4

I've been banging my head against the wall on this for a week, so thought I'd finally turn to the experts. Much appreciated for any help.

[Note: originally posted this on ServerFault, was told this is a better place for it.]

What I'm trying to do: I have some resources on my local (home) network that I'd like to be able to access remotely. I need to be able to access them both on remote computers as well as on iOS devices. This last point means that I have to use TUN rather than TAP, as the iOS OpenVPN client doesn't support TAP. (It would also be nice to be able to use this VPN to access the broader internet when I'm in a sketchy public wifi area, but that's a secondary goal.)

What I've done so far: I have an old Linksys e1200 router, flashed DD-WRT with OpenVPN support on it (specifically DD-WRT v24-sp2 (06/07/14) vpnkong), and have successfully set up the OpenVPN & forwarded the ports from my main router so that I can connect to it remotely. (I know I can connect, because when I log into the VPN remotely I can access the routers admin page.) However, once my remote client is connected, I can't access the LAN resources.

I've been futzing around with all sorts of OpenVPN config/port forwarding/iptables commands but can't seem to get anything to work. That said, I'm pretty new at this level of network configuration, and am trying to learn how routing works, so if I'm doing something stupid, let me know; it's all changeable.

My setup:

<The Internets>
     |
     |
--------------------------------
|   DSL modem                  |
|   Internal IP: 192.168.1.254 |
--------------------------------    
       |    
       |
-------------------------------          ----------------------------------
| Main router                 |          |  DD-WRT router running OpenVPN | 
|  192.168.1.67 from modem    | -------- |  IP:  10.0.0.17                |
|  Internal IP:  10.0.0.1     |          |  Subnet Mask: 255.255.255.0    |
|  Subnet Mask: 255.255.255.0 |          |  Gateway:  10.0.0.1            |
|  Hands out:  10.0.0.32-254  |          |  OpenVPN is server             |
|                             |          |       10.0.1.16/225.255.255.240|
-------------------------------          ----------------------------------
      |                                              |
      |                                              | 
Other things connected here       And some connected here as well, for testing

I'm pretty sure that the DSL modem and the Main router are port forwarding correctly, since I'm able to connect the the DD-WRT router and OpenVPN remotely. I'm running things over TCP on port 443. (I do realize I have double NAT going on here, could change that if that's a problem. I could also plug the OpenVPN server directly into the DSL modem if that would be helpful in some way.)

I also know that when I hard plug my computer into the DD-WRT router, I can access all the LAN resources I want. So at least that is working correctly locally.

My current OpenVPN config:

server 10.0.1.16 255.255.255.240
push "dhcp-option DNS 10.0.0.1"
push "route 10.0.1.0 255.255.254.0"
push "route 10.0.0.0 255.255.254.0"
route 10.0.1.0 255.255.254.0
route 10.0.0.0 255.255.254.0
dev tun0
proto tcp
port 443
keepalive 15 30
cipher AES-256-CBC
daemon
verb 5
mute 5 
comp-lzo 
duplicate-cn 
tls-server 
client-to-client 
dh /tmp/openvpn/dh.pem c
a /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.pem 
key /tmp/openvpn/key.pem 
management localhost 14 

My current firewall on the OpenVPN router:

iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT
iptables -I FORWARD 1 --source 10.0.0.0/23 -j ACCEPT
iptables -t nat -s 10.0.0.0/23 -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -J ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT

Other random (helpful?) information: On the OpenVPN router I have the WAN & DHCP disabled. In the "Setup > Advanced Routing" screen I have the operating mode set to "RIP2 Router" (my Main router is a RIP2 router also).

The Routing table on the DD-WRT:

Destination  Subnet Mask        Gateway     Flags   Metric  Interface
10.0.1.18    255.255.255.255    0.0.0.0     UH      0       tun0
10.0.1.16    255.255.255.240    10.0.1.18   UG      0       tun0
10.0.0.0     255.255.255.0      0.0.0.0     U       0       LAN & WLAN
10.0.0.0     255.255.254.0      10.0.1.18   UG      0       tun0
169.254.0.0  255.255.0.0        0.0.0.0     U       0       LAN & WLAN
0.0.0.0      0.0.0.0            10.0.0.1    UG      0       LAN & WLAN

I'm happy to post whatever other info would be helpful. Thank you again! Much appreciated in advance.

2
  • You need to describe exactly what sort of "lan resources" you are trying to access, and how, and what exactly you mean by "not working". Some LAN resources require local broadcast discovery, which requires tap, some do not. Some require port forwards and/or NAT, some do not.
    – qasdfdsaq
    Jul 1, 2015 at 11:09
  • Did you ever manage to figure this out? I'm attempting something similar (trying to expose services on a local LAN by running a VPN server in the same network and then connecting from anywhere for secure access).
    – Some Guy
    Aug 12, 2020 at 12:14

1 Answer 1

-1

Simplicity is a beautiful thing.

Rather use Mega / dropbox clients on your devices. If you need to print to local printers, install CloudPrint (Android) or a variant for iOS.

Otherwise take the easy VPN route and use TeamViewer VPN. Make sure the IP range is different on the client & host network. VPN's can be tricky, just 1 incorrect preference and it will not work as expected.

I'd swop the routers around and make what is currently the main router , into a simple dumb switch that accepts DHCP from the 'new' main router.

1
  • Thanks for the suggestions. What I'm really looking to do on the VPN is get access to my local IP cameras (e.g., "nanny" or "security" cams) remotely. I don't really trust the corporate "cloud" camera storage services (especially since some of them broadcast over insecure http). I also don't have (or really want to have) a local machine set up to run a VPN server on so was looking for something that would run on the router hardware. (Hence installing DD-WRT.) But I will definitely try swapping the order of the routers and which one acts as the DHCP server! Will update on results.
    – Q A
    Jun 25, 2015 at 13:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .