[ccorrea]

Hi guys need your help regading the following:

Netgear R7000p
Firmware: DD-WRT v3.0-r58163 std (08/25/24)

I need your help for creating iptables or anything that allow me to have only one dedicated ethernet port for Openvpn (Cyberghost) and if the VPN is down, shut down the internet access for that Ethernet port.

[eibgrad]

You just need to use the GUI to create a new unbridged VLAN (e.g., vlan3) w/ a dedicated port assignment (move it from vlan1 to your new VLAN) and assign it a new IP network (e.g., 192.168.2.1/24). Then using PBR (policy based routing) w/ the OpenVPN client to only route that traffic over the VPN, while enabling the kill switch option.

[ccorrea]

How can I assign an ip network address to a vlan?

[eibgrad]

Once you create the VLAN, go to Setup->Networking->Interface Setup. You should see the new VLAN, and probably configured as Default. If you change it to Unbridged, it will reveal addition options which include IP assignment, NAT, etc. You can also add a DHCP server for the new VLAN at the bottom of that same page.

Note, when dealing w/ new VLANs and VAPs, you might have to reboot between changes before all options will appear or otherwise be configurable. IOW, the system doesn't always immediately recognize these types of changes appropriately w/o a reboot.

[ccorrea]

So for so good, but how can I configure the killswitch?

[eibgrad]

The kill switch is just a checkbox on the VPN page.

[ccorrea]

Thank you so much, how can I simulate the VPN is down just be sure any device is not accessing the Internet?

[eibgrad]

Using ssh or telnet, kill the running OpenVPN client process.

[ccorrea]

eibgrad, thank you so much for your help

[egc]

Questions about OpenVPN (PBR, Killswitch etc.) can be found in the OpenVPN guides a sticky (first few sticky threads) in this forum.
See: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398

In your case you need the OpenVPN Client setup guide

[ccorrea]

Hi, I need your help again, after a night without using the VPN I see it is down, what can I do for always having the VPN up and running?

[eibgrad]

Enable the Watchdog option on the OpenVPN client.

As @egc indicated previously, a lot of this information is already provided in the OpenVPN Client Setup Guide.

[eibgrad]

P.S. I'm not sure if the OpenVPN Client Setup Guide mentions this directly (TLDR), but for maximum reliability, it's generally a good idea to specify *multiple* servers within the OpenVPN client configuration. Chances are the use of a domain name for the server will result in multiple possible IPs for the client to choose from should any fail to connect. But in the event this isn't the case, or the VPN provider only offers explicit IPs, it's best to specify at least three (3) servers in case any one goes down for an extended period of time (e.g., for maintenance). In such a situation, it's NOT going to matter if the watchdog is running if the one and only server available in the config remains unreachable.

[ccorrea]

Hello Guys, I'm having another issue.

As you know I have the Netgear R7000p with a dedicated ethernet port for a VLAN that I'm only using for one PC for accesing thru the CyberGhost VPN (OpenVPN), so when I test its speed (using speedtest) it shos around 30 Mbps (too slow). But when I do the same test with the Cyberghost app using a port outside the VLAN I mensioned previusly (the one dedicated for OpenVPN), I have around 270 Mbps.

So, what can I do to increase speed on the VPN for the dedicated VLAN?

[egc]

Use WireGuard instead of OpenVPN, should give you three times the speed of openvpn, my R7000 does over 100 Mb on WireGuard.