Settings for OpenVPN

Installing and Using OpenWrt
1

Hello,

I need your help !

I try to configure OpenVPN. The idea is to have an access to my LAN in order to manage HomeAssistant.

I followed several tutorial and i assumed to have configured OpenVPN, generate certificat, generate opvn file.

But when i'm using smartphone OpenVPN solfware, using files generated, it's not working.

I think i have seomething wrong into port redirection maybe.
On my Internet Box, i autorize 1194 port from web to OpenWRT IP.
And into OpenWRT, i add a rule allowing UDP from WAN port 1194 to my VLAN Domotic port 1194.

I don't know how to find where i have a blocking point.

Thanks for your help !

2

Use WireGuard much faster and easier to setup.
You need the WireGuard server setup guide see:

1 Like
3

Thanks but, if it's some port redirection problems, it would be the same with another VPN

4

I think there's some mistake here. A correct vpn implementation is not going to need or be affected by port forwards - that is, you will not be needing to setup a port forward on the device the VPN is terminating on because the port forwards only apply to the NAT engine and the VPN comes in AFTER the NAT engine has finished.

OpenVPN is a real problem to configure because it's developers tried to make it KISS by having it manipulate the Linux NAT rules "behind the scenes" Depending on what configs and keywords you feed it, it may or may not muck about with iptables. The idea is since most users are using vpn's in the case of they want to run a vpn on their router to get into their home network from a remote PC, forcing nat on on both the client and server removes the bother of paying attention to having the correct routing table. In other words, with OpenVPN the KISS approach they use makes it easier to setup in the "default case" but a lot more complex in any other kind of case.

WG seems to have a more equal approach where it's developers assume you know something about VPNs and doesn't try to do stuff behind your back. You would be smart to take egc's advice.

2 Likes
5

You can use tcpdump on OpenWrt to see if any attempts from the phone are making it through the ISP and the ISP router to your wan port. The phone must be connected to an "outside" network-- turn its wifi off and have it use the cellular network.

As noted by @tmittelstaedt, on the router which runs the OpenVPN server, you would open the port not forward it.

OpenVPN posts a lot of messages in the system log. Check that the server starts up completely ("Initialization Sequence Completed") then check if it is trying to respond to anything from the phone.