[Ironclad00]

Hello, I apologize for yet another VPN-related post but I'm unable to debug my issue by looking at other posts.

The two issues I'm having:
1) I can connect to the VPN when on my local network, but not from any other network
2) Even when connected to the VPN via my local network, I cannot access the admin dashboard but can access other servers on the network (ie, 192.168.1.1 times out, but 192.168.1.180 can connect just fine)

I'm running DD-WRT v3.0-r37015M kongac on a Nighthawk R8000. My server config is in the attached image and my client config is:

client
dev tun0
proto tcp4
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
remote-cert-tls server
cipher AES-256-CBC
verb 4


My firewall config is:
iptables -I INPUT 1 -p udp –dport 1194 -j ACCEPT
iptables -I FORWARD 1 –source 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT


When I connect locally, I'll get logs like:
...
20190117 14:08:28 I TUN/TAP device tun0 opened
20190117 14:08:28 D do_ifconfig tt->did_ifconfig_ipv6_setup=0
20190117 14:08:28 I /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
20190117 14:08:28 I Listening for incoming TCP connection on [AF_INET][undef]:1194
20190117 14:08:28 I TCPv4_SERVER link local (bound): [AF_INET][undef]:1194
20190117 14:08:28 I TCPv4_SERVER link remote: [AF_UNSPEC]
20190117 14:08:28 I Initialization Sequence Completed
20190117 14:09:24 I TCP connection established with [AF_INET]192.168.1.123:58112
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_VER=2.4.6
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_PLAT=win
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_PROTO=2
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_NCP=2
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_LZ4=1
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_LZ4v2=1
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_LZO=1
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_COMP_STUB=1
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_COMP_STUBv2=1
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_TCPNL=1
20190117 14:09:25 I 192.168.1.123:58112 peer info: IV_GUI_VER=OpenVPN_GUI_11
20190117 14:09:25 I 192.168.1.123:58112 [client1] Peer Connection Initiated with [AF_INET]192.168.1.123:58112
20190117 14:09:25 I client1/192.168.1.123:58112 MULTI_sva: pool returned IPv4=10.8.0.6 IPv6=(Not enabled)
20190117 14:09:35 N client1/192.168.1.123:58112 Connection reset restarting [-1]
20190117 14:20:17 I TCP connection established with [AF_INET]192.168.1.123:58436
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_VER=2.4.6
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_PLAT=win
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_PROTO=2
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_NCP=2
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_LZ4=1
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_LZ4v2=1
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_LZO=1
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_COMP_STUB=1
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_COMP_STUBv2=1
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_TCPNL=1
20190117 14:20:18 I 192.168.1.123:58436 peer info: IV_GUI_VER=OpenVPN_GUI_11
20190117 14:20:18 I 192.168.1.123:58436 [client1] Peer Connection Initiated with [AF_INET]192.168.1.123:58436
20190117 14:20:18 I client1/192.168.1.123:58436 MULTI_sva: pool returned IPv4=10.8.0.6 IPv6=(Not enabled)
19691231 19:00:00

But theres no output when connecting from a non-local network. This seems like a firewall mis-configuration to me, but I don't know how to debug such a problem. I've run nmap on my server for port 1194 and its open so that can't be it. Any help is greatly appreciated![/img][/i]

[Dr_K]

One thing at a time

Your firewall rules

I don't have that router...or use those particular rules..but they should work as I believe many do

Some are not really needed...at least on <Kong> builds

I'm willing to bet that your router does not use tun0 as referenced in your last two rules

My 6300v2 uses tun2 and I recall that fact stumping me for a while

I don't think the log tells you anymore but the openvpn.conf on the router may

Or try changing it and testing

Edit

Just loged in and now see your screenshot

I see you specify tum0 on aditional config.....not sure that will make router honor that though

To be honest I never tried to set it up as a daemon

[Ironclad00]

Thank you for the response, I'll try some of your suggestions. I just switched "Server" mode and it automatically calls the tunnel tun2 as you said so I'll use that from now on. I'll post back if I'm able to figure this out.

[Dr_K]

A suggestion if I may....remove most all that stuff in additional config

When using server mode, most of that is auto populated including most of the firewall rules

It's been awhile since I tested but the above holds more true on <Kong> builds than BS

If you can look at tmp/openvpn/openvpn.conf you'll see what is already there.

Then add to additional config what you feel is missing

Good luck

[egc]

Yes do as @dr_K said, remove everything from additionel config you can use the push route but even that is not necessary of you enable redirect default gateway.

Remove all firewall rules but you need one firewall rule to NAT the VPN.

I am travelling but will post the rule tomorrow.

The GUI normally takes care of all other necessary rules

[Dr_K]

Huummmm.......eager to hear egc's input on this as my understanding of iptables is just slightly better tha limited ¯\_(ツ)_/¯

In much reading and testing...I ended up with 2 for my needs...at least so I thought

iptables -t nat -I POSTROUTING -s xxx.xx.xx.0/29 -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`

iptables -t nat -A POSTROUTING -s xxx.xx.xx.0/29 -o vlan2 -j SNAT --to-source $(nvram get wan_ipaddr)

Change x's to match your vpn's network

I am always learning....

[mrjcd]

there are other preferences but this is what I use:

if 'main gateway router' has the ovpn server then --- at /Diagnostics.asp this should be saved as in Firewall
iptables -t nat -A POSTROUTING -s 10.122.163.240/28 -j MASQUERADE
The IP & netmask should match your ovpn server network.
example my ovpn network: 10.122.163.240/28

in router at /Services.asp this should be put in 'Additional DNSMasq Options' if you want ovpn clients to use local DNS
interface=tun2
Should match router ovpn interface. I think most dd-wrt ovpn server would be tun2
|
|
and then there's
|
|
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
would be only thing used in firewall for ovpn server on a properly configured WAP...
... in this type setup nothing needs added to main router and this will allow ALL clients
connected to the WAPs ovpn server seem as though they are actually on your local network.

[Dr_K]

Thank you mrjcd for chiming in

I too have interface=tun2 in my 'Additional DNSMasq Options' As my uses are as you explain

By no means am I questioning you, but could you or someone maybe explain what my used rules are doing? That may not be optimal.....or wanted.

Am I opening myself up to potentially bad things?

As I did say..."I am always learning" and I do know that just because it works as expected.....doesn't mean it's right!! ¯\(°_o)/¯

Thanks again

[egc]

MASQUERADING is the same as source natting to the out interface ie rules of Dr_K and mrjcd are doing the same.
As the VPN net is usually /24 That should probably be used instead of /29.

@mrjcd does not specify an out interface (which I would do) But as the default gateway is the WAN it works anyway.

I will have more time tomorrow to share my thoughts but as @mrjcd said it is a matter of preferences

[Ironclad00]

Thanks a ton for the replies everyone. I did finally get my VPN working by letting the "Server" (as opposed to "Daemon") setting create most of my config file for me and then debugging from there as suggested by Dr_K.

My client config and firewall rules remained the same except they reference tun2 instead of tun0.

Here's my final server config. I don't know exactly which of the new config lines fixed my problem, so I've left some commentary about different sections that might help anyone also having config issues.

# Everything below is pretty much the same as my original file
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
script-security 2
cipher aes-256-cbc
management 127.0.0.1 14
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
tls-auth /tmp/openvpn/ta.key 0

# My config did not include '-server', but I would be surprised if that was the issue
proto tcp4-server

# The port was not explicitly specified in my original config
port 1194

# The default tun # was indeed 2 so I just left it as that
dev tun2

# These next two lines seem like they def could have caused issues by not being included in my original config
tls-server
auth sha256

# I do not understand what the remaining lines do so they may or may not have helped in getting my VPN functional
syslog
management-log-cache 100
writepid /var/run/openvpnd.pid
topology subnet
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /tmp/openvpn/ccd
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
tcp-nodelay
tun-mtu 1500
mtu-disc yes

[Dr_K]

Thank you egc for looking at my firewall rules and commenting

If I read correctly you said that I am good with what I'm using....

My CIDR ends with /29 because I am limiting my hosts (because I am cautiously paranoid) with a subnet mask of 255.255.255.248

With the plan to expand it on an as needed basis

In my understanding this is correct..?

Ironclad00

Congratulations!!

[egc]

@Ironclad00, nice job you got it working.

@Dr_K yes your rules will work but below some thoughts about the rules, and that is what it is, just my thoughts

Here are your rules:

[Dr_K]

Ironclad00

My apologies for this straying off topic, but to anyone following along....this is good information

Thank you again egc for your detailed input and congratulations for getting me to add yet another bookmark to my already bursting folder's of bookmarks

[mrjcd]

[egc]

The alternative for the rule from @mrjcd is to set the NAT rule for the OVPN subnet on the main router and add a static route on the main router to get the OVPN subnet to the WAP.
So the rule from @mrjcd is an elegant solution especially if the main router is not configurable much.

However there is one drawback all VPN traffic originates from the WAP so you can not differentiate/troubleshoot.

So for larger networks with many clients not my prefered solution.

That said, I am using the rule posted by @mrjcd on my WAP which harbors my backup OVPN server.

P.S. I am also still learning everyday (from forum members like @mrjcd, good idea using a port above 4000) and I am still making stupid mistakes everyday (well perhaps not everyday )