0

Problem:

Connecting to a router via OpenVPN from outside its network and setting all traffic through the VPN allows access to:

  • The router itself

  • The LAN hosts behind the router

    What doesn't work:

  • Network access outside the LAN

  • DNS resolution (although the DNS is pushed through the VPN)

Pinging an outside IP reports "Destination Port Unreachable".

For any request, tcpdump is filled with

12:03:22.070072 IP 10.8.4.2 > 10.8.4.1: ICMP 10.8.4.2 udp port 49763 unreachable, length 93

Where 10.8.4.2 is the client IP and 10.8.4.1 the server (the port changes).

Setup:

  • OpenWRT router (Turris Omnia) with internal network 192.168.10.0/24
  • OpenVPN listening on port 1196 (open and accessible)
  • Port 443 redirected to 1196 on the router (for networks that block 1196)
  • Three zones defined in firewall: vpn, lan, wan.
  • Client: Android 8 client with OpenVPN for Android (Nexus 5X)

openvpn config:

port 1196
proto tcp
dev tun2
ca /etc/openvpn/ca.crt
cert /etc/openvpn/mycrt.crt
key /etc/openvpn/mycrt.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.8.4.0 255.255.255.0
ifconfig-pool-persist /tmp/openvpn/clients/ipp-local.txt
client-config-dir ccd
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 
comp-lzo no
persist-key
persist-tun
status /tmp/log/openvpn-status.log
verb 3
mute 20
push "route 192.168.10.0 255.255.255.0"
push "route 192.168.20.0 255.255.255.0"
mssfix
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
status /var/log/openvpn-server-status.log
topology subnet

The redirect is done in ccd/myclient:

push "redirect-gateway local def1"
push "dhcp-option DNS 192.168.10.1"

Now, the configuration on the openWRT side is:

/etc/config/openvpn

config openvpn 'local_service'
        option config '/etc/openvpn/server-local.conf'
        option enabled '1'

/etc/config/network

config interface 'vpn2'
        option ifname 'tun2'
        option proto 'none'
        option auto '1'

/etc/config/firewall

config zone
        option input 'ACCEPT'
        option output 'ACCEPT'
        option name 'vpn'
        option masq '1'
        option forward 'ACCEPT'
        option mtu_fix '1'
        option network 'vpn2'

config forwarding
        option dest 'vpn'
        option src 'lan'

config forwarding
        option dest 'lan'
        option src 'vpn'

config forwarding
        option dest 'wan'
        option src 'vpn'

config redirect
        option target 'DNAT'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '443'
        option dest_ip '192.168.10.1'
        option dest_port '1196'
        option name 'openvpn https'

Client config:

# Enables connection to GUI
management /data/user/0/de.blinkt.openvpn/cache/mgmtsocket unix
management-client
management-query-passwords
management-hold

setenv IV_GUI_VER "de.blinkt.openvpn 0.6.73" 
setenv IV_PLAT_VER "27 8.1.0 arm64-v8a google bullhead Nexus 5X"
machine-readable-output
allow-recursive-routing
ifconfig-nowarn
client
verb 4
connect-retry 2 300
resolv-retry 60
dev tun
remote my-remote-gateway.example.com 443 tcp-client
<ca>
REDACTED
</ca>
<key>
REDACTED
</key>
<cert>
REDACTED
</cert>
comp-lzo
<tls-auth>
REDACTED
</tls-auth>
key-direction 1
route 0.0.0.0 0.0.0.0 vpn_gateway
verify-x509-name seldon name
remote-cert-tls server
cipher AES-256-CBC
auth SHA512
# Use system proxy setting
management-query-proxy

1 Answer 1

2

Problem solved. There were actually two problems:

  1. Forwarding from the VPN to outside the server was not allowed by the firewall;
  2. The DNS IP specified had a different subnet from the IP assigned via VPN, and it did not work

Enabling forwarding in openWRT between wan and vpn and setting the correct address for the DNS solved the issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.