Hi All,
Ramble: I am sure this is a simple question and a simple answer, for which i apologizes. I have searched all over the internet to try to find the answer but simple cant find something that has the same problem as I do.
Problem: I am unable to connect to my local devices (LAN) (e.g. 192.168.1.51, via ping or via a browser) or the Internet once i connect from my laptop to my openVPN server (running on my openWRT router). I can browse the routers configuration page (192.168.1.1) Very basic setup example:.
To do the setup i followed the full guide: server.setup everything was left as the examples. When i connect from the client (my laptop) everything seems fine and I can browse the LEDE config page so i know i am "inside my house".
Is it as simple as the fact that I get a 192.168.200.2 IP address or is it a setting that i need to change in the firewall/openVpn configs.
If this is not just me being silly, and to enable LAN/Internet access needs an extra step i will update the guide to help others.
Config files:
Ruuning: LEDE Reboot 17.01.5
Network:
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd69:3124:5d6c::/48'
config dsl 'dsl'
option xfer_mode 'ptm'
option annex 'b'
option tone 'a'
option line_mode 'vdsl'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device 'lan_dev'
option name 'eth0.1'
option macaddr '38:35:fb:88:6f:f4'
config interface 'wan'
option proto 'pppoe'
option ipv6 '1'
option username 'XXXXXX'
option password 'XXXXXX'
option _orig_ifname 'ptm0'
option _orig_bridge 'false'
option ifname 'ptm0.101'
config device 'wan_dev'
option name 'ptm0'
option macaddr '38:35:fb:88:6f:f5'
config interface 'wan6'
option ifname '@wan'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 4 5 6t'
option vid '1'
config interface 'vpnserver'
option proto 'none'
option ifname 'ovpns0'
option auto '1'
Firewall:
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'any'
option reload '1'
config rule
option name 'Allow-OpenVPN-Inbound'
option target 'ACCEPT'
option src '*'
option proto 'tcpudp'
option dest_port 'XXXX'
config zone
option name 'vpnserver'
option input 'ACCEPT'
option output 'ACCEPT'
option masq '1'
option network 'vpnserver'
option forward 'REJECT'
config forwarding
option src 'vpnserver'
option dest 'wan'
config forwarding
option src 'vpnserver'
option dest 'lan'
openVPN sever:
config openvpn 'vpnserver'
option enabled '1'
option dev_type 'tun'
option dev 'ovpns0'
option proto 'udp'
option port 'XXXX'
option topology 'subnet'
option tls_server '1'
option mode 'server'
option server '192.168.200.0 255.255.255.0'
option route_gateway 'dhcp'
option compress 'lz4'
option keepalive '10 120'
option persist_key '1'
option persist_tun '1'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/my-server.crt'
option key '/etc/openvpn/my-server.key'
option dh '/etc/openvpn/dh2048.pem'
option tls_auth '/etc/openvpn/tls-auth.key 0'
option client_to_client '1'
option log '/tmp/openvpn.log'
list push 'topology subnet'
list push 'redirect-gateway def1'
list push 'route-gateway dhcp'
list push 'route 192.168.200.0 255.255.255.0'
list push 'dhcp-option DNS 192.168.1.1'
list push 'compress lz4'
list push 'persist-key'
list push 'persist-tun'
openVPN Client:
client
dev tun
proto udp
fast-io
remote XX.XX.XX.XX XXXX
remote-cert-tls server
nobind
persist-key
persist-tun
compress lz4
verb 3
key-direction 1
<ca>
-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4097 (0x1001)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=London, O=WWW Ltd.
Validity
Not Before: Jul 26 21:25:21 2018 GMT
Not After : Jul 23 21:25:21 2028 GMT
Subject: CN=my-client
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
XXXX
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage:
Digital Signature
X509v3 Extended Key Usage:
TLS Web Client Authentication
Signature Algorithm: sha256WithRSAEncryption
XXXX
-----BEGIN CERTIFICATE-----
XXXX
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
XXXX
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
XXXX
-----END OpenVPN Static key V1-----
</tls-auth>
You may have guessed I am very new to all this....
Thanks guys,
James
