Cannot access internet and local DNS server using OpenVPN on DD-WRT router

Question

I tried to setup Dnsmasq and OpenVPN server on my DD-WRT router.

My goal is to connect to my dd-wrt (v24-sp2 (03/25/13) mega) router via openvpn and:

use my local resources,
address to them using dns names I entered in dnsmasq config
route all my internet traffic through home.

I have made some config of OpenVPN server and dnsmasq and now option one is working.

But I have no idea how to make work options two and three. Can somebody help me?

Client config (OpenVPN v2.3.4):

client
dev tun
proto udp
remote some.server.net 11193
redirect-gateway

cipher AES-128-CBC
auth MD5

ca ca.crt
cert client.crt
key client.key

nobind
comp-lzo
persist-key
persist-tun
verb 3
float

#resolv-retry infinite

OpenVPN Server config (I used GUI mode):

Firewall config commands on router:

iptables -I INPUT 1 -p udp --dport 11193 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.144.128/25 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.144.128/25 -o vlan2 -j SNAT --to-source XX.XX.XX.XX

DNSMasq settings:

My local area settings (if it is matter): DHCP settings

What shows ipconfig /all when vpn is connected (sorry for non-english console): ipconfig /all on W8 client

What shows ifconfig -a command

br0       Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:C9  
          inet addr:192.168.144.126  Bcast:192.168.144.127  Mask:255.255.255.128
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1314791 errors:0 dropped:0 overruns:0 frame:0
          TX packets:520087 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1212860286 (1.1 GiB)  TX bytes:35424179 (33.7 MiB)
br0:0     Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:C9  
          inet addr:169.254.255.1  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
eth0      Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:C9  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2132892 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1772722 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1428506146 (1.3 GiB)  TX bytes:1357054830 (1.2 GiB)
          Interrupt:4 Base address:0x2000 
eth1      Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:CB  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:20244 errors:0 dropped:0 overruns:0 frame:24589427
          TX packets:116648 errors:47 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1931745 (1.8 MiB)  TX bytes:41642341 (39.7 MiB)
          Interrupt:3 Base address:0x1000 
eth2      Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:CC  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:28 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:6 Base address:0x8000 
etherip0  Link encap:Ethernet  HWaddr 4E:A6:FB:D5:97:10  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
          RX packets:612 errors:0 dropped:0 overruns:0 frame:0
          TX packets:612 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:127026 (124.0 KiB)  TX bytes:127026 (124.0 KiB)
ppp0      Link encap:Point-to-Point Protocol  
          inet addr:XX.XX.XX.XX  P-t-P:YY.YY.YY.YY  Mask:255.255.255.255
          UP POINTOPOINT RUNNING MULTICAST  MTU:1492  Metric:1
          RX packets:328586 errors:0 dropped:0 overruns:0 frame:0
          TX packets:564238 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:40074316 (38.2 MiB)  TX bytes:674767309 (643.5 MiB)
teql0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
tun2      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:192.168.144.129  P-t-P:192.168.144.129  Mask:255.255.255.128
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:3195 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3725 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:251990 (246.0 KiB)  TX bytes:2682328 (2.5 MiB)
tunl0     Link encap:UNSPEC  HWaddr 00-00-00-00-FF-80-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
vlan0     Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:C9  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
vlan1     Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:C9  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1034054 errors:0 dropped:0 overruns:0 frame:0
          TX packets:508091 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1174793178 (1.0 GiB)  TX bytes:37167391 (35.4 MiB)
vlan2     Link encap:Ethernet  HWaddr C0:C1:C0:D1:0F:CA  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1098545 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1264631 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:215018185 (205.0 MiB)  TX bytes:1319887439 (1.2 GiB)

UPDATE1:

Using a clue from András Korn found a solution for option two (link). I added register-dns and pull lines in client vpn config and interface=tun2 line in additional dnsmasq options field.

And I added the third line into firewall config commands.

I assume that some of my iptables commands are wrong because I used wrong interfaces (vlanX or ethX).

UPDATE2:

Additional info

What shows route print command before activating VPN

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric 
          0.0.0.0          0.0.0.0  192.168.192.254  192.168.192.147     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
    192.168.192.0    255.255.255.0         On-link   192.168.192.147    281
  192.168.192.147  255.255.255.255         On-link   192.168.192.147    281
  192.168.192.255  255.255.255.255         On-link   192.168.192.147    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link   192.168.192.147    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link   192.168.192.147    281
===========================================================================
Persistent Routes:
  None

What shows route print command after activating VPN (routes possibly related to VPN marked with minus sign)

Network Destination        Netmask          Gateway       Interface  Metric 
          0.0.0.0          0.0.0.0  192.168.192.254  192.168.192.147     25
          0.0.0.0        128.0.0.0  192.168.144.129  192.168.144.131     20 ----
      XX.XX.XX.XX  255.255.255.255  192.168.192.254  192.168.192.147     25 ---- To my DD-WRT router (XX.XX.XX.XX = WAN IP)
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0  192.168.144.129  192.168.144.131     20 ----
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
  192.168.144.128  255.255.255.128         On-link   192.168.144.131    276 ----
  192.168.144.131  255.255.255.255         On-link   192.168.144.131    276 ---- Probably routes to my VPN subnet
  192.168.144.255  255.255.255.255         On-link   192.168.144.131    276 ----
    192.168.192.0    255.255.255.0         On-link   192.168.192.147    281
  192.168.192.147  255.255.255.255         On-link   192.168.192.147    281
  192.168.192.255  255.255.255.255         On-link   192.168.192.147    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link   192.168.192.147    281
        224.0.0.0        240.0.0.0         On-link   192.168.144.131    276 ----
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link   192.168.192.147    281
  255.255.255.255  255.255.255.255         On-link   192.168.144.131    276 ----
===========================================================================
Persistent Routes:
  None

What shows tracert google.com command:

Tracing route to google.com [188.35.142.42]
over a maximum of 30 hops:

  1    10 ms     7 ms     9 ms  192.168.144.129
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  ................................................

You want to cause the openvpn config to include a push "dhcp-option DNS 192.168.144.126" directive (if that's where dnsmasq listens). The client config needs to include pull and register-dns. You should change redirect-gateway to redirect-gateway def1. — András Korn, Sep 2, 2014 at 21:14
Hello! Thank you very much for your help! As I understand, commands pull and register-dns made my openvpn client to redirect dns queries to my router (192.168.144.126 in home network or 192.168.144.129 in vpn subnet). My client started to send dns queries through vpn (+) but router sends no answer (-). I tried with disabled firewall both push "dhcp-option DNS 192.168.144.126" and push "dhcp-option DNS 192.168.144.129" — SLenik, Sep 3, 2014 at 9:55
I can't give you specific instructions because I'm not intimately familiar with dnsmasq. Make sure it listens on the address you're pushing to the client as the DNS server, and make sure it is configured to accept requests from the client's address. — András Korn, Sep 3, 2014 at 14:24
THank you very much! Using your clue found a solution for dnsmasq. Only internet remains. Maybe you can help me in this question either?) — SLenik, Sep 6, 2014 at 5:44
Please show us the routing table of the client (route print) when it's connected to the VPN, and some tracert output that shows what way it's actually routing traffic. — András Korn, Sep 7, 2014 at 21:26

András Korn · Accepted Answer · 2014-09-09 14:56:01Z

2

OK, regarding the Internet access part of your question, I think your

iptables -t nat -A POSTROUTING -s 192.168.144.128/25 -o vlan2 -j SNAT --to-source XX.XX.XX.XX

is wrong. vlan2 should be ppp0 (because ppp0 is your internet facing Interface).

A simpler rule like

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

should also work.

answered Sep 9, 2014 at 14:56

András Korn

3501 silver badge8 bronze badges

Worked with iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE. Many thanks to you!
– SLenik
Sep 11, 2014 at 9:37

Add a comment |

tkrn · Accepted Answer · 2017-05-10 18:46:02Z

Andras - Would it be vlan2 in my case? Thanks!

br0       Link encap:Ethernet  HWaddr CC:E1:D5:3A:B2:80
          inet addr:192.168.11.1  Bcast:192.168.11.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:424601 errors:0 dropped:21377 overruns:0 frame:0
          TX packets:475454 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:70115596 (66.8 MiB)  TX bytes:585654624 (558.5 MiB)

br0:0     Link encap:Ethernet  HWaddr CC:E1:D5:3A:B2:80
          inet addr:169.254.255.1  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0      Link encap:Ethernet  HWaddr CC:E1:D5:3A:B2:80
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5196488 errors:0 dropped:0 overruns:0 frame:0
          TX packets:848653 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:969250040 (924.3 MiB)  TX bytes:639674339 (610.0 MiB)
          Interrupt:5

imq0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          UP RUNNING NOARP  MTU:1500  Metric:1
          RX packets:71971 errors:0 dropped:0 overruns:0 frame:0
          TX packets:71958 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:30
          RX bytes:58870852 (56.1 MiB)  TX bytes:58851352 (56.1 MiB)

imq1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          UP RUNNING NOARP  MTU:16000  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:11000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:65536  Metric:1
          RX packets:90 errors:0 dropped:0 overruns:0 frame:0
          TX packets:90 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8027 (7.8 KiB)  TX bytes:8027 (7.8 KiB)

ra0       Link encap:Ethernet  HWaddr CC:E1:D5:3A:B2:80
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10164 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10826 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2261013 (2.1 MiB)  TX bytes:10971684 (10.4 MiB)
          Interrupt:6

tun2      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:192.168.12.1  P-t-P:192.168.12.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1400  Metric:1
          RX packets:1203 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1855 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:84990 (82.9 KiB)  TX bytes:1936057 (1.8 MiB)

vlan1     Link encap:Ethernet  HWaddr CC:E1:D5:3A:B2:80
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:415650 errors:0 dropped:0 overruns:0 frame:0
          TX packets:465320 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:68193995 (65.0 MiB)  TX bytes:574645820 (548.0 MiB)

vlan2     Link encap:Ethernet  HWaddr CC:E1:D5:3A:B2:80
          inet addr:72.196.156.81  Bcast:72.196.159.255  Mask:255.255.248.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4775595 errors:0 dropped:24901 overruns:0 frame:0
          TX packets:382762 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:807307551 (769.9 MiB)  TX bytes:60986467 (58.1 MiB)

Probably, because that's the interface that has a globally unique IP. But it's impossible to tell for certain without seeing the routing table. — András Korn, May 23, 2017 at 9:33

Stack Exchange Network

Cannot access internet and local DNS server using OpenVPN on DD-WRT router

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
openvpn
dnsmasq
dd-wrt
.

Hot Network Questions

Cannot access internet and local DNS server using OpenVPN on DD-WRT router

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged openvpndnsmasqdd-wrt.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
openvpn
dnsmasq
dd-wrt
.