OpenVPN and routing problem on OpenWRT
My home topology:
router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports.
router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays role of WiFi access point. 4 LAN ports + WAN port.
Home PC (connects to router1 via DHCP)
|
internet ------ router1-----
|
router2 (OpenVPN server on OpenWRT)
On router1 I set up NAT Virtual Servers and can connect to my router via SSH or OpenVPN (tcp on 443 port)
OpenVPN server works fine and all traffic goes via tun interface after connection.
OpenVPN server config (if matter):
--script-security 2
mode server
dev tun
port 443
proto tcp
server 10.0.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.1.1" # Change this to your router's LAN IP Address
push "route 192.168.1.0 255.255.255.0" # Change this to your network
client-config-dir ccd
client-to-client
tls-server
dh /etc/openvpn/dh2048.pem
ca /etc/openvpn/CA_cert.pem
cert /etc/openvpn/certs/server.pem
key /etc/openvpn/keys/server.pem
crl-verify /etc/openvpn/crl/crl.pem
tls-auth /etc/openvpn/ta.key 0
#comp-lzo
keepalive 10 120
tun-mtu 1500
mssfix 1450
persist-key
persist-tun
verb 3
log /var/log/openvpn.log
My goal is OpenVPN tunnel with Internet from my home router1. At now I can connect to OpenVPN server but all traffic that goes via tunnel does not reach Internet.
Firewall rules on router2 (OpenWRT):
iptables -t nat -A prerouting_wan -p tcp --dport 443 -j ACCEPT
iptables -A input_wan -p tcp --dport 443 -j ACCEPT
iptables -t nat -A prerouting_lan -p tcp --dport 443 -j ACCEPT
iptables -A input_lan -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
It's definitely a problem with routing but I have no enough knowledges to solve it.
firewall openvpn openwrt route nat
asked Oct 28 '14 at 13:57
Alex
262
bumped to the homepage by Community♦ 9 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
My home topology:
router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports.
router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays role of WiFi access point. 4 LAN ports + WAN port.
Home PC (connects to router1 via DHCP)
|
internet ------ router1-----
|
router2 (OpenVPN server on OpenWRT)
On router1 I set up NAT Virtual Servers and can connect to my router via SSH or OpenVPN (tcp on 443 port)
OpenVPN server works fine and all traffic goes via tun interface after connection.
OpenVPN server config (if matter):
--script-security 2
mode server
dev tun
port 443
proto tcp
server 10.0.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.1.1" # Change this to your router's LAN IP Address
push "route 192.168.1.0 255.255.255.0" # Change this to your network
client-config-dir ccd
client-to-client
tls-server
dh /etc/openvpn/dh2048.pem
ca /etc/openvpn/CA_cert.pem
cert /etc/openvpn/certs/server.pem
key /etc/openvpn/keys/server.pem
crl-verify /etc/openvpn/crl/crl.pem
tls-auth /etc/openvpn/ta.key 0
#comp-lzo
keepalive 10 120
tun-mtu 1500
mssfix 1450
persist-key
persist-tun
verb 3
log /var/log/openvpn.log
My goal is OpenVPN tunnel with Internet from my home router1. At now I can connect to OpenVPN server but all traffic that goes via tunnel does not reach Internet.
Firewall rules on router2 (OpenWRT):
iptables -t nat -A prerouting_wan -p tcp --dport 443 -j ACCEPT
iptables -A input_wan -p tcp --dport 443 -j ACCEPT
iptables -t nat -A prerouting_lan -p tcp --dport 443 -j ACCEPT
iptables -A input_lan -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
It's definitely a problem with routing but I have no enough knowledges to solve it.
firewall openvpn openwrt route nat
asked Oct 28 '14 at 13:57
Alex
262
bumped to the homepage by Community♦ 9 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
2
You need to study how NAT works with iptables. Simply adding an ACCEPT rule to thenattable won't make it do NAT.
– wurtel
Oct 28 '14 at 14:44
add a comment |
My home topology:
router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports.
router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays role of WiFi access point. 4 LAN ports + WAN port.
Home PC (connects to router1 via DHCP)
|
internet ------ router1-----
|
router2 (OpenVPN server on OpenWRT)
On router1 I set up NAT Virtual Servers and can connect to my router via SSH or OpenVPN (tcp on 443 port)
OpenVPN server works fine and all traffic goes via tun interface after connection.
OpenVPN server config (if matter):
--script-security 2
mode server
dev tun
port 443
proto tcp
server 10.0.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.1.1" # Change this to your router's LAN IP Address
push "route 192.168.1.0 255.255.255.0" # Change this to your network
client-config-dir ccd
client-to-client
tls-server
dh /etc/openvpn/dh2048.pem
ca /etc/openvpn/CA_cert.pem
cert /etc/openvpn/certs/server.pem
key /etc/openvpn/keys/server.pem
crl-verify /etc/openvpn/crl/crl.pem
tls-auth /etc/openvpn/ta.key 0
#comp-lzo
keepalive 10 120
tun-mtu 1500
mssfix 1450
persist-key
persist-tun
verb 3
log /var/log/openvpn.log
My goal is OpenVPN tunnel with Internet from my home router1. At now I can connect to OpenVPN server but all traffic that goes via tunnel does not reach Internet.
Firewall rules on router2 (OpenWRT):
iptables -t nat -A prerouting_wan -p tcp --dport 443 -j ACCEPT
iptables -A input_wan -p tcp --dport 443 -j ACCEPT
iptables -t nat -A prerouting_lan -p tcp --dport 443 -j ACCEPT
iptables -A input_lan -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
It's definitely a problem with routing but I have no enough knowledges to solve it.
firewall openvpn openwrt route nat
asked Oct 28 '14 at 13:57
Alex
262
My home topology:
router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports.
router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays role of WiFi access point. 4 LAN ports + WAN port.
Home PC (connects to router1 via DHCP)
|
internet ------ router1-----
|
router2 (OpenVPN server on OpenWRT)
On router1 I set up NAT Virtual Servers and can connect to my router via SSH or OpenVPN (tcp on 443 port)
OpenVPN server works fine and all traffic goes via tun interface after connection.
OpenVPN server config (if matter):
--script-security 2
mode server
dev tun
port 443
proto tcp
server 10.0.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.1.1" # Change this to your router's LAN IP Address
push "route 192.168.1.0 255.255.255.0" # Change this to your network
client-config-dir ccd
client-to-client
tls-server
dh /etc/openvpn/dh2048.pem
ca /etc/openvpn/CA_cert.pem
cert /etc/openvpn/certs/server.pem
key /etc/openvpn/keys/server.pem
crl-verify /etc/openvpn/crl/crl.pem
tls-auth /etc/openvpn/ta.key 0
#comp-lzo
keepalive 10 120
tun-mtu 1500
mssfix 1450
persist-key
persist-tun
verb 3
log /var/log/openvpn.log
My goal is OpenVPN tunnel with Internet from my home router1. At now I can connect to OpenVPN server but all traffic that goes via tunnel does not reach Internet.
Firewall rules on router2 (OpenWRT):
iptables -t nat -A prerouting_wan -p tcp --dport 443 -j ACCEPT
iptables -A input_wan -p tcp --dport 443 -j ACCEPT
iptables -t nat -A prerouting_lan -p tcp --dport 443 -j ACCEPT
iptables -A input_lan -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
It's definitely a problem with routing but I have no enough knowledges to solve it.
firewall openvpn openwrt route nat
firewall openvpn openwrt route nat
asked Oct 28 '14 at 13:57
Alex
262
asked Oct 28 '14 at 13:57
Alex
262
asked Oct 28 '14 at 13:57
Alex
262
asked Oct 28 '14 at 13:57
Alex
262
asked Oct 28 '14 at 13:57
Alex
262
262
bumped to the homepage by Community♦ 9 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 9 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
2
You need to study how NAT works with iptables. Simply adding an ACCEPT rule to thenattable won't make it do NAT.
– wurtel
Oct 28 '14 at 14:44
add a comment |
2
You need to study how NAT works with iptables. Simply adding an ACCEPT rule to thenattable won't make it do NAT.
– wurtel
Oct 28 '14 at 14:44
2
2
You need to study how NAT works with iptables. Simply adding an ACCEPT rule to the
nat table won't make it do NAT.– wurtel
Oct 28 '14 at 14:44
You need to study how NAT works with iptables. Simply adding an ACCEPT rule to the
nat table won't make it do NAT.– wurtel
Oct 28 '14 at 14:44
add a comment |
1 Answer
1
active
oldest
votes
You have to add 10.0.0.0/24 network routed to gateway 192.168.1.2 as a static route on router1. It's not about NAT.
answered Jan 16 '17 at 4:59
user218669
112
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f164609%2fopenvpn-and-routing-problem-on-openwrt%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You have to add 10.0.0.0/24 network routed to gateway 192.168.1.2 as a static route on router1. It's not about NAT.
answered Jan 16 '17 at 4:59
user218669
112
add a comment |
You have to add 10.0.0.0/24 network routed to gateway 192.168.1.2 as a static route on router1. It's not about NAT.
answered Jan 16 '17 at 4:59
user218669
112
add a comment |
You have to add 10.0.0.0/24 network routed to gateway 192.168.1.2 as a static route on router1. It's not about NAT.
answered Jan 16 '17 at 4:59
user218669
112
You have to add 10.0.0.0/24 network routed to gateway 192.168.1.2 as a static route on router1. It's not about NAT.
answered Jan 16 '17 at 4:59
user218669
112
answered Jan 16 '17 at 4:59
user218669
112
answered Jan 16 '17 at 4:59
user218669
112
answered Jan 16 '17 at 4:59
user218669
112
112
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f164609%2fopenvpn-and-routing-problem-on-openwrt%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
You need to study how NAT works with iptables. Simply adding an ACCEPT rule to the
nattable won't make it do NAT.– wurtel
Oct 28 '14 at 14:44