Problem:
Connecting to a router via OpenVPN from outside its network and setting all traffic through the VPN allows access to:
The router itself
The LAN hosts behind the router
What doesn't work:
Network access outside the LAN
DNS resolution (although the DNS is pushed through the VPN)
Pinging an outside IP reports "Destination Port Unreachable".
For any request, tcpdump is filled with
12:03:22.070072 IP 10.8.4.2 > 10.8.4.1: ICMP 10.8.4.2 udp port 49763 unreachable, length 93
Where 10.8.4.2 is the client IP and 10.8.4.1 the server (the port changes).
Setup:
- OpenWRT router (Turris Omnia) with internal network 192.168.10.0/24
- OpenVPN listening on port 1196 (open and accessible)
- Port 443 redirected to 1196 on the router (for networks that block 1196)
- Three zones defined in firewall:
vpn
,lan
,wan
. - Client: Android 8 client with OpenVPN for Android (Nexus 5X)
openvpn config:
port 1196
proto tcp
dev tun2
ca /etc/openvpn/ca.crt
cert /etc/openvpn/mycrt.crt
key /etc/openvpn/mycrt.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.8.4.0 255.255.255.0
ifconfig-pool-persist /tmp/openvpn/clients/ipp-local.txt
client-config-dir ccd
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0
comp-lzo no
persist-key
persist-tun
status /tmp/log/openvpn-status.log
verb 3
mute 20
push "route 192.168.10.0 255.255.255.0"
push "route 192.168.20.0 255.255.255.0"
mssfix
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
status /var/log/openvpn-server-status.log
topology subnet
The redirect is done in ccd/myclient
:
push "redirect-gateway local def1"
push "dhcp-option DNS 192.168.10.1"
Now, the configuration on the openWRT side is:
/etc/config/openvpn
config openvpn 'local_service'
option config '/etc/openvpn/server-local.conf'
option enabled '1'
/etc/config/network
config interface 'vpn2'
option ifname 'tun2'
option proto 'none'
option auto '1'
/etc/config/firewall
config zone
option input 'ACCEPT'
option output 'ACCEPT'
option name 'vpn'
option masq '1'
option forward 'ACCEPT'
option mtu_fix '1'
option network 'vpn2'
config forwarding
option dest 'vpn'
option src 'lan'
config forwarding
option dest 'lan'
option src 'vpn'
config forwarding
option dest 'wan'
option src 'vpn'
config redirect
option target 'DNAT'
option src 'wan'
option dest 'lan'
option proto 'tcp'
option src_dport '443'
option dest_ip '192.168.10.1'
option dest_port '1196'
option name 'openvpn https'
Client config:
# Enables connection to GUI
management /data/user/0/de.blinkt.openvpn/cache/mgmtsocket unix
management-client
management-query-passwords
management-hold
setenv IV_GUI_VER "de.blinkt.openvpn 0.6.73"
setenv IV_PLAT_VER "27 8.1.0 arm64-v8a google bullhead Nexus 5X"
machine-readable-output
allow-recursive-routing
ifconfig-nowarn
client
verb 4
connect-retry 2 300
resolv-retry 60
dev tun
remote my-remote-gateway.example.com 443 tcp-client
<ca>
REDACTED
</ca>
<key>
REDACTED
</key>
<cert>
REDACTED
</cert>
comp-lzo
<tls-auth>
REDACTED
</tls-auth>
key-direction 1
route 0.0.0.0 0.0.0.0 vpn_gateway
verify-x509-name seldon name
remote-cert-tls server
cipher AES-256-CBC
auth SHA512
# Use system proxy setting
management-query-proxy