Anyone have DD-WRT, PIA openvpn, and port forwarding working

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page 1, 2, 3, 4, 5, 6  Next
Author Message
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Sat Feb 03, 2018 15:37    Post subject: Anyone have DD-WRT, PIA openvpn, and port forwarding working Reply with quote
I have Pia vpn and port forwarding working on a windows Sad pc. I would rather have it on the router. Pia support gave me a script to try and said it probably wouldn't work. They were right. There is a pretty confusing mixed up bunch of posts on Pia forums. I tried a bunch of things to no avail. Searching here has not helped me yet. The question is, has anyone been able to get port forwarding working on openvpn client dd-wrt router using pia openvpn?
Sponsor
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Sat Feb 03, 2018 21:08    Post subject: Reply with quote
In a nutshell getting which port to forward is the first problem. Pia says to
Code:
How to use it:
1. wget https://www.privateinternetaccess.com/installer/port_forward.sh
2. chmod +x port_forward.sh
3. Make sure you are connected in one of the gateways that supports port forwarding
3. ./port_forward.sh <user> <password>

It should return something like: { "port": 23423 }

You can then enter this port into your software.



This returns
Code:
root@DD-WRT:~#  wget https://www.privateinternetaccess.com/installer/port_forward.sh

wget: not an http or ftp url: https://www.privateinternetaccess.com/installer/port_forward.sh


Entering the script alone
Code:
root@DD-WRT:~# #! /bin/bash
#
# Enable port forwarding
#
# Requirements:
#   your Private Internet Access user and password as arguments
#
# Usage:
#  ./port_forward.sh <user> <password>

error( )
{
  echo "$@" 1>&2
  exit 1
}

error_and_usage( )
{
  echo "$@" 1>&2
  usage_and_exit 1
}

usage( )
{
  echo "Usage: `dirname $0`/$PROGRAM <user> <password>

>"
}

usage_and_exit( )
{
  usage
  exit $1
}

version( )
{
  echo "$PROGRAM version $VERSION"
}


port_forward_assignment( )
{
  echo 'Loading port forward assignment information..'
  if [ "$(uname)" == "Linux" ]; then
    local_ip=`ifconfig tun0|grep -oE "inet addr: *10\.[0-9]+\.[0-9]+\.[0-9]+"|tr -d "a-z :"|tee /tmp/vpn_ip`
    client_id=`head -n 100 /dev/urandom | md5sum | tr -d " -"`
  fi
  if [ "$(uname)" == "Darwin" ]; then
    local_ip=`ifconfig tun0 | grep "inet " | cut -d\  -f2|tee /tmp/vpn_ip`
    client_id=`head -n 100 /dev/urandom | md5 -r | tr -d " -"`
  fi
  json=`wget -q --post-data="user=$???????&pass=$??????????&client_id=$client_id&local_ip=$local_ip" -O - 'https://www.privateinternetaccess.com/vpninfo/port_forward_assignment' | head -1`
  echo $json
}

EXITCODE=0
PROGRAM=`basename $0`
VERSION=1.0
USER=$1
PASSWORD=$2

while test $# -lt 2
do
  case $1 in
  --usage | --help | -h )
    usage_and_exit 0
    ;;
  --version | -v )
    version
    exit 0
    ;;
  *)
    error_and_usage "Unrecognized option: $1"
    ;;
  esac
  shift
done

port_forward_assignment

exit 0


returns
Code:
root@DD-WRT:~# #! /bin/bash
root@DD-WRT:~# #
root@DD-WRT:~# # Enable port forwarding
root@DD-WRT:~# #
root@DD-WRT:~# # Requirements:
root@DD-WRT:~# #   your Private Internet Access user and password as arguments
root@DD-WRT:~# #
root@DD-WRT:~# # Usage:
root@DD-WRT:~# #  ./port_forward.sh <user> <password>
root@DD-WRT:~#
root@DD-WRT:~# error( )
> {
>   echo "$@" 1>&2
>   exit 1
> }
root@DD-WRT:~#
root@DD-WRT:~# error_and_usage( )
> {
>   echo "$@" 1>&2
>   usage_and_exit 1
> }
root@DD-WRT:~#
root@DD-WRT:~# usage( )
> {
>   echo "Usage: `dirname $0`/$PROGRAM <user> <password>
>
> >"
> }
root@DD-WRT:~#
root@DD-WRT:~# usage_and_exit( )
> {
>   usage
>   exit $1
> }
root@DD-WRT:~#
root@DD-WRT:~# version( )
> {
>   echo "$PROGRAM version $VERSION"
> }
root@DD-WRT:~#
root@DD-WRT:~#
root@DD-WRT:~# port_forward_assignment( )
> {
>   echo 'Loading port forward assignment information..'
>   if [ "$(uname)" == "Linux" ]; then
>     local_ip=`ifconfig tun0|grep -oE "inet addr: *10\.[0-9]+\.[0-9]+\.[0-9]+"|tr
-d "a-z :"|tee /tmp/vpn_ip`
>     client_id=`head -n 100 /dev/urandom | md5sum | tr -d " -"`
>   fi
>   if [ "$(uname)" == "Darwin" ]; then
>     local_ip=`ifconfig tun0 | grep "inet " | cut -d\  -f2|tee /tmp/vpn_ip`
>     client_id=`head -n 100 /dev/urandom | md5 -r | tr -d " -"`
>   fi
>   json=`wget -q --post-data="user=$???????&pass=$??????????&client_id=$client_id&
local_ip=$local_ip" -O - 'https://www.privateinternetaccess.com/vpninfo/port_forwar
d_assignment' | head -1`
>   echo $json
> }
root@DD-WRT:~#
root@DD-WRT:~# EXITCODE=0
root@DD-WRT:~# PROGRAM=`basename $0`
root@DD-WRT:~# VERSION=1.0
root@DD-WRT:~# USER=$1
root@DD-WRT:~# PASSWORD=$2
root@DD-WRT:~#
root@DD-WRT:~# while test $# -lt 2
> do
>   case $1 in
>   --usage | --help | -h )
>     usage_and_exit 0
>     ;;
>   --version | -v )
>     version
>     exit 0
>     ;;
>   *)
>     error_and_usage "Unrecognized option: $1"
>     ;;
>   esac
>   shift
> done
Unrecognized option:
Usage: ./-sh <user> <password>

>
Connection closed by foreign host.

JUst running those instructions on Ubuntu PC

Code:
pw@pw-MP8708:~$ wget https://www.privateinternetaccess.com/installer/port_forward.sh
--2018-02-03 14:08:22--  https://www.privateinternetaccess.com/installer/port_forward.sh
Resolving www.privateinternetaccess.com (www.privateinternetaccess.com)... 23.208.44.232
Connecting to www.privateinternetaccess.com (www.privateinternetaccess.com)|23.208.44.232|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1431 (1.4K) [text/x-sh]
Saving to: ‘port_forward.sh.4’

port_forward.sh.4    100%[=====================>]   1.40K  --.-KB/s    in 0s     

2018-02-03 14:08:22 (163 MB/s) - ‘port_forward.sh.4’ saved [1431/1431]

pw@pw-MP8708:~$ chmod +x port_forward.sh
pw@pw-MP8708:~$ ./port_forward.sh ????????? ????????
Loading port forward assignment information..
tun0: error fetching interface information: Device not found
{"error":"Invalid parameter: local_ip "}
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Sun Feb 04, 2018 0:53    Post subject: Reply with quote
    eibgrad wrote:

Quote:
That's one of the dangers I found in using PureVPN, and discussed in the following thread.

https://www.dd-wrt.com/phpBB2/viewtopic.php?t=307445


after reading your reply 4th post down here: https://www.dd-wrt.com/phpBB2/viewtopic.php?t=313501&highlight= I scrapped PUREVPN and went with PIA.


d0ug wrote:

The IP of my host running the email and web server is excluded from the policy based routing.


so this means all traffic to and from that machine is over the wan? If so that is what I was trying to avoid. The script from PIA support is meant to give the port to forward (or not). Not able to get that to happen and what I have going on on the windows machine is working. I just do not like using windows.

So, thanks for the help guys / gals and I will continue as I am.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5920
Location: Netherlands

PostPosted: Wed Feb 07, 2018 14:01    Post subject: Reply with quote
Pia has a new port forwarding API: https://www.privateinternetaccess.com/forum/discussion/23431/new-pia-port-forwarding-api

However you need sha256sum for it to work, I just installed it via Entware ng: opkg install coreutils-sha256sum
and lo and behold it actually works. Mind you if you are using PBR you have to route their server adress: http://209.222.18.222 through the VPN
Also it only works the first 2 minutes the VPN is up!

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5920
Location: Netherlands

PostPosted: Wed Feb 07, 2018 16:48    Post subject: Reply with quote
Yes I agree it is not for the faint of hearted Sad

Besides the new API will get you the port number but from there on you have to write a script for port forwarding that particular port to your destined port I guess.
(If I ever need such a script I know where to find you Smile )

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Wed Feb 07, 2018 19:14    Post subject: Reply with quote
Count me among the faint of hearted average user but I am willing to try anything. I had tried the new APi and knew about the 2 minute thing without success. Must have missed the part about sha256sum. Time for me to get to googling that and entware. I installed entware a few days ago on a flash drive I think but really didn't know what I was doing.
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Wed Feb 07, 2018 23:02    Post subject: Reply with quote
egc wrote:
Quote:
Pia has a new port forwarding API: https://www.privateinternetaccess.com/forum/discussion/23431/new-pia-port-forwarding-api

However you need sha256sum for it to work, I just installed it via Entware ng: opkg install coreutils-sha256sum
and lo and behold it actually works. Mind you if you are using PBR you have to route their server adress: http://209.222.18.222 through the VPN
Also it only works the first 2 minutes the VPN is up!


I installed entware on usb. I believe I installed sha256sum, not sure how to know that worked.
Ran the install script from Pia.
    https://www.privateinternetaccess.com/forum/discussion/23431/new-pia-port-forwarding-api
Code:
 pw@pw-MP8708:~$ ./port_forwarding.sh
Loading port forward assignment information...
Port forwarding is already activated on this connection, has expired, or you are not connected to a PIA region that supports port forwarding

I read on PIA comments on that page a lot of people were getting this message. Didn't read anything I understood about what to do about it. Any ideas?
BTW: not using PBR
BTW2: thanks egc for the help
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Thu Feb 08, 2018 0:46    Post subject: Reply with quote
I assume you are talking about the script found here:
    https://pastebin.com/EnscrGbH


Tried that before, I will give it another shot. Is there anything needs changing for my individual settings? openvpn is set using port 502 tcp. IP of PC is 192.168.1.145. Thanks
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Thu Feb 08, 2018 19:40    Post subject: Reply with quote
It all looks way over my pay grade but I am going to play with it awhile Shocked. I will report back.
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Sat Feb 10, 2018 17:43    Post subject: Reply with quote
egc wrote:
Pia has a new port forwarding API: https://www.privateinternetaccess.com/forum/discussion/23431/new-pia-port-forwarding-api

However you need sha256sum for it to work, I just installed it via Entware ng: opkg install coreutils-sha256sum
and lo and behold it actually works. Mind you if you are using PBR you have to route their server adress: http://209.222.18.222 through the VPN
Also it only works the first 2 minutes the VPN is up!


Finally got that to return a port number.

egc wrote
Quote:
Besides the new API will get you the port number but from there on you have to write a script for port forwarding that particular port to your destined port I guess.
(If I ever need such a script I know where to find you)
Looks like this is what I need a little help with now.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5920
Location: Netherlands

PostPosted: Sat Feb 10, 2018 20:48    Post subject: Reply with quote
eibgrad wrote:
bushant wrote:
egc wrote:
Pia has a new port forwarding API: https://www.privateinternetaccess.com/forum/discussion/23431/new-pia-port-forwarding-api

However you need sha256sum for it to work, I just installed it via Entware ng: opkg install coreutils-sha256sum
and lo and behold it actually works. Mind you if you are using PBR you have to route their server adress: http://209.222.18.222 through the VPN
Also it only works the first 2 minutes the VPN is up!


Finally got that to return a port number.

egc wrote
Quote:
Besides the new API will get you the port number but from there on you have to write a script for port forwarding that particular port to your destined port I guess.
(If I ever need such a script I know where to find you)
Looks like this is what I need a little help with now.


Let me see what I can do. I have a pretty good idea what needs to be done. But I may have to rely on you guys to test since I'm not all that interested in opening a PIA account just for this. I wish these VPN providers offered developer accounts so we could easily address the problems of *their* customers.

I still say my existing PBR scripts are the better solution. Because either way, we're still dependent on scripting, user modifications to those scripts, and user installation. So it only makes sense to me to use the scripting option that offers the most bang for the buck. And which is already tested and proven.

But I'll still give it a go.


Glad you stepped in. I have scripting and programming skills but only for Windows. Sad

The output of the PIA API is:
{"port":58636}

so my limited linux knowledge would use sed or tr to extract the numbers

use the firewall rules:
iptables -t nat -I PREROUTING -p tcp --dport <EXTERNAL_PORT> -j DNAT --to <INTERNAL_IP>:<INTERNAL_PORT>
iptables -I FORWARD -p tcp -d <INTERNAL_IP> --dport <INTERNAL_PORT> -j ACCEPT [-s <EXTERNAL_IP>]

To set the port forwarding

Make a shell script use "route-up shellscript.sh" in addtitional config to run the script when OpenVPN starts

Not sure if that would be feasible but even if I could pull it off it would cost me a lot of work (would be fun to try though)

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
bushant
DD-WRT Guru


Joined: 18 Nov 2015
Posts: 1377

PostPosted: Sat Feb 10, 2018 22:31    Post subject: Reply with quote
This certainly isn't an end of the world thing. I have something working on windows just not preferable. Not asking anyone to go very far out of the way to solve my problems. BUT THANKS A BUNCH!
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5920
Location: Netherlands

PostPosted: Sun Feb 11, 2018 10:50    Post subject: Reply with quote
I am interested, if only for learning some advanced scripting Smile

For posterity:
Installation of Entware and coreutils-sha256sum is not necessary.
it is entirely possible to get an unique hash with windows:
Open a CMD prompt and issue:
Code:
certutil -hashfile myfile SHA256

For myfile use a unique personale file. This will give you a hash like: 0796bfb0c5c8565be79b337af2fc09ac9ecc0abe48ba25ede424c06d420ab78c
In the script use this hash like:
Code:
json=`curl "http://209.222.18.222:2000/?client_id=0796bfb0c5c8565be79b337af2fc09ac9ecc0abe48ba25ede424c06d420ab78c" 2>/dev/null`

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5920
Location: Netherlands

PostPosted: Sun Feb 11, 2018 16:50    Post subject: Reply with quote
I have adapted the port forwarding PIA script:
1. To use the VPN tunnel (curl --interface VPNTUNNEL) this can be useful if PBR is used (Next step is to seek the actual VPN interface name, I now use tun1, I can AWK the routing table probably to automate this)
2. Incorporate code if a fixed client identifier is used, described in the previous post. The fixed identifier can be set in startup command. This fixed identifier returns the same port even after 2 minutes, but in order to work it has to be run a first time within 2 minutes of the start of the VPN.

It still needs some polishing Smile

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5920
Location: Netherlands

PostPosted: Mon Feb 12, 2018 7:07    Post subject: Reply with quote
Yes I have tested the hash can be reused.
It is only as a unique identifier relative to every other user. So static would be fine.
I have reworked my last script to use a static hash and that was working

I will test your script later. Many thanks!

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Goto page 1, 2, 3, 4, 5, 6  Next Display posts from previous:    Page 1 of 6
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum