OpenVPN layer 2 between 2 OpenWrt Routers

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi guys,
Newish member here :slight_smile:
I've been using OpenWRT for a while now, and a couple months ago I set up a VPN Layer 2 bridge between 2 OpenWRT routers, one in my old home, one in my new home.
Everything was working perfectly, both routers running stable builds (19.07.something :laughing: ).
Server router is in my old home, a TPLink WDR4300, but now i've had to change my client router (the one in my home) over to a Linksys EA7300, it still has no official support, but I was able to flash a snapshot build over it since it had been added. (As a side note now I'm running a build by user arrmo, he fixed some stuff related to flashing and using the dual boot this router has but apart from that it should be kind of the same as a normal snapshot, kernel is 5.4)
Everything works alright apart from the VPN.
If I use the same config files what I get is that I can ping from both sides, and if I bridge the tap0 interfaces over to the local bridges I can also ping from/to devices in both networks, but I can't really use the connection itself, ssh for instance never connects (it kind of hangs). I went ahead and debugged the issue as much as I could, it's not related to the bridging (I ended up removing both tap0 from the local br-lan) and using different ips/ranges so that routes wouldn't be a problem, checked routes to make sure those ranges were diverted to the correct interface. After that I used wireshark via ssh to check what was happening and this is what I see.
For SSH (no matter the way I try to connect)

3010×3340

If I try with curl for example, I can go from the server to the client, but not the other way around (in that case I see this in wireshark)
3010×3340

I also have the pcaps here

And here are the config files I'm using

server openvpn

config openvpn 'vpn_bridge_server'
	option ca '/etc/easy-rsa/pki/ca.crt'
	option cert '/etc/easy-rsa/pki/issued/server.crt'
	option comp_lzo 'yes'
	option dev 'tap'
	option dh '/etc/easy-rsa/pki/dh.pem'
	option down_pre '1'
	option enabled '1'
	option keepalive '10 60'
	option key '/etc/easy-rsa/pki/private/server.key'
	option log_append '/var/log/openvpn.log'
	option mssfix '1420'
	option persist_key '1'
	option persist_tun '1'
	option port '1194'
	option proto 'udp'
	option status '/tmp/openvpn-status.log'
	option verb '3'
	option server_bridge '192.168.3.1 255.255.255.0 192.168.3.201 192.168.3.210'

client openvpn

config openvpn 'vpn_bridge_client'
	list remote 'my url was here :) '
	option ca '/etc/easy-rsa/ca.crt'
	option cert '/etc/easy-rsa/client.crt'
	option client '1'
	option comp_lzo 'yes'
	option dev 'tap'
	option dh '/etc/easy-rsa/dh.pem'
	option down_pre '1'
	option enabled '1'
	option float '1'
	option key '/etc/easy-rsa/client.key'
	option log_append '/var/log/openvpn.log'
	option nobind '1'
	option persist_key '1'
	option persist_tun '1'
	option port '1194'
	option proto 'udp'
	option remote_cert_tls 'server'
	option reneg_sec '0'
	option status '/tmp/openvpn-status.log'

also network just in case

server

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd7f:3525:998d::/48'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ip6assign '60'
	list dns '192.168.1.1'
	list ipaddr '192.168.1.1/23'
	option ifname 'eth0.1'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'pppoe'
	option password 'antel'
	option ipv6 'auto'
	option username 'antel@adsl'

config device 'wan_eth0_2_dev'
	option name 'eth0.2'
	option macaddr '30:b5:c2:d5:f6:61'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '2 3 4 5 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '1 0t'

config interface 'tap'
	option ifname 'tap0'
	option proto 'static'
	option ipaddr '192.168.3.1'
	option netmask '255.255.255.0'

client

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option packet_steering '1'
	option ula_prefix 'fd83:e61e:996d::/48'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ip6assign '60'
	option ipaddr '192.168.0.1'
	option bridge_empty '1'
	list dns '8.8.8.8'
	list dns '192.168.1.1'
	option igmp_snooping '1'
	option netmask '255.255.254.0'
	option ifname 'lan1 lan2 lan3 lan4'

config device 'lan_lan1_dev'
	option name 'lan1'
	option macaddr 'c4:41:1e:1d:3c:57'

config device 'lan_lan2_dev'
	option name 'lan2'
	option macaddr 'c4:41:1e:1d:3c:57'

config device 'lan_lan3_dev'
	option name 'lan3'
	option macaddr 'c4:41:1e:1d:3c:57'

config device 'lan_lan4_dev'
	option name 'lan4'
	option macaddr 'c4:41:1e:1d:3c:57'

config interface 'wan'
	option ifname 'wan'
	option proto 'pppoe'
	option username 'antel@adsl'
	option password 'antel'
	option ipv6 '0'

config device 'wan_wan_dev'
	option name 'wan'
	option macaddr 'c4:41:1e:1d:3c:57'
	option ipv6 '0'

config interface 'tap'
	option proto 'static'
	option ifname 'tap0'
	option ipaddr '192.168.3.201'
	option netmask '255.255.255.0'

and ifconfigs and routes

server

root@OpenWrt-4300:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         cor4bras1.antel 0.0.0.0         UG    0      0        0 pppoe-wan
192.168.0.0     *               255.255.254.0   U     0      0        0 br-lan
192.168.3.0     *               255.255.255.0   U     0      0        0 tap0
200.40.161.197  *               255.255.255.255 UH    0      0        0 pppoe-wan
root@OpenWrt-4300:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr 30:B5:C2:D5:F6:60
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.254.0
          inet6 addr: 2800:a4:1716:f800::1/60 Scope:Global
          inet6 addr: fe80::32b5:c2ff:fed5:f660/64 Scope:Link
          inet6 addr: fd7f:3525:998d::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2776239 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7095405 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:298629104 (284.7 MiB)  TX bytes:9635280813 (8.9 GiB)

eth0      Link encap:Ethernet  HWaddr 30:B5:C2:D5:F6:60
          inet6 addr: fe80::32b5:c2ff:fed5:f660/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9716368 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9746570 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1480982770 (1.3 GiB)  TX bytes:1252245369 (1.1 GiB)
          Interrupt:4

eth0.1    Link encap:Ethernet  HWaddr 30:B5:C2:D5:F6:60
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2301368 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7114762 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:247928922 (236.4 MiB)  TX bytes:9418240446 (8.7 GiB)

eth0.2    Link encap:Ethernet  HWaddr 30:B5:C2:D5:F6:61
          inet6 addr: fe80::32b5:c2ff:fed5:f661/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:7414982 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2631786 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:9648091562 (8.9 GiB)  TX bytes:384951259 (367.1 MiB)

ifb0      Link encap:Ethernet  HWaddr 2E:FE:0A:67:E6:A3
          inet6 addr: fe80::2cfe:aff:fe67:e6a3/64 Scope:Link
          UP BROADCAST RUNNING NOARP  MTU:1500  Metric:1
          RX packets:7396010 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7396010 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:9568484056 (8.9 GiB)  TX bytes:9568484056 (8.9 GiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:5685 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5685 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:477883 (466.6 KiB)  TX bytes:477883 (466.6 KiB)

pppoe-wan Link encap:Point-to-Point Protocol
          inet addr:186.52.156.140  P-t-P:200.40.161.197  Mask:255.255.255.255
          inet6 addr: fe80::c8d4:f8f4:98c:fc3c/10 Scope:Link
          inet6 addr: 2800:a4:2017:75cb:c8d4:f8f4:98c:fc3c/64 Scope:Global
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:7409328 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2626222 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:9588236662 (8.9 GiB)  TX bytes:326779491 (311.6 MiB)

tap0      Link encap:Ethernet  HWaddr 56:CF:BE:78:1E:C7
          inet addr:192.168.3.1  Bcast:192.168.3.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:48 errors:0 dropped:0 overruns:0 frame:0
          TX packets:99 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:5346 (5.2 KiB)  TX bytes:30654 (29.9 KiB)

wlan0     Link encap:Ethernet  HWaddr 30:B5:C2:D5:F6:5F
          inet6 addr: fe80::32b5:c2ff:fed5:f65f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:207475 errors:0 dropped:0 overruns:0 frame:0
          TX packets:573077 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:31779352 (30.3 MiB)  TX bytes:291420838 (277.9 MiB)

wlan1     Link encap:Ethernet  HWaddr 30:B5:C2:D5:F6:60
          inet6 addr: fe80::32b5:c2ff:fed5:f660/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:536 errors:0 dropped:0 overruns:0 frame:0
          TX packets:340030 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:83602 (81.6 KiB)  TX bytes:41501379 (39.5 MiB)

and client

root@EA7300:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         rtiu2bras1.ante 0.0.0.0         UG    0      0        0 pppoe-wan
192.168.0.0     *               255.255.254.0   U     0      0        0 br-lan
192.168.3.0     *               255.255.255.0   U     0      0        0 tap0
200.40.162.195  *               255.255.255.255 UH    0      0        0 pppoe-wan
root@EA7300:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:57
          inet addr:192.168.0.1  Bcast:192.168.1.255  Mask:255.255.254.0
          inet6 addr: fd83:e61e:996d::1/60 Scope:Global
          inet6 addr: fe80::c641:1eff:fe1d:3c57/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:945489 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1457930 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:230584151 (219.9 MiB)  TX bytes:1680716958 (1.5 GiB)

eth0      Link encap:Ethernet  HWaddr 16:EA:B8:74:52:2B
          inet6 addr: fe80::14ea:b8ff:fe74:522b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1504  Metric:1
          RX packets:2351349 errors:1 dropped:0 overruns:0 frame:0
          TX packets:2324802 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1941962100 (1.8 GiB)  TX bytes:1551842006 (1.4 GiB)
          Interrupt:21

lan1      Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:57
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lan2      Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:57
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:192046 errors:0 dropped:0 overruns:0 frame:0
          TX packets:260503 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:85890589 (81.9 MiB)  TX bytes:41643742 (39.7 MiB)

lan3      Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:57
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:569798 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1103476 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:132195848 (126.0 MiB)  TX bytes:1214076058 (1.1 GiB)

lan4      Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:57
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1481 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1481 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:142773 (139.4 KiB)  TX bytes:142773 (139.4 KiB)

pppoe-wan Link encap:Point-to-Point Protocol
          inet addr:186.54.219.241  P-t-P:200.40.162.195  Mask:255.255.255.255
          inet6 addr: fe80::cc58:587f:ea8:9256/128 Scope:Link
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:1587064 errors:0 dropped:0 overruns:0 frame:0
          TX packets:954749 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:1668627570 (1.5 GiB)  TX bytes:255758306 (243.9 MiB)

tap0      Link encap:Ethernet  HWaddr 0A:BC:73:E1:05:FF
          inet addr:192.168.3.201  Bcast:0.0.0.0  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:50 errors:0 dropped:0 overruns:0 frame:0
          TX packets:48 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3177 (3.1 KiB)  TX bytes:5346 (5.2 KiB)

wan       Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:57
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1589505 errors:0 dropped:0 overruns:0 frame:0
          TX packets:957189 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1681551381 (1.5 GiB)  TX bytes:276836028 (264.0 MiB)

wlan0     Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:58
          inet6 addr: fe80::c641:1eff:fe1d:3c58/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2995 errors:0 dropped:0 overruns:0 frame:0
          TX packets:258299 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:354881 (346.5 KiB)  TX bytes:29103263 (27.7 MiB)

wlan1     Link encap:Ethernet  HWaddr C4:41:1E:1D:3C:59
          inet6 addr: fe80::c641:1eff:fe1d:3c59/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:246138 errors:0 dropped:0 overruns:0 frame:0
          TX packets:716177 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:32605877 (31.0 MiB)  TX bytes:504330922 (480.9 MiB)

If anyone bumped into this or has ideas let me know :slight_smile: thanks in advance!
Juan

2

Remove compression and mssfix for a start.

1 Like
3

Amazing... that did the trick, not sure which of the 2, but i'll test and leave the answer here just for future reference, thanks a ton @trendy !!

1 Like
4

For future reference, I think what happens is some kind of incompatibility of compression between different versions of openVPN (OpenWRT 19.07 had 2.4.something, OpenWRT 21 has 2.5.something)
There is a documented change in how that particular parameter works in openVPN documentation.
Here is a summary https://support.ecessa.com/hc/en-us/articles/360015878232-SSL-VPN-Compression-Options

5
2 Likes
6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.