[buffpatel]

Hello,

5 years ago with help from this forum I was able to successfully set up a site to site OpenVPN tunnel connection from my parents network to my home network. This connection worked both ways and I could ping all devices on their network and they could ping all devices on my network without issue.

I also created different OpenVPN certificates for my cellphone and laptop so when traveling I could connect to my router (OpenVPN server). That way from my laptop or cellphone, I could browse my local network and through the tunnel I could browse my parents network. It was really nice and everything worked as it should.

Link to that thread for review:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=999241

A few days ago I discovered that I can no longer browse either my home network or my parents network with my cellphone or laptop when connected through OpenVPN. I can still ping and access both routers however. I just cannot ping anything on either network. Interestingly, the site to site tunnel connection is still working perfectly. From any device on my home network or any device on my parents network, I can ping any device on the other network.

The strange thing is that I haven't changed any configuration as far as the OpenVPN config goes. I'm wondering if perhaps over the years OpenVPN has changed and so maybe my config might now be outdated.


Both Routers for the OpenVPN tunnel are R8000's running DD-WRT build 44085 (8/7/20)

My config is as follows:

Server IP (my router): 192.168.10.1
Client IP (parents router): 192.168.1.1

Open VPN Server Config is in attached picture:

Additional config:
push "route 192.168.10.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
route 192.168.1.0 255.255.255.0
verb 1
mute 5

Firewall:
#!/bin/sh
OVPN_SERVER="10.1.1.0/24"
OVPN_DEV="tun2"
OVPN_PROTO="udp"
OVPN_PORT="43081"

WAN_IF="$(ip route | awk '/^default/{print $NF}')"

# open the OpenVPN server port
iptables -I INPUT -i $WAN_IF -p $OVPN_PROTO --dport $OVPN_PORT -j ACCEPT
# allow OpenVPN clients to access the OpenVPN server
iptables -I INPUT -i $OVPN_DEV -m state --state NEW -j ACCEPT
# allow OpenVPN clients to access ALL other devices on the LAN
iptables -I FORWARD -i $OVPN_DEV -m state --state NEW -j ACCEPT
# allow local devices to become clients of the remote network
iptables -I FORWARD -o $OVPN_DEV -m state --state NEW -j ACCEPT
# allow OpenVPN clients to use the OpenVPN server as an internet gateway
iptables -t nat -A POSTROUTING -s $OVPN_SERVER -o $WAN_IF -j MASQUERADE


Laptop OpenVPN Config:

client
dev tun
proto udp
tun-mtu 1500
remote ******** 43081
redirect-gateway
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
cipher AES-256-CBC
verb 1
float

ca ca.crt
cert Laptop.crt
key Laptop.key
tls-auth ta.key 1


OpenVPN server log showing my laptop connecting


Serverlog:
20200810 15:30:00 W WARNING: Using --management on a TCP port WITHOUT passwords is STRONGLY discouraged and considered insecure
20200810 15:30:00 W WARNING: file '/tmp/openvpn/ta.key' is group or others accessible
20200810 15:30:00 I OpenVPN 2.4.9 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Aug 7 2020
20200810 15:30:00 I library versions: OpenSSL 1.1.1g 21 Apr 2020 LZO 2.09
20200810 15:30:00 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20200810 15:30:00 I TUN/TAP device tun2 opened
20200810 15:30:00 I /sbin/ifconfig tun2 10.1.1.1 netmask 255.255.255.0 mtu 1500 broadcast 10.1.1.255
20200810 15:30:09 W Could not determine IPv4/IPv6 protocol. Using AF_INET
20200810 15:30:09 I UDPv4 link local (bound): [AF_INET][undef]:43081
20200810 15:30:09 I UDPv4 link remote: [AF_UNSPEC]
20200810 15:30:09 I ifconfig_pool_read() in='MomAndDad 10.1.1.2' TODO: IPv6
20200810 15:30:09 I succeeded -> ifconfig_pool_set()
20200810 15:30:09 I Initialization Sequence Completed
20200810 15:30:12 I ***:48185 peer info: IV_VER=2.4.9
20200810 15:30:12 I ***:48185 peer info: IV_PLAT=linux
20200810 15:30:12 I ***:48185 peer info: IV_PROTO=2
20200810 15:30:12 I ***:48185 peer info: IV_NCP=2
20200810 15:30:12 I ***:48185 peer info: IV_LZ4=1
20200810 15:30:12 I ***:48185 peer info: IV_LZ4v2=1
20200810 15:30:12 I ***:48185 peer info: IV_LZO=1
20200810 15:30:12 I ***:48185 peer info: IV_COMP_STUB=1
20200810 15:30:12 I ***:48185 peer info: IV_COMP_STUBv2=1
20200810 15:30:12 I ***:48185 peer info: IV_TCPNL=1
20200810 15:30:12 I ***:48185 [MomAndDad] Peer Connection Initiated with [AF_INET]***:48185
20200810 15:30:12 I MomAndDad/***:48185 MULTI_sva: pool returned IPv4=10.1.1.2 IPv6=(Not enabled)
20200810 15:34:43 I *****:8010 peer info: IV_VER=2.4.9
20200810 15:34:43 I *****:8010 peer info: IV_PLAT=win
20200810 15:34:43 I *****:8010 peer info: IV_PROTO=2
20200810 15:34:43 I *****:8010 peer info: IV_NCP=2
20200810 15:34:43 I *****:8010 peer info: IV_LZ4=1
20200810 15:34:43 I *****:8010 peer info: IV_LZ4v2=1
20200810 15:34:43 I *****:8010 peer info: IV_LZO=1
20200810 15:34:43 I *****:8010 peer info: IV_COMP_STUB=1
20200810 15:34:43 I *****:8010 peer info: IV_COMP_STUBv2=1
20200810 15:34:43 I *****:8010 peer info: IV_TCPNL=1
20200810 15:34:43 I *****:8010 peer info: IV_GUI_VER=OpenVPN_GUI_11
20200810 15:34:43 I *****:8010 [Laptop] Peer Connection Initiated with [AF_INET]*****:8010
20200810 15:34:43 I Laptop/*****:8010 MULTI_sva: pool returned IPv4=10.1.1.4 IPv6=(Not enabled)
20200810 15:39:35 I *****:8031 peer info: IV_VER=2.4.9
20200810 15:39:35 I *****:8031 peer info: IV_PLAT=win
20200810 15:39:35 I *****:8031 peer info: IV_PROTO=2
20200810 15:39:35 I *****:8031 peer info: IV_NCP=2
20200810 15:39:35 I *****:8031 peer info: IV_LZ4=1
20200810 15:39:35 I *****:8031 peer info: IV_LZ4v2=1
20200810 15:39:35 I *****:8031 peer info: IV_LZO=1
20200810 15:39:35 I *****:8031 peer info: IV_COMP_STUB=1
20200810 15:39:35 I *****:8031 peer info: IV_COMP_STUBv2=1
20200810 15:39:35 I *****:8031 peer info: IV_TCPNL=1
20200810 15:39:35 I *****:8031 peer info: IV_GUI_VER=OpenVPN_GUI_11
20200810 15:39:35 I *****:8031 [Laptop] Peer Connection Initiated with [AF_INET]*****:8031
20200810 15:39:35 I MULTI_sva: pool returned IPv4=10.1.1.4 IPv6=(Not enabled)



If needed I can provide my parents router (OpenVPN client) config as well. I left it out as I don't think it's causing my problem.

Any ideas on why my laptop can only ping the OpenVPN server, but can't reach anything else?

Thanks in advance![img][/img]

[egc]

Things have changed a lot.

See my signature for the Openvpn server setup guide.

Start with disabling the CVE mitigation patch in the OVPN GUI.
This could be your problem.

Have a look at the guide there is only one firewall rule necessary!!

[buffpatel]