[woodomat]

Hi all,

I'd like to share my VPN configuration with selective routing for getting access to US-only services such as Netflix, Pandora and Hulu. I hope you find it helpful.

0. Initial thoughts

When I started setting up DD-WRT I initially thought about configuring a virtual WLAN that routes EVERYTHING through a (configured) VPN connection that terminates somewhere in the US so that I don't have to deal with advanced routing and identifying miscellaneous IP ranges that the above mentioned services use to stream their content.

I found that rather difficult and besides, it would still have required me to switch WLANs depending whether I want full speed (without VPN) or access US-only services (with VPN, but slower).

Therefore I finally decided to go with a "mixed" configuration, meaning that all connections that require an US-based IP address are being routed through the VPN tunnel and the others not.

1. OpenVPN vs. PPTP

For the VPN connection itself I chose OpenVPN over PPTP as PPTP has some great security issues and usually is slower than OpenVPN. Usually in that case that this is true for all kind of software clients I've tried so far with providers who offer both OpenVPN and PPTP.

Unfortunately the DD-WRT firmware versions I've been using so far (namely 18024 and 18777) are kind of slowing down the whole OpenVPN connection: When using OpenVPN with DD-WRT I get a download rate of around 3-4 Mbit, when using OpenVPN with Tunnelblick that rate improves to around 10 Mbit. No idea why that is the case. Perhaps my routers (a Cisco E4200) CPU is to weak to get better download rates - or there is a bug in DD-WRT. Note that it also doesn't matter if you have an UDP or a TCP connection in DD-WRT. Both are slower than normal.

Concerning bugs: At the time of writing all builds greater than 18777 (latest is 19519) have an OpenVPN bug that renders the usage of the OpenVPN client service unusable. If you want to use OpenVPN you need to stick with any version up to 18777.

2. The actual configuration

In "Services" / "VPN" enable the OpenVPN client and configure the main connection itself according to the instructions of your VPN provider.

I have used both BlackVPN, StrongVPN and Hide My Ass - I personally liked Hide My Ass best as out of these three it had the most servers on the US east side (which is the preferred location if you're in Europe as it is geographically the closest and therefore - in theory - the fastest). All three offer quite good guides specifically for DD-WRT - and all three work fine. Note though that the configurations have been written for older builds of DD-WRT and that sometimes google will point you to antique setup guides that don't make use of the DD-WRT OpenVPN GUI.

You DON'T want to use those!

Find a setup guide for recent versions of DD-WRT - and use the GUI as this is the easiest way by far to get OpenVPN up and running.

Once your connection is up and running - which you want to double check before proceeding - you can configure selective routing.

Here is my routing table, which you can copy-and-paste into the "Additional Config" section of the OpenVPN client configuration in DD-WRT (build 18777):

[kk5000]

Thank you for this VERY informative & useful post. The observation about OpenVPN being broken above 18777 is on the mark. Of course no one has any way of knowing this outside of trial and error. I've been pulling my hair out since yesterday trying to figure out why this was not working until I saw your post, downgraded to 18777 and BANG, worked instantly. If somebody posts asking about all this he will likely be told to RTFM. What good is the stupid manual if the software is broken???? Anyway, I'll stop ranting now.

So thanks for that VERY important piece of info.

I had a couple other questions though. You said you're using HMA but then you also say enable openvpn client. The HMA people specifically tell you not to do that and ask to simply enable "OpenVPN server". If I threw your config into the additional config area of the OpenVPN server will it work?

Secondly, what IP would I substitute into the XXX. area? The VPN IP? That's unique everytime though.

Thank you so much for this post BTW. Exceptional stuff.

[woodomat]

I have been using HMA for a long time but finally moved on to setting up my own OpenVPN server on a virtual machine (on the US east coast)

I'm not quite sure what HMA guide told you to enable the OpenVPN server - please paste the link - but to me that wouldn't make any sense since you don't want to connect to your own DD-WRT router via VPN but rather connect your DD-WRT router to a VPN server (in the US), meaning that the DD-WRT unit is, by definition, the client.

Of course there are scenarios where you'd like to have your DD-WRT router act as a server (i.e. if you'd like to connect to your home network from the road) but the use case I've described in this thread is not one.

Therefore, when it comes to connecting DD-WRT to one of HMA's VPN servers you need to enable OpenVPN Client in the Services tab.

And you need to substitute the XXX.XXX.XXX.XXX IP address with the address of the VPN server you're connecting to (and not the one you're being assigned afterwards as this changes every time as you've pointed out correctly).

[kk5000]

Hi,

Here's the HMA guide I'm talking about :

https://vpn.hidemyass.com/vpncontrol/myaccounts/wrtgen

This is pretty much their default guide. You see this when you login, click "DD-WRT routers", and then generate code under the automated installer after selecting the servers.

It says :

"In the "OpenVPN Daemon" section select "Enable".
Then click "Save".

Note! Do not enable OpenVPN Client."

If I follow all that step by step it does work perfectly as in my outgoing IP changes. Just don't know how to setup your stuff with this

[woodomat]

Thanks for the link.

If you follow these instructions provided by HMA what happens is that your DD-WRT router is being (automagically) setup as an OpenVPN client.

While I haven't taken a closer look at what happens in the script in detail, I'd highly recommend to AVOID using any sort of "automated" setup at all times. Even if that means that you need to take a little more effort in understanding how basic OpenVPN configuration works (but it's not *that* complicated anyway ).

Call me paranoid, but the automated installer doesn't provide any security measure against the script being modified to do bad things (i.e. by someone who has hijacked HMA's webserver) - there are no security measures such as SHA/MD5 checksums whatsoever.

And apart from that you're bound to live with HMA's out-of-the-box configuration, meaning it's impossible for you to change the VPN server you want to connect to (i.e. the one that geographically closest to you) or use features such as additional config (which is necessary for selective routing).

Therefore, do it THIS way:
http://forum.hidemyass.com/index.php/topic/1927-tutorial-configure-hma-openvpn-on-a-dd-wrt-router/

Following that guide will also allow you to use selective routing as I've described above.

Oh and: The only reason why in the instructions on the link you've pasted you're being told to enable the OpenVPN server is to get "OpenVPN" appear in the Status tab, in order to check the assigned IP address. Since you don't configure the server, it really does nothing else at all.

[woodomat]

Also, you might need to reset your DD-WRT router before
manual configuration, since chances are high that it'll interfere
with the automated setup.

[kk5000]

[kk5000]

It works it works! The whole thing works

Now all we have to do is keep up with the IP assignments for these people or perhaps come up with some way that we can just plug in a FQDN like movies.netflix.com for the routing.

That works with one of our corporate Sonicwall routers but that's a whole other story.

[kk5000]

Also, how does one go about putting a list together for a particular site? If there an app that can detect all IPs we're connecting to I would volunteer to report all Hulu IPs for instance.

I also wanted to reroute Disney.go.com for the kids so I looked up their IP assignment which is apparently 68.71.208.0 - 68.71.223.255 :

http://whois.arin.net/rest/net/NET-68-71-208-0-1/pft

route 68.71.208.0 255.255.240.0 vpn_gateway

did very nicely.

If only all the rest of them were that easy

Also, Viacom is a big media company and the only reason to watch their sites (as far as I can think) is video content they happen to block so I did this too:

129.228.0.0 255.255.128.0 vpn_gateway
166.77.0.0 255.255.0.0 vpn_gateway
206.220.40.0 255.255.252.0 vpn_gateway

However that STILL didn't seem to give me :

http://www.nick.com/videos/clip/ygst-107-full-episode.html

They very nicely show me the ads and then lock me out. I will debug that later especially if I can find an app that detects the IP in a reliable fashion. 5:30 AM. Going to bed.

[woodomat]

Glad to hear that everything works as intended

I'm absolutely with you - we should try to collect ip-ranges for US-based services somewhere... Perhaps the dd-wrt wiki would be a good place for this?

Regarding the collection itself: I found Wireshark being a very useful tool as it can capture all ip connections that are being made to the outside world. I then ran "whois (IP address)" in my terminal and that returned all entire range.

Btw. thanks for the Nick IPs - have already added them to my config!

[kk5000]

OK so I got this so far :

# disney.go.com - WORKS
route 68.71.208.0 255.255.240.0 vpn_gateway

# Viacom i.e. nick.com and all that crap - WORKS
route 129.228.0.0 255.255.128.0 vpn_gateway
route 166.77.0.0 255.255.0.0 vpn_gateway
route 206.220.40.0 255.255.252.0 vpn_gateway
route 69.31.132.0 255.255.254.0 vpn_gateway
route 72.246.0.0 255.254.0.0 vpn_gateway

# CBS - WORKS
route 198.99.118.0 255.255.254.0 vpn_gateway
route 198.99.120.0 255.255.254.0 vpn_gateway
route 198.99.122.0 255.255.255.0 vpn_gateway

# NBC WORKS
route 66.77.124.0 255.255.255.0 vpn_gateway

# ABC & general Disney range works
route 199.181.129.0 255.255.255.0 vpn_gateway
route 199.181.130.0 255.255.254.0 vpn_gateway
route 199.181.132.0 255.255.252.0 vpn_gateway

# Disney (ESPN) STILL NOT WORKING!!
route 68.71.208.0 255.255.240.0 vpn_gateway
route 192.147.170.0 255.255.255.0 vpn_gateway
route 198.105.192.0 255.255.248.0 vpn_gateway
route 69.31.132.0 255.255.254.0 vpn_gateway
route 107.8.0.0 255.248.0.0 vpn_gateway

# FOX NOT WORKING YET!
route 88.221.94.0 255.255.254.0 vpn_gateway
route 192.204.0.0 255.255.0.0 vpn_gateway

#COMCAST Just got this off the ESPN connection so far
route 207.223.0.0 255.255.240.0 vpn_gateway

BTW when I say not working it just means more ranges need to be added

[woodomat]

thanks again! for some reason disney doesn't work for me yet, but I will try to add some ranges using wireshark!

[jimmyk]

Thank you, Woodomat.

The route command in openvpn option is very useful. I can integrate the route command here other than have another vpn-up.sh script.

But I have another question off the topic. I cannot have clients to access through the OpenVPN tunnel unless I execute this command:

[goli]

Hey there.

I started using privoxy as a transparent proxy on my dd-wrt box. And I use another HTTP proxy on the OpenVPN entpoint side. For me this is no problem because the remote endpoint is a VPS completely managed by myselfe.

This allows me to filter HTTP requests by very fine grained rules on my local side that aren't based on current IP addresses.

Especially when you start doing youtube through such a proxy, this becomes very importent because it's the only managable way to avoid doing all google traffic throug an oversea VPN.

Here's my current local privoxy configuration on my dd-wrt box. It's a useractions file.

[kk5000]