1

My target is to connect a PC from internet to a local VPN at my home and then access my computers in local LAN.

Explanation:

******             **************        ******************         *********
* PC * ----------> * ISP-ROUTER * -----> * OPENWRT ROUTER * ------> * My PC *
******  INTERNET   **************  DMZ   ******************  WLAN   *********

The OpenWRT router is connected through LAN port and not WAN port since the ISP-router is already providing LAN.

The OpenWRT router has OpenVPN running. I can connect with the "global PC" to my VPN but then I cannot ping "My PC".

I tried all things I found on internet but I always get the same result. The OpenWRT router is a Netgear WDNR3700 running OpenWRT 12.04.

Here is my config I tried but get no positive result:

/etc/config/openvpn

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
push "route 10.0.0.0 255.255.255.0"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /tmp/openvpn-status.log
verb 3

/etc/config/network

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config interface 'lan'
    option type 'bridge'
    option proto 'static'
    option netmask '255.255.255.0'
    option ipaddr '10.0.0.5'
    option gateway '10.0.0.4'
    option broadcast '10.0.0.255'
    option dns '8.8.8.8'
    option ifname 'eth0.1 wlan0 radio1.network1'
    option bridge 'true'

config interface 'wan'
    option ifname 'eth1'
    option proto 'dhcp'

config switch
    option name 'rtl8366s'
    option reset '1'
    option enable_vlan '1'
    option blinkrate '2'

config switch_vlan
    option device 'rtl8366s'
    option vlan '1'
    option ports '0 1 2 3 5t'

config switch_port
    option device 'rtl8366s'
    option port '1'
    option led '6'

config switch_port
    option device 'rtl8366s'
    option port '2'
    option led '9'

config switch_port
    option device 'rtl8366s'
    option port '5'
    option led '2'

config interface 'vpn'
    option proto 'none'
    option ifname 'tun0-00'`

/etc/config/firewall

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'lan'
    option network 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'wan'
    option network 'wan'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config zone
    option name 'vpn'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'
    option masq '1'
    option network 'vpn'

config forwarding
    option src 'lan'
    option dest 'wan'

config forwarding
    option src 'vpn'
    option dest 'lan'

config forwarding
    option src 'lan'
    option dest 'vpn'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fe80::/10'
    option src_port '547'
    option dest_ip 'fe80::/10'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config include
    option path '/etc/firewall.user'

config rule
    option src 'vpn'
    option target 'ACCEPT'
    option name 'VPN'
    option dest_port '1194'
    option proto 'tcpudp'
    option family 'ipv4'

config rule
    option target 'ACCEPT'
    option proto 'tcp'
    option dest_port '9100'
    option name 'Printer 0'
    option src 'lan'

Everything I tried was always taking me to the same result: Connect to VPN no problem, ping local PC not working. I cannot even ping the routers internal IP.

Hopefully you can help me. Thanks in advance.

  • Does your VPN server OpenWRT router support iptables ? If so you can use iptables to masquerade packets to your LAN. – dotvotdot Feb 17 '16 at 13:06
  • The router supports iptables. However I do not know how to use them. Is there a simple HowTo? – Klaus F. Feb 18 '16 at 14:31
  • Have a look at the OpenVPN HOWTO for this problem. There is a suitable iptables rule included. – dotvotdot Feb 19 '16 at 16:33
0

According to this post I found the problem: Howto connect multiple networks over the Internet the cheap way

In my config I pushed the route information to the client but not to the server itself. So I added this line: route 10.0.0.0 255.255.255.0 and everything works fine.

New config file:

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
route 10.0.0.0 255.255.255.0
push "route 10.0.0.0 255.255.255.0"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /tmp/openvpn-status.log
verb 3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.