Connect OpenWrt as a client to VPN server l2tp

If you want the LuCI web interface for OpenWrt, install luci-app-openvpn.

Have you setup your server? Do you have your certs and such and do you have a client configuration ready to go?

Euhm yeah I did the configuration for the VPN server on my NAS. And I do have the .ovpn file and the certificate. The client I am not sure and the Luci GUI for OpenVPN is installed.

Can you clarify this? Do you mean you're not sure if you have the appropriate client config files, or are you saying that you just don't know how to load them into the OpenWrt system?

I am sorry I didn't, but indeed I am not sure if have the appropriate client config files.

You might try installing your client config files on a computer or a phone to make sure that you have everything you need ready on both the server config and client files. From there, we can help you setup the OpenWrt side of things. It is important to know that your VPN server (and client config files) are functioning so that we are only working with the variable of OpenWrt itself.

Alright I will check this in the weekend and I will keep you updated!

Because of some school deadlines I am not able to check the files. I will let you know when it happend.

So it has been a while, I am sorry for that! But I am glad to tell you guys that the files are ready and I've tested on my phone and it works! I have a connection to my vpn server through OpenVPN.

That is great to hear!

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

But how do I fix my OpenWRT with OpenVPN. Because I want my OpenWRT to operate as a client.

Oh... I'm sorry... I thought that the OpenWrt side was done.

Ok... so what you can do now is either create a second set of keys/certs for the OpenWrt device, or use the ones you just tested on your phone over to OpenWrt. And you'll need all the client configuration parameters (which you have from your phone).

Then, just follow the OpenVPN client instructions for getting them into place on your router. If that doesn't work, let us know where you get stuck.

Alright I will follow these steps and I will come back to you when it's finished or when I am having problems. Thank you

Well the first try is done. But it is not working and I don't know why. The files are because I've tested it on 2 mobile devices, but the connection won't succeed on my raspberry pi. And I followed the steps on the site.

let's see the config and log files:

Please copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system baord
cat /etc/config/network
cat /etc/config/firewall
logread -e openvpn

Is a screenshot of the system log also fine?

a screenshot is only useful if the entire sequence is visible and it has been filtered to only show the openvpn process. The text output is much better.

Then give me a moment :smiley:

System info:

{
	"kernel": "5.4.188",
	"hostname": "OpenWrt",
	"system": "ARMv8 Processor rev 3",
	"model": "Raspberry Pi 4 Model B Rev 1.5",
	"board_name": "raspberrypi,4-model-b",
	"release": {
		"distribution": "OpenWrt",
		"version": "21.02.3",
		"revision": "r16554-1d4dea6d4f",
		"target": "bcm27xx/bcm2711",
		"description": "OpenWrt 21.02.3 r16554-1d4dea6d4f"
	}
}

Network info:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdf2:a309:9b81::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ip4table '1'
	option ip6table '1'
	option ipaddr '192.168.2.1'
	list dns '1.1.1.1'
	list dns '1.0.0.1'

config interface 'wwan'
	option proto 'dhcp'
	option peerdns '0'

config rule 'lan_wan'
	option in 'lan'
	option lookup '2'
	option priority '40000'

config rule6 'lan_wan6'
	option in 'lan'
	option lookup '2'
	option priority '40000'

config interface 'dutch'
	option proto 'wireguard'
	option private_key '***'
	list addresses '10.5.0.2'
	option auto '0'

config wireguard_dutch
	list allowed_ips '0.0.0.0/0'
	option endpoint_host '213.152.188.241'
	option endpoint_port '51820'
	option persistent_keepalive '25'
	option public_key '***'
	option route_allowed_ips '1'

config interface 'OpenVPN'
	option proto 'none'
	option auto '0'
	option device 'wlan0'

Firewall info:

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'wan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list device 'dutch'
	list network 'wan'
	list network 'wan6'
	list network 'wwan'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config rule
	option name 'Support-UDP-Traceroute'
	option src 'wan'
	option dest_port '33434:33689'
	option proto 'udp'
	option family 'ipv4'
	option target 'REJECT'
	option enabled 'false'

config include
	option path '/etc/firewall.user'

config zone
	option name 'wg_dutch'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config forwarding
	option src 'wg_dutch'
	option dest 'lan'

config forwarding
	option src 'wg_dutch'
	option dest 'wan'

config zone
	option name 'BredaVPN'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config forwarding
	option src 'BredaVPN'
	option dest 'lan'

config forwarding
	option src 'BredaVPN'
	option dest 'wan'

My log file is to big to send but here is some of it:

Logfile OpenVPN:

Wed May  3 21:35:20 2023 daemon.notice openvpn(BredaVPN)[3043]: OpenVPN 2.5.3 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Wed May  3 21:35:20 2023 daemon.notice openvpn(BredaVPN)[3043]: library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
Wed May  3 21:35:20 2023 daemon.warn openvpn(BredaVPN)[3043]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed May  3 21:35:20 2023 daemon.warn openvpn(BredaVPN)[3043]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed May  3 21:35:20 2023 daemon.notice openvpn(BredaVPN)[3043]: TCP/UDP: Preserving recently used remote address: [AF_INET]94.209.240.182:1194
Wed May  3 21:35:20 2023 daemon.err openvpn(BredaVPN)[3043]: TCP/UDP: Socket bind failed on local address [AF_INET][undef]:1194: Address in use (errno=98)
Wed May  3 21:35:20 2023 daemon.notice openvpn(BredaVPN)[3043]: Exiting due to fatal error
Wed May  3 21:35:25 2023 daemon.warn openvpn(BredaVPN)[3044]: WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
Wed May  3 21:35:25 2023 daemon.warn openvpn(BredaVPN)[3044]: --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
Wed May  3 21:35:25 2023 daemon.notice openvpn(BredaVPN)[3044]: OpenVPN 2.5.3 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Wed May  3 21:35:25 2023 daemon.notice openvpn(BredaVPN)[3044]: library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
Wed May  3 21:35:25 2023 daemon.warn openvpn(BredaVPN)[3044]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed May  3 21:35:25 2023 daemon.warn openvpn(BredaVPN)[3044]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed May  3 21:35:25 2023 daemon.notice openvpn(BredaVPN)[3044]: TCP/UDP: Preserving recently used remote address: [AF_INET]94.209.240.182:1194
Wed May  3 21:35:25 2023 daemon.err openvpn(BredaVPN)[3044]: TCP/UDP: Socket bind failed on local address [AF_INET][undef]:1194: Address in use (errno=98)
Wed May  3 21:35:25 2023 daemon.notice openvpn(BredaVPN)[3044]: Exiting due to fatal error
Wed May  3 21:35:30 2023 daemon.warn openvpn(BredaVPN)[3045]: WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
Wed May  3 21:35:30 2023 daemon.warn openvpn(BredaVPN)[3045]: --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
Wed May  3 21:35:30 2023 daemon.notice openvpn(BredaVPN)[3045]: OpenVPN 2.5.3 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Wed May  3 21:35:30 2023 daemon.notice openvpn(BredaVPN)[3045]: library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
Wed May  3 21:35:30 2023 daemon.warn openvpn(BredaVPN)[3045]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed May  3 21:35:30 2023 daemon.warn openvpn(BredaVPN)[3045]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed May  3 21:35:30 2023 daemon.notice openvpn(BredaVPN)[3045]: TCP/UDP: Preserving recently used remote address: [AF_INET]94.209.240.182:1194
Wed May  3 21:35:30 2023 daemon.err openvpn(BredaVPN)[3045]: TCP/UDP: Socket bind failed on local address [AF_INET][undef]:1194: Address in use (errno=98)
Wed May  3 21:35:30 2023 daemon.notice openvpn(BredaVPN)[3045]: Exiting due to fatal error
Wed May  3 21:35:35 2023 daemon.warn openvpn(BredaVPN)[3046]: WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
Wed May  3 21:35:35 2023 daemon.warn openvpn(BredaVPN)[3046]: --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
Wed May  3 21:35:35 2023 daemon.notice openvpn(BredaVPN)[3046]: OpenVPN 2.5.3 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Wed May  3 21:35:35 2023 daemon.notice openvpn(BredaVPN)[3046]: library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
Wed May  3 21:35:35 2023 daemon.warn openvpn(BredaVPN)[3046]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed May  3 21:35:35 2023 daemon.warn openvpn(BredaVPN)[3046]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed May  3 21:35:35 2023 daemon.notice openvpn(BredaVPN)[3046]: TCP/UDP: Preserving recently used remote address: [AF_INET]94.209.240.182:1194
Wed May  3 21:35:35 2023 daemon.err openvpn(BredaVPN)[3046]: TCP/UDP: Socket bind failed on local address [AF_INET][undef]:1194: Address in use (errno=98)
Wed May  3 21:35:35 2023 daemon.notice openvpn(BredaVPN)[3046]: Exiting due to fatal error
Wed May  3 21:35:40 2023 daemon.warn openvpn(BredaVPN)[3047]: WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

Small update, I added these lines to the config.ovpn file and the server starts.

The lines were:
resolv-retry infinite
nobind
persist-key
persist-tun

And I see that there is connection to my own VPN server. But if I connect with my OpenWRT (aka raspberry) and I go to google and type in 'whatismyproxy.com' I see that I still have the wrong digital location.

There are a few small issues in your config in general, but before going into them, are you using the wireguard interface (i.e. is it active)?