OpenVPN server setup guide by egc

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page Previous  1, 2, 3, 4, 5  Next
Author Message
SomeOtherGuy2
DD-WRT Novice


Joined: 17 Jun 2019
Posts: 4

PostPosted: Tue Jul 02, 2019 3:04    Post subject: openVPN with static ip Reply with quote
I recently changed to a new-in-town fiber optic isp. I bought a Netgear 7800 and flashed the appropriate dd-wrt (build 40065). I'm following the above guide attempting to provide secure access to my desktop from my laptop when on the road. My issue is that with this isp the WAN ip address shown on the dd-wrt status page is different than the one I get from what's my ip or via my DDNS service. I'm told that to get OpenVPN working I have to get a static ip address from my isp, which I've requested. My question is, once I get it, what changes do I have to make to the procedure described in your excellent guide to accomplish my objective?
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3664
Location: Netherlands

PostPosted: Tue Jul 02, 2019 15:49    Post subject: Reply with quote
I am not sure if the problem is static versus dynamic, because if you have a dynamic address that is what DDNS is for.

Could it be that your new router is in router mode so that you are double natted?

Your new router should be in bridged/modem mode or you should place your R7800 in the DMZ of the ISP router, in that case enable "Use external IP check" on the DDNS page

This does not sound like an OVPN problem

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
SomeOtherGuy2
DD-WRT Novice


Joined: 17 Jun 2019
Posts: 4

PostPosted: Tue Jul 02, 2019 21:11    Post subject: Reply with quote
Quote:
Your new router should be in bridged/modem mode or you should place your R7800 in the DMZ of the ISP router, in that case enable "Use external IP check" on the DDNS page


I suspect that you are correct about the "double natted" business. The WAN ip shown on the dd-wrt status page begins with 100, which my research tells me is "reserved for carrier NAT". Does this mean that there is NAT going on before the signal ever gets to my house? Additionally, there is a VoIP box between the ISP-provided modem and my R7800, which may or may not functioning as an ISP router. Unfortunately I'm a networking newbie, and it is not apparent to me how to get my 7800 in the bridged/modem mode or place it in the DMZ of the ISP router. Following a guide I've found elsewhere in these forums, I've connected the ISP-provided modem directly to one of the computers on the network and run "ipconfig /all", and believe I've determined the router's ip address and the ip address provided to the client (both beginning with 100, and therefore not on the same network as the 7800 and my networked computers, whose addresses begin with 192). I have not yet figured out what to do with this information.
TOG_WAS_HERE
DD-WRT Novice


Joined: 02 Oct 2018
Posts: 17

PostPosted: Wed Jul 03, 2019 0:46    Post subject: error:0B080074:x509 Reply with quote
You've fixed my issue of it not showing anything the OpenVPN tab of DD-WRT! But unfortunately, got an error: error:0B080074:x509 (client side)

I got this error when right-clicking the .ovpn file and pressing "Start OpenPVN on this config file?
Tried it on two PCs and same error. Possibly I misconfigured something...

I've also tried importing it in the OpenVPN GUI but I get "exit code 1"
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3664
Location: Netherlands

PostPosted: Wed Jul 03, 2019 9:13    Post subject: Reply with quote
SomeOtherGuy2 wrote:
Quote:
Your new router should be in bridged/modem mode or you should place your R7800 in the DMZ of the ISP router, in that case enable "Use external IP check" on the DDNS page


I suspect that you are correct about the "double natted" business. The WAN ip shown on the dd-wrt status page begins with 100, which my research tells me is "reserved for carrier NAT". Does this mean that there is NAT going on before the signal ever gets to my house? Additionally, there is a VoIP box between the ISP-provided modem and my R7800, which may or may not functioning as an ISP router. Unfortunately I'm a networking newbie, and it is not apparent to me how to get my 7800 in the bridged/modem mode or place it in the DMZ of the ISP router. Following a guide I've found elsewhere in these forums, I've connected the ISP-provided modem directly to one of the computers on the network and run "ipconfig /all", and believe I've determined the router's ip address and the ip address provided to the client (both beginning with 100, and therefore not on the same network as the 7800 and my networked computers, whose addresses begin with 192). I have not yet figured out what to do with this information.


If your ISP router is behing a cg nat network (which indeed uses addresses starting with 100) you are in trouble. Ask your ISP about it and ask for a public IP address for your ISP router or for a solution where they do port forward to your router.

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3664
Location: Netherlands

PostPosted: Wed Jul 03, 2019 9:15    Post subject: Re: error:0B080074:x509 Reply with quote
TOG_WAS_HERE wrote:
You've fixed my issue of it not showing anything the OpenVPN tab of DD-WRT! But unfortunately, got an error: error:0B080074:x509 (client side)

I got this error when right-clicking the .ovpn file and pressing "Start OpenPVN on this config file?
Tried it on two PCs and same error. Possibly I misconfigured something...

I've also tried importing it in the OpenVPN GUI but I get "exit code 1"



We can better help you if you start a new thread, stating your router, your build number and your problem and the solutions you already tried.

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
SomeOtherGuy2
DD-WRT Novice


Joined: 17 Jun 2019
Posts: 4

PostPosted: Wed Jul 10, 2019 19:46    Post subject: Reply with quote
Quote:
If your ISP router is behing a cg nat network (which indeed uses addresses starting with 100) you are in trouble. Ask your ISP about it and ask for a public IP address for your ISP router or for a solution where they do port forward to your router.

I got a static ip addresss from my isp and configured my router to use it. I'm still having issues with OpenVPN, however, getting the "TLS Negotiation failed etc." in the client's log. I'm seeing something strange in the router's OpenVPN status page (screenshot attached). The first several entries list the time and date as Dec 31, 1969, and include a message "Warning: your certificate is not yet valid". The certificates are valid 7/3/2019 to 6/30/2029. However, after the line "initialization sequence completed", the date and time on the subsequent lines are shown correctly. On the basic setup page, I have enabled the NTP client, selected the appropriate time zone (eastern US) and left the server/ip box empty. In your OpenVPN troubleshooting guide, the server log you show has the same recent date throughout, and the certificate not valid warning is absent, so I'm assuming that this is my OpenVPN problem. I just don't know how to solve it.
SomeOtherGuy2
DD-WRT Novice


Joined: 17 Jun 2019
Posts: 4

PostPosted: Wed Jul 10, 2019 20:55    Post subject: Never mind Reply with quote
Quote:
I'm still having issues with OpenVPN, however, getting the "TLS Negotiation failed etc." in the client's log
I had been trying to connect while at home and failing as above. I went down to the local public library and was able to connect successfully over their wifi connection. Problem solved!
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3664
Location: Netherlands

PostPosted: Thu Jul 11, 2019 6:51    Post subject: Reply with quote
Great, yes you can not connect from your own network, you have to use cellular or a public wifi
_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
wcnngt
DD-WRT Novice


Joined: 06 Dec 2011
Posts: 7

PostPosted: Mon Aug 19, 2019 12:12    Post subject: Reply with quote
I am trying to connect a dd-wrt router (A) behind a primary router (B) to another router (C) running dd-wrt openvpn. My goal is to access Internet through C's IP from A.
I followed the instruction exactly, setting
C: 192.168.1.1, VPN subnet: 10.8.0.0
B: 192.168.0.1
A: 192.168.2.1

I set "Redirect Default Gateway" to enable and first tried openvpn client by iphone. Using the firewall rule below won't get me to Internet.
iptables -t nat -A POSTROUTING -o $(nvram get wan_iface) -j MASQUERADE

I am able to go to Internet if I use:
WAN_IF="$(route -n | awk '/^0.0.0.0/{wif=$NF} END {print wif}')"
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o $WAN_IF -j MASQUERADE

So I settled on the later. Then I tried to setup router A. But the vpn won't work. After setting NAT to enable on the VPN page in A, I don't understand this paragraph in the instruction:
"Furthermore you have to NAT the clients traffic out of the WAN of the OVPN server if you want to have internet access, you already have a NAT rule to route the OVPN servers traffic but in this case you should use the general NAT rule"

Do I have to do anything? I will attached the log in a second post.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3664
Location: Netherlands

PostPosted: Mon Aug 19, 2019 13:53    Post subject: Reply with quote
wcnngt wrote:
I am trying to connect a dd-wrt router (A) behind a primary router (B) to another router (C) running dd-wrt openvpn. My goal is to access Internet through C's IP from A.
I followed the instruction exactly, setting
C: 192.168.1.1, VPN subnet: 10.8.0.0
B: 192.168.0.1
A: 192.168.2.1

I set "Redirect Default Gateway" to enable and first tried openvpn client by iphone. Using the firewall rule below won't get me to Internet.
iptables -t nat -A POSTROUTING -o $(nvram get wan_iface) -j MASQUERADE

I am able to go to Internet if I use:
WAN_IF="$(route -n | awk '/^0.0.0.0/{wif=$NF} END {print wif}')"
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o $WAN_IF -j MASQUERADE

So I settled on the later. Then I tried to setup router A. But the vpn won't work. After setting NAT to enable on the VPN page in A, I don't understand this paragraph in the instruction:
"Furthermore you have to NAT the clients traffic out of the WAN of the OVPN server if you want to have internet access, you already have a NAT rule to route the OVPN servers traffic but in this case you should use the general NAT rule"

Do I have to do anything? I will attached the log in a second post.


Both NAT rules should work in 99,9 % of setups.
So either there is a typo in the first rule or you have a "non-standard" setup.
So tell us a bit more about router C where you have the OVPN server running.
Router model, build, setup, i.e. is this router connected with its WAN port to the internet and in normal gateway setup, has the WAN port a public IP? etc.

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
wcnngt
DD-WRT Novice


Joined: 06 Dec 2011
Posts: 7

PostPosted: Mon Aug 19, 2019 14:05    Post subject: Reply with quote
Router C is Netgear R6400 v1 running DD-WRT v3.0-r40527 std (08/04/19).
It is normal gateway setup and connects to public internet via PPPOE login. I also setup the DDNS through No-ip.
I will post some logs once I get home.

Because OpenVPN did not work, I also played around with PPTP to achieve the same goal. But i could not find an instruction written as detailed as yours.

Thanks a lot for your help.



egc wrote:
wcnngt wrote:
I am trying to connect a dd-wrt router (A) behind a primary router (B) to another router (C) running dd-wrt openvpn. My goal is to access Internet through C's IP from A.
I followed the instruction exactly, setting
C: 192.168.1.1, VPN subnet: 10.8.0.0
B: 192.168.0.1
A: 192.168.2.1

I set "Redirect Default Gateway" to enable and first tried openvpn client by iphone. Using the firewall rule below won't get me to Internet.
iptables -t nat -A POSTROUTING -o $(nvram get wan_iface) -j MASQUERADE

I am able to go to Internet if I use:
WAN_IF="$(route -n | awk '/^0.0.0.0/{wif=$NF} END {print wif}')"
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o $WAN_IF -j MASQUERADE

So I settled on the later. Then I tried to setup router A. But the vpn won't work. After setting NAT to enable on the VPN page in A, I don't understand this paragraph in the instruction:
"Furthermore you have to NAT the clients traffic out of the WAN of the OVPN server if you want to have internet access, you already have a NAT rule to route the OVPN servers traffic but in this case you should use the general NAT rule"

Do I have to do anything? I will attached the log in a second post.


Both NAT rules should work in 99,9 % of setups.
So either there is a typo in the first rule or you have a "non-standard" setup.
So tell us a bit more about router C where you have the OVPN server running.
Router model, build, setup, i.e. is this router connected with its WAN port to the internet and in normal gateway setup, has the WAN port a public IP? etc.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3664
Location: Netherlands

PostPosted: Mon Aug 19, 2019 14:20    Post subject: Reply with quote
Even for PPPoE both rules should work, interesting.

Can you show the output on router C of:
Code:
nvram show | grep wan_ifname

ip route show


Regardless this queston if the second rule works with your Iphone it should normally work with your other ddwrt router setup as an OVPN client, if you follow the guide.

So post a picture of the setup page and status page (whole page) of OVPN server and OVPN client router (keeps you bizzy Smile )

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
wcnngt
DD-WRT Novice


Joined: 06 Dec 2011
Posts: 7

PostPosted: Tue Aug 20, 2019 0:01    Post subject: Reply with quote
I put screenshots and log here
https://drive.google.com/drive/folders/1t5zkCVX05vA4mxLhw9_-1ugY6BHS9339

Thanks a lot.


egc wrote:
Even for PPPoE both rules should work, interesting.

Can you show the output on router C of:
Code:
nvram show | grep wan_ifname

ip route show


Regardless this queston if the second rule works with your Iphone it should normally work with your other ddwrt router setup as an OVPN client, if you follow the guide.

So post a picture of the setup page and status page (whole page) of OVPN server and OVPN client router (keeps you bizzy Smile )
wcnngt
DD-WRT Novice


Joined: 06 Dec 2011
Posts: 7

PostPosted: Tue Aug 20, 2019 1:58    Post subject: Reply with quote
It seems to be related to

Aug 19 23:50:38 DD-WRT daemon.warn openvpn[951]: WARNING: Failed running command (--route-up): external program exited with error status: 2
Aug 19 23:50:38 DD-WRT daemon.warn openvpn[951]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

I read the troubleshooting guide and it seems to be due to k2.6 not being able to execute external scripts. Is there any workaround other than finding a k3 build. My router is F7D4301v1 and according to the router database, the latest is a k2.6 build.

wcnngt wrote:
I put screenshots and log here
https://drive.google.com/drive/folders/1t5zkCVX05vA4mxLhw9_-1ugY6BHS9339

Thanks a lot.


egc wrote:
Even for PPPoE both rules should work, interesting.

Can you show the output on router C of:
Code:
nvram show | grep wan_ifname

ip route show


Regardless this queston if the second rule works with your Iphone it should normally work with your other ddwrt router setup as an OVPN client, if you follow the guide.

So post a picture of the setup page and status page (whole page) of OVPN server and OVPN client router (keeps you bizzy Smile )
Goto page Previous  1, 2, 3, 4, 5  Next Display posts from previous:    Page 4 of 5
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum