Problem with OpenVPN and firewall rules or routing

Installing and Using OpenWrt Network and Wireless Configuration
1

Hello,

now that I have successfully installed OpenWRT on my Mikrotik RB750GR3 I wanted to install and use this router as an OpenVPN Client.

Here is my network:

Site A (OPNsense Firewall):
Local-Network: 192.168.1.0/24
Tunnel-Network: 10.30.30.0/29
Remote-Network: 192.168.2.0/24

Site B (Mikrotik with OpenWRT):
Local-Network: 192.168.2.0/24
Tunnel-Network: 10.30.30.0/29
Remote-Network: 192.168.1.0/24

The OpenVPN tunnel is up an running. I see the logs on both sites. But there isn't any traffic routed through the VPN. I can't ping a server from Site A to Site B and vice versa.

I'm really new to OpenWRT and I don't know much about the firewall system or routing. Please can somebody help me? I haven't touched the firewall on Site B. On Site A I know the firewall and the config is here ok.

Here is the firewall config from Site A:

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fc00::/6'
        option dest_ip 'fc00::/6'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config zone
        option name 'fw_Flexi'
        option forward 'REJECT'
        option output 'ACCEPT'
        option network 'if_fleximausvpn'
        option input 'REJECT'
        option masq '1'
        option mtu_fix '1'

So which rule do I need in the firewall to communicate with both networks? Thank you very much for your help!

2

Before going into VPN thing, could you confirm that both routers have internet connection?

3

Yes, they both have a working internet connection. Also the clients behind those routers.

4

You need to enable forwarding from LAN to VPN

5

Sorry, but I don't know. In the OpenVPN config or in firewall? Can you please give me an example?

7

https://openwrt.org/docs/guide-user/services/vpn/openvpn/client
This is actually one way to set it up.

A different way would be to have a separate zone for VPN, but then allow forwarding from LAN to VPN (like what you have for Router A)

8
9

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.