.

Yes, you are correct, it appears that the tunnel reverts back to the default after a little while. It has been hard for me to pin point the time interval since nothing abnormal shows up in the logs (client or server).

Interestingly though, when I run a DOS window and try to ping/tracert internet sites or VPN (internal) devices, Vista will randomly use the external route or the tunnel/VPN route. Cant see a pattern, unfortunately.

Now .. Why would I be doing this ..Need to establish a 'secure' VPN connection to access resources on the home network. Having the tunnel spilt does not assure any security, it actually may enhance the opportunity for compromise by cross-site scripting. With a split tunnel, it becomes harder to indentify the culprit. I did take your Great Wall of China comment in good spirit, but jokes apart, if one cannot maintain a dedicated connection over the tunnel, it defeats the purpose of the VPN.

An alternative, and this would eliminate the over burdening of the tunnel, would be to maintain a 'local only' VPN connection and not allow the VPN to have a connection to the internet. Probably easier said than done.

Ideally, I would prefer to have a local connection to the 'immediate network' and the tunneled VPN connection provide internet services for a couple reasons (even if there is a price to pay).

1) Some financial sites (my credit union for sure), keeps track of the various IP's that I connect from. So when I am travelling, I would prefer to appear as if I am connecting from 'home'. With the current setup, I have to request adding the 'new ip' and have to remember to cleanup when done.

2) When travelling overseas, certain sites block access from IP's that are not US based.

Possible next steps/questions.

1. Is it possible to force the VPN channel to handle ALL internet and VPN traffic ? This would force the 'external' network to be a 'local' network.

2. Could this be accomplished by
- a push from the VPN server to the client when a connection is successfully established.
- a batch file on the client to set/reset the default path.

Thoughts/suggestions/alternatives ?

The OpenVPN forum is not very helpful .. they couldn't even help me establish a connection. Waiting for a 4 day turnaround, just to be asked to publish logs and then not hear for another 4-5 days, was not a very rewarding experience. Not sure if others have had a better experience.

[PetervdM]

[ndewan]

Made the recommended changes.

Looks like I am now taking using the 'external' network in the 'local' mode and using the VPN channel for internet access and devices in the home network.

Sample tracert commands