Routing over point-to-point OpenVPN tunnel

Installing and Using OpenWrt
1

Hello all,

I have two OpenWrt One routers running OpenWrt version 24.10. I have successfully established an OpenVPN tunnel between the two via the WAN. Now I want to route between the subnets that the two routers are connected to.

The routers' LAN addresses are x.y.73.1 and x.y.74.1 and their LAN subnets are x.y.73.0/24 and x.y.74.0/24 respectively. The tunnel addresses are x.y.75.1 and x.y.75.2 at the two routers' ends. I've created an interface in the LuCi menu Network -> Interfaces -> Add New Interface named OpenVPN, Unmanaged, Device = tun0. I've then added that interface to the lan firewall zone. I can successfully ping each tunnel endpoint over the tunnel. The two routers are the default gateway for their two subnets.

Now I have two problems with the routing:

  1. I can't define a static route over the tunnel. On router x.y.74.1, in the LuCi menu Network -> Routing -> Add, I add a route Interface=OpenVPN, unicast, Target=x.y.73.0/24, Gateway=Unspecified. I Save and Save and Apply. But the route doesn't get created in the system routing table. I ssh to the router and type the command "route" - there is no route to x.y.73.0 defined.
  2. After manually creating the route, I can ping from the router to addresses on the other subnet, but other devices on the source router's subnet can't ping them. It's as if the router is not acting as a gateway to the tunnel. On router x.y.74.1, I type the command "route add -net x.y.73.0/24 tun0". Then, on router x.y.74.1 I can successfully ping x.y.73.123. But from x.y.74.234, I can't ping x.y.73.123.

Any assistance would be much appreciated. Thanks in advance.

Graham

2

Before going deep into solutions for OpenVPN, have you considered Wireguard? It's actually a lot easier to configure (both in general and for site-to-site routing) and it is also much more performant.

3

Thanks for replying, psherman. I've used OpenVPN in the past (not with OpenWrt though), so I thought I would use that. But I'm open to changing to Wireguard. I'll give it a go.

Thanks again,
Graham

4

WireGuard is indeed easier, what you probably want is a site-to-site setup.
See:
https://openwrt.org/docs/guide-user/services/vpn/wireguard/site-to-site

or see my notes, I have set this up multiple times:

Start with setting up one side (which must have a public IP address) up as Server, but for Allowed IPs add the subnet of the router of the other side

Start with setting up the other side as a Client but setup up the firewall as if it is a Server and instead of 0.0.0.0/0 for Allowed IPs use the routers subnet of the other side as Allowed IPs and also the subnet of the WireGuard interface

The Server guide has a paragraph about site-to-site setup

It is possible also with OpenVPN but needs some more work.

You are redacting your private IP addresses which is not necessary, we can give better support if you share that information with us