So I just upgraded my WRT3200ACM to OpenWrt 21.02.1 and tried to get the OpenVPN client to function properly. At first everything was working, I checked my IP and it was indeed the VPN providers IP address. Shortly after I could not enter most websites, but I still had an internet connection. For some reason I could Google random stuff for about 5-10 minutes, then the connection died. I have tried both TCP and UDP (and other servers).
I then followed a guide at:
According to this guide, I had done everything correctly for configuring OpenVPN for a device that is using OpenWRT 21.02+
I saw that some additional steps was required if the device is lower than 21.02+ (does not concern me)
(1) Add to config file under "auth-user-pass" :
script-security 2
up /etc/openvpn/client.sh
down /etc/openvpn/client.sh
and
(2) SSH into to router and add DNS updater script:
Again, I'm not supposed do to this according to linked guide as I'm running 21.02.1, yet adding them makes the VPN function properly.
(A)
Why does the VPN work after adding steps 1 & 2 and is it a bad solution?
(B)
Could I do this another way that does not involve ssh into router and adding a DNS script?
I don't really like to mess around with command line when I don't fully understand what I'm doing, GUI first, terminal later
as far I understand that is for update the dns servers to the proper ones depending if the vpn is up or down... when is up use the dns for the vpn and if down use the ones of your own connection.
may be those dns are from a ISP restricting to be used from another connection so you may try to put fixed public dns servers like 1.1.1.1 or 8.8.8.8 or 9.9.9.9
if you can browse for a few minutes it can be dns since cached dns will work until ttl time cache expires.
It appears it is setting dnsmasq to push the VPN DNS servers over DHCP so that the endpoint users have them directly advertised. This would have no effect on an endpoint until the endpoint reconnects or requests a DHCP renewal.
If you want to go through the VPN all the time and have it intentionally break ("kill switch" functionality) should the VPN be down, you could just set the settings assuming the VPN will be up. Make sure that DNS works well enough in the down state for the router to resolve the IP of the VPN server so it can make initial contact, or configure the VPN server by IP instead of name.
Does the site specifically say that 21.02 should be treated differently, or does it just say that 19.07 and earlier use that script. It is entirely possible that they haven’t update the procedure for 21.02 but that it is very similar (if not the same).
