0

This seems to be a popular topic, but I can't find any solution to the same problem I am having.

Here's the setup: I have a DD-WRT router (build 14896) on a linksys WRT54GL.

I have one file server in the lan, and a client server outside the wan. my client can connect to the VPN through the wan port. it gets the IP 192.168.66.6. (omitting 192.168 forward)

From the client (mac connected to vpn over wan) I can not ping 66.1, 66.2, 66.5, or the internal server 54.50 or internal lan router 54.1. i can tell that it IS reaching the router because the ping causes the wan light to blink ( i set the interval to .01 to make sure it's

From the router (ssh into the router) I can not ping the client 66.6 or the route 66.2, but i can ping the server 66.1

for testing purposes, both the vpn router and the client are plugged into another DHCP router, so it's technically not connecting through the internet. that range is 192.168.1.0/24

This is the routing table of the mac client when connected:

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.1.254      UGSc           55        0     en0
default            192.168.66.5       UGScI           0        0    tun0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH             63   285476     lo0
169.254            link#4             UCS             0        0     en0
192.168.1          link#4             UCS             3        0     en0
192.168.1.64/32    link#4             UCS             1        0     en0
192.168.1.64       b8:e8:56:44:b7:52  UHLWI           0       25     lo0
192.168.1.65       30:10:e4:4d:ce:28  UHLWI           0        3     en0
192.168.1.69       0:23:12:fa:8:f8    UHLWI           0        0     en0    689
192.168.1.77       98:fc:11:7c:d3:e4  UHLWIi          2    21412     en0   1155
192.168.1.254/32   link#4             UCS             1        0     en0
192.168.1.254      60:fe:20:61:bb:31  UHLWIir        60      752     en0   1200
192.168.54         192.168.66.5       UGSc            0        0    tun0
192.168.66         192.168.66.5       UGSc            0        0    tun0
192.168.66.5       192.168.66.6       UHr             3        0    tun0
192.168.66.5/32    link#13            UCS             0        0    tun0

routing table of the router

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.1.254   0.0.0.0         255.255.255.255 UH        0 0          0 vlan1
192.168.66.2    0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.54.0    0.0.0.0         255.255.255.0   U         0 0          0 br0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 vlan1
192.168.66.0    192.168.66.2    255.255.255.0   UG        0 0          0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         192.168.1.254   0.0.0.0         UG        0 0          0 vlan1

my openvpn server config

push "route 192.168.54.0 255.255.255.0"
push "dhcp-option DNS 192.168.66.1"
server 192.168.66.0 255.255.255.0

dev tun0
proto udp
cipher AES-256-CBC
auth SHA512
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
client-to-client
management localhost 5001

my firewall commands:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

i also tried adding these in addition to the ones above

iptables -A INPUT -i tun0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

Also the firewall is disabled on the VPN router. I have tried multiple combinations of iptables rules and tweaking some of the other settings but I still can't figure this out.

routing tests from the client:

#: route get 192.168.66.1
route to: 192.168.66.1
destination: 192.168.66.0
gateway: 192.168.66.5
interface: tun0

#: route get 192.168.54.1
route to: 192.168.54.1
destination: 192.168.54.0
mask: 255.255.255.0
gateway: 192.168.66.5
interface: tun0

routing test from VPN server:

#: ip route get 192.168.66.6
192.168.66.6 via 192.168.66.2 dev tun0  src 192.168.66.1
cache  mtu 1500 advmss 1460
  • I was able to successfully set up openVPN server with the same settings on a VM, so I can only imagine that the routing is correct but that iptables is blocking the traffic. – DAB Jan 31 '15 at 16:24
0

I don't know much this helps, but using the DD-WRT OpenVPN GUI works fine for me. I have not yet got the CLI to work:

I have a remote OpenVPN server that works fine with my PCs and Android phones. I recently put dd-wrt on my routers, a D-Link DIR-825 and a Netgear r7000; I'm now just using the r7000. I have a USB stick in the router, which for example works fine on boot to set up a swapfile and add it to swap.

I have set up an OpenVPN client in my router by cut-paste elements of an .ovpn file created on my server. This works fine.

However, I would like to easily use alternate client ovpn files for different servers, without having to delete/overwrite, cut and paste new info into the router. So, on my USB I put in several client ovpn files which I know work fine on my PCs and phones.

I tried to use these alternate ovpn files by first disabling the OpenVPN service in the router, then checking that I still get pings from my PC via my ISP. Via as ssh- login shell to the router, I then tried openvpn file.ovpn to start up a new OVPN service. It did not work -- no remote pings from my PC. I then kill'ed the openvpn process, and got back my ping to my ISP. I also restarted the dd-wrt OpenVPN service through by browser, and simply got back my original OVPN service.

So, everything seems to work OK, except the ability to start any alternate OVPN service via the command line

openvpn file.ovpn

Adding --daemon makes no difference:

Note that when the OVPN service is disabled in the GUI, there are no files in /tmp/openvncl/. To follow the same call made by the GUI (see ps) I copied route-up.sh and route-down.sh from there into my sda1 dir.

I then ran

xovpn.sh server

where xovpn.sh is in /tmp/mnt/sda1/

#!/bin/sh
killall openvpn
/usr/sbin/openvpn --config /tmp/mnt/sda1/$1.ovpn --route-up /tmp/mnt/sda1/route-up.sh --down-pre /tmp/mnt/sda1/route-down.sh --daemon

(The point of this exercise to to be able to change servers simply using the CLI.)

This command shows up fine under ps as it did when using the GUI. However, I get no connection to the internet at all. I tried this with 3 servers -- my own and two from privatetunnel -- all of which work fine on my PCs and phones.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.