[Solved] OpenVPN client on LAN2 kills connection on LAN

dramm33 · January 4, 2019, 7:29pm

At the moment IP. In my openvpn config file I have something like this:

list remote '12.123.123.123 80'

But I'm thinking about switching to NordVPN next month and I think they use hostname.

These two rules that guy in the other thread used are equivalent to what you told me to do or is it something else entirely?

ip route add default via 192.168.0.1 table 10
ip rule add from 192.168.5.2 table 10

Something to occurred to me. Does it matter that the OpenWrt router is connected to my ISP modem/router which is configured in bridge mode (to avoid double NAT)?

I reading all I can find on routes to actually understand what in happening with all those rules/routes and actually be able to troubleshoot this situation. If there is any material you recommend let me know.

lleachii · January 4, 2019, 8:01pm

Yes, those commands are similar (default = 0.0.0.0/0). You enter those commands at the system prompt when not using the UCI/web GUI. Please be advised, it's just one route, and one routing rule. You keep mixing terms.

It shouldn't. You should be getting a public IP from the modem.

Perhaps: https://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.rpdb.html

dramm33 · January 26, 2019, 4:09pm

After studying the material @lleachii recommend and doing some more research I ended up finding another thread about the same thing, which had the solution.

Final Solution

I did what @trendy recommended in this post:

I added the following to Network > Firewall > Custom Rules

ip route add 192.168.1.0/24 dev br-lan table lan
ip route add default via xxx.xx.192.1 src 100.64.196.32 table lan
ip route add 192.168.10.0/24 dev br-lan2 table vpn
ip route add default via xx.xx.0.102 src xx.xx.0.101 table vpn
ip rule add from 192.168.10.0/24 to default lookup vpn prio 16000
ip rule add from 192.168.1.0/24 to default lookup lan prio 16010
ip rule add iif lo to default lookup lan prio 16020

Added vpn and lan tables to /etc/iproute2/rt_tables

#
# reserved values
#
128     prelocal
255     local
254     main
253     default
250     vpn
240     lan
0       unspec
#
# local
#
#1      inr.ruhep

Config files for reference

/etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd32:c7d2:6fa8::/48'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ifname 'eth0.1'
        option ipaddr '192.168.1.1'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 0t'

config interface 'vpn'
        option proto 'none'
        option ifname 'tun0'

config interface 'lan2'
        option _orig_bridge 'false'
        option proto 'static'
        option ipaddr '192.168.10.1'
        option netmask '255.255.255.0'
        option type 'bridge'          
        option ip6assign '60'

/etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'               
        option proto 'udp'             
        option src_ip 'fc00::/6'       
        option dest_ip 'fc00::/6'      
        option dest_port '546'         
        option family 'ipv6'           
        option target 'ACCEPT'         
                                       
config rule                            
        option name 'Allow-MLD'        
        option src 'wan'               
        option proto 'icmp'            
        option src_ip 'fe80::/10'      
        list icmp_type '130/0'         
        list icmp_type '131/0'         
        list icmp_type '132/0'         
        list icmp_type '143/0'         
        option family 'ipv6'           
        option target 'ACCEPT'         
                                       
config rule                            
        option name 'Allow-ICMPv6-Input'
        option src 'wan'                
        option proto 'icmp'             
        list icmp_type 'echo-request'   
        list icmp_type 'echo-reply'     
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        list icmp_type 'router-solicitation'    
        list icmp_type 'neighbour-solicitation' 
        list icmp_type 'router-advertisement'   
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-ICMPv6-Forward'      
        option src 'wan'                        
        option dest '*'                         
        option proto 'icmp'                     
        list icmp_type 'echo-request'           
        list icmp_type 'echo-reply'             
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-IPSec-ESP'           
        option src 'wan'                        
        option dest 'lan'                       
        option proto 'esp'                      
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-ISAKMP'              
        option src 'wan'                        
        option dest 'lan'                       
        option dest_port '500'                  
        option proto 'udp'                      
        option target 'ACCEPT'                  
                                                
config include                                  
        option path '/etc/firewall.user'        
                                                
config zone                                     
        option name 'vpnclient'                 
        option network 'vpn'                    
        option input 'REJECT'                   
        option output 'ACCEPT'                  
        option forward 'REJECT'                 
        option masq '1'                         
        option mtu_fix '1'                      
                                                
config zone                                     
        option name 'lan2'                      
        option input 'REJECT'                   
        option forward 'REJECT'                 
        option output 'ACCEPT'                  
        option network 'lan2'                   
                                                
config forwarding                               
        option dest 'wan'                       
        option src 'lan'                                    
                                                
config forwarding                               
        option dest 'vpnclient'                 
        option src 'lan2'

PS1: For some reason DHCP on LAN2 isn't working, it's not a issue to me, but be aware of it in case you copy the configs.
PS2: I can't ping from one LAN to the other. Tried adding the forwarding rules without success.

lleachii · January 26, 2019, 5:10pm

Please understand that this file is reloaded any time the firewall is.

This may not lead to major issues in your config, but may to others.

Glad you got it working!

trendy · January 26, 2019, 6:42pm

I suggest adding them in the same firewall zone LAN.

Have you enabled it? Post also the /etc/config/dhcp

dramm33 · January 26, 2019, 9:29pm

Network > Firewall > Zones

/etc/config/firewall (just the added forwardings)

config forwarding
	option dest 'lan'
	option src 'lan2'

config forwarding
	option dest 'lan2'
	option src 'lan'

Not sure what you mean by enabling it. Ignore interface on Network > Interfaces > LAN2 > DHCP Server is unchecked.

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option name 'DCH-Arch'
	option dns '1'
	option mac 'XX:XX:XX:XX:6B:B4'
	option ip '192.168.1.3'

config domain
	option ip '192.168.1.3'
	option name 'desktop'

config host
	option name 'DMWC-Arch'
	option dns '1'
	option mac 'xx:xx:xx:xx:B9:F5'
	option ip '192.168.1.4'

config domain
	option ip '192.168.1.4'
	option name 'laptop'

config host
	option name 'OP2'
	option dns '1'
	option mac 'xx:xx:xx:xx:3E:F6'
	option ip '192.168.1.5'

config dhcp 'lan2'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'lan2'
	option ra 'server'
	option dhcpv6 'server'
	option ra_management '1'

trendy · January 26, 2019, 11:30pm

Still, you are rejecting INPUT from zone LAN2, so the DHCP packets from the hosts in LAN2 will never reach the router, as you don't specifically allow port 67.

I had a closer look in the rules you added. Since you want to have intra-LAN traffic, you must add a route for the other network in the new routing tables. Otherwise packets to the other LAN go to the internet gateway.

ip route add 192.168.10.0/24 dev br-lan2 table lan
ip route add 192.168.1.0/24 dev br-lan table vpn

dramm33 · January 27, 2019, 1:38pm

By adding these two rules I can ping between LANs!
Edit: I just notice that I got really weird ping timings

➜  ~ ping 192.168.10.172
PING 192.168.10.172 (192.168.10.172) 56(84) bytes of data.
64 bytes from 192.168.10.172: icmp_seq=1 ttl=63 time=4.01 ms
64 bytes from 192.168.10.172: icmp_seq=2 ttl=63 time=5.81 ms
64 bytes from 192.168.10.172: icmp_seq=3 ttl=63 time=3.44 ms
64 bytes from 192.168.10.172: icmp_seq=4 ttl=63 time=80.10 ms
64 bytes from 192.168.10.172: icmp_seq=5 ttl=63 time=105 ms
64 bytes from 192.168.10.172: icmp_seq=6 ttl=63 time=129 ms
64 bytes from 192.168.10.172: icmp_seq=7 ttl=63 time=153 ms
64 bytes from 192.168.10.172: icmp_seq=8 ttl=63 time=173 ms
64 bytes from 192.168.10.172: icmp_seq=9 ttl=63 time=196 ms
64 bytes from 192.168.10.172: icmp_seq=10 ttl=63 time=48.8 ms
64 bytes from 192.168.10.172: icmp_seq=11 ttl=63 time=41.2 ms
64 bytes from 192.168.10.172: icmp_seq=12 ttl=63 time=675 ms
64 bytes from 192.168.10.172: icmp_seq=13 ttl=63 time=5.50 ms
64 bytes from 192.168.10.172: icmp_seq=14 ttl=63 time=412 ms
64 bytes from 192.168.10.172: icmp_seq=15 ttl=63 time=950 ms
64 bytes from 192.168.10.172: icmp_seq=16 ttl=63 time=7.11 ms
^C
--- 192.168.10.172 ping statistics ---
16 packets transmitted, 16 received, 0% packet loss, time 31ms
rtt min/avg/max/mdev = 3.438/186.983/950.424/262.211 ms

That's way to much for just going to the router and back.
(I'm pinging from a cabled connection on LAN to my phone on LAN2 wifi)

By allowing INPUT and FORWARD in zone lan2 DCHP works, however I get a DNS leak.
I tried setting the VPN DNS in Network > Interfaces > LAN2 > Common Configuration > Use custom DNS servers and in Network > Interfaces > LAN2 > DHCP Server > Advanced Settings > DHCP-Options but I still get the leak.

Setting manual IP and rejecting INPUT/FORWARD in zone lan2 allows ping between LANs (because of those two routes) and I don't get leaks.
I'm just not sure there will be any undesired behaviours because of the reject (besides DCHP not working).

vgaetera · January 27, 2019, 4:10pm

https://openwrt.org/docs/guide-user/base-system/dhcp_configuration#upstream_dns_provider

tmomas · February 6, 2019, 4:12pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.