OpenVPN does not work properly

Installing and Using OpenWrt
1

Hello and good day to the community,

On the internet connection I have a fritzbox 7590 . I am absolute newbie with openwrt and have my old fritzbox 7360 with OpenWrt 22.03.5 r20134-5f15225c1e successfully flashed and plugged via lankkabel to the first fritzbox.
I also successfully set up my OpenVPN on openwrt and got it running. I can connect to openwrt with my laptop via wifi and have internet access.
When I check the external IP address of my laptop, I have the one from my internet provider in Germany. What am I doing wrong or what have I forgotten to set. My VPN provider is cyberghost. In the VPN config is a Ukrainian server entered. Greetings Lucca

Translated with www.DeepL.com/Translator (free version)

2

push route on the OVPN server.

3

Ah. My mistake. You want to connect to a VPN server operated by a third-party (Cyberghost). I thought you were also managing the VPN server as well as the clients.

In that case, you will have no control over what directives the OVPN server pushes to clients. However, Cyberghost might have some information about configuring OpenWRT to work with it. Many VPN providers recognise this use case and offer advice for implementing it.

I'm not a Cyberghost customer, so I don't know how good its help information is, but that's where I'd suggest looking first, to see if there is any information specific to Cyberghost and OpenWRT.

4

Run the troubleshooting commands at the bottom of the page and post here the output.

Please use the "Preformatted text </>" button for logs, scripts, configs and general console output.
grafik

1 Like
5

The startup of an OpenVPN client logs a lot to the system log, so you should start by reading it. One of the log entries should be a default route being pushed and accepted. If you run route or examine the routing status in LuCI, you should see that a "split default" route has been installed by OpenVPN. The new route routes 0.0.0.0/1 and 128.0.0.0/1 into tun0 (or whatever the OpenVPN tunnel device is). These two subnets together cover the whole IPv4 Internet.

For redirecting all Internet usage through a VPN service, the VPN tunnel should be placed into the wan firewall zone.

6
7

There you go.

8

Sorry, what do I have to do?

9

This:

10

I can't see any troubleshooting commands at the bottom of the page. Where do I need to look?

11

There's a big header which reads "Troubleshooting". The link took you directly there when you clicked on it.

12

sorry now i understand :slight_smile:

root@OpenWrt:~# /etc/init.d/log restart; /etc/init.d/openvpn restart; sleep 10

root@OpenWrt:~# logread -e openvpn; netstat -l -n -p | grep -e openvpn

root@OpenWrt:~# pgrep -f -a openvpn

13

root@OpenWrt:~# ip rule show; ip -6 rule show; nft list ruleset

root@OpenWrt:~# uci show network; uci show firewall; uci show openvpn

root@OpenWrt:~# head -v -n -0 /etc/openvpn/*.conf

14

Replace .conf with .ovpn and run that command again. Make sure to redact any keys, certs, and passwords which may be exposed.

15

Is this router not setup as a dumb AP i.e. connected LAN<>LAN on the same subnet?

The OVPN does make a connection but if this is a dumb AP then the LAN clients like your laptop will just bypass the VPN

If so point the gateway of your LAN clients like your laptop to the router e.g.: 192.168.178.2?
But easier is to just setup as a regular router (connected with its WAN on its own subnet) so all connected clients will always use the VPN.

1 Like
16

I have now started again from the beginning.
The Lan interface has IPv4: 192.168.15.2/24 DHCP is on.
At the Wan port comes the network cable from my first Fritzbox. The wan interface is configured as DHCP Client and
got the IP from the first fritzbox 192.168.178.122.

I am connected with my laptop via WLAN with the OpenWRT router, but still have no Internet. What do I have to configure now? I will deal with VPN later.

17

You need to repost again the configurations from above in preformatted text not in blockquote.
For what it's worth, there was no issue with the tunnel itself. The problem is that you had it configured in the lan zone, so no masquerade was applied and it is questionable whether the lan clients were using OpenWrt as the gateway.

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
1 Like
18 
root@OpenWrt:~# ubus call system board
{
        "kernel": "5.10.176",
        "hostname": "OpenWrt",
        "system": "xRX200 rev 1.2",
        "model": "AVM FRITZ!Box 7360 SL",
        "board_name": "avm,fritz7360sl",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "22.03.5",
                "revision": "r20134-5f15225c1e",
                "target": "lantiq/xrx200",
                "description": "OpenWrt 22.03.5 r20134-5f15225c1e"
        }
}

root@OpenWrt:~# uci export network; uci export wireless;
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd74:3dcd:0880::/48'

config atm-bridge 'atm'
        option vpi '1'
        option vci '32'
        option encaps 'llc'
        option payload 'bridged'
        option nameprefix 'dsl'

config dsl 'dsl'
        option annex 'b'
        option tone 'av'
        option ds_snr_offset '0'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.15.1'

config device
        option name 'dsl0'
        option macaddr '9c:c7:a6:41:2b:11'

config interface 'wan'
        option proto 'static'
        option device 'eth0'
        option ipaddr '192.168.178.2'
        option gateway '192.168.178.1'
        option broadcast '192.168.178.255'
        list dns '8.8.8.8'

package wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
        option cell_density '0'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'LucV'
        option encryption 'psk2'
        option key 'qwertzui'

root@OpenWrt:~# uci export dhcp; uci export firewall;
package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'
        option start '100'
        option limit '150'
        option leasetime '12h'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

package firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option synflood_protect '1'
        option forward 'ACCEPT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'ovpn_fw'
        option output 'ACCEPT'
        option input 'REJECT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'ovpn_fw'

root@OpenWrt:~# ip -4 addr ; ip -4 ro li tab all ; ip -4 ru;
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1508 qdisc fq_codel state UNKNOWN qlen 1000
    inet 192.168.178.2/32 brd 192.168.178.255 scope global eth0
       valid_lft forever preferred_lft forever
10: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 192.168.15.1/24 brd 192.168.15.255 scope global br-lan
       valid_lft forever preferred_lft forever
192.168.15.0/24 dev br-lan scope link  src 192.168.15.1
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
broadcast 192.168.15.0 dev br-lan table local scope link  src 192.168.15.1
local 192.168.15.1 dev br-lan table local scope host  src 192.168.15.1
broadcast 192.168.15.255 dev br-lan table local scope link  src 192.168.15.1
local 192.168.178.2 dev eth0 table local scope host  src 192.168.178.2
broadcast 192.168.178.255 dev eth0 table local scope link  src 192.168.178.2
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
root@OpenWrt:~#

root@OpenWrt:~# ip -4 addr ; ip -4 ro li tab all ; ip -4 ru;
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1508 qdisc fq_codel state UNKNOWN qlen 1000
    inet 192.168.178.2/32 brd 192.168.178.255 scope global eth0
       valid_lft forever preferred_lft forever
10: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    inet 192.168.15.1/24 brd 192.168.15.255 scope global br-lan
       valid_lft forever preferred_lft forever
192.168.15.0/24 dev br-lan scope link  src 192.168.15.1
broadcast 127.0.0.0 dev lo table local scope link  src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host  src 127.0.0.1
local 127.0.0.1 dev lo table local scope host  src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link  src 127.0.0.1
broadcast 192.168.15.0 dev br-lan table local scope link  src 192.168.15.1
local 192.168.15.1 dev br-lan table local scope host  src 192.168.15.1
broadcast 192.168.15.255 dev br-lan table local scope link  src 192.168.15.1
local 192.168.178.2 dev eth0 table local scope host  src 192.168.178.2
broadcast 192.168.178.255 dev eth0 table local scope link  src 192.168.178.2
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default
root@OpenWrt:~# ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
lrwxrwxrwx    1 root     root            16 Apr 27 20:28 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r--    1 root     root            47 Jul  3 18:40 /tmp/resolv.conf
-rw-r--r--    1 root     root            35 Jul  3 18:40 /tmp/resolv.conf.d/resolv.conf.auto

/tmp/resolv.conf.d:
-rw-r--r--    1 root     root            35 Jul  3 18:40 resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1

==> /tmp/resolv.conf.d <==
head: /tmp/resolv.conf.d: I/O error

==> /tmp/resolv.conf.d/resolv.conf.auto <==
# Interface wan
nameserver 8.8.8.8
19

I would be happy if I could first
Internet from my network 192.168.178.1 over the new network
192.168.15.1 network.
VPN I can try later.

Thanks for the support.

20

wan interface is missing the subnet mask.

5 Likes