Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup a fresh dd-wrt router to work with OpenVpn. However, the OpenVpn I need to use has a automatically generated config file. That looks like:

# Automatically generated OpenVPN client config file
# Generated on Wed Sep 11 17:15:39 2013 by ip-10-164-12-159
# Note: this config file contains inline private keys
#       and therefore should be kept confidential!
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=openvpn
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=-redacted-
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=-redacted-
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# -----BEGIN CERTIFICATE-----
# -redacted-
# -----END CERTIFICATE-----
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=0
# OVPN_ACCESS_SERVER_ORGANIZATION=OpenVPN Technologies, Inc.
setenv FORWARD_COMPATIBLE 1
client
proto udp
nobind
remote -redacted-
port 443
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
auth-user-pass
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

<ca>
-----BEGIN CERTIFICATE-----
-redacted-
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
-redacted-
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
-redacted-
-----END PRIVATE KEY-----
</key>

key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key (Server Agent)
#
-----BEGIN OpenVPN Static key V1-----
-redacted-
-----END OpenVPN Static key V1-----
</tls-auth>

If a SSH into my router (this means I have turned sshd on) I can use this configuration to connect to the OpenVpn server. If I look at the VPN Server Access Control Page is shows that I have successfully connected. However, I believe the routing table of the dd-wrt is not sending traffic from the wifi device to the VPN.

I am very new to routing and have not been able to work any of the dd-wrt tutorials (they all assume that you use another type of configuration, which I cannot use). Therefore my questions is in two parts:

  1. Can someone guide me in setting up the iptables (or whatever sends the traffic from the wifi networking device) in a scriptable fashion so that I can run the iptables script and then start OpenVPN on the router.

  2. How do I change this to work only on a VAP (virtual access point) or only with certain ip addresses (so only the device with the ip of x.x.x.x connected to the AP goes through the VPN).

Note: I normally like to have these scripts on my computer and then I ssh them onto whatever dd-wrt router is around and then run them to open a VPN connection.

Going through google and this site hasn't helped my very much so far.

share|improve this question

closed as off-topic by Ward, Falcon Momot, Jenny D, MadHatter, dawud Sep 12 '13 at 15:28

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – Falcon Momot, Jenny D, MadHatter, dawud
If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

1 Answer 1

I'm mostly speaking based on my plans to move my home OpenVPN setup to OpenWRT. It is currently implemented on Fedora18, but I'd like to use the test machine for other things. I would imagine that DD-WRT would be similar, but there may be some inaccuracies due to implementation difficulties. Hopefully someone with more DD-WRT experience should be able to back me up and smooth out any bumps.

The dev tun directive means that you are using a separate subnet, usually set using the server directive (I'm guessing that this part is handled in on the VPN Management page). For example, server 10.0.0.0 255.255.255.0, would mean that your clients would be given an address on their client's virtual adapter within this range.

If this device is your internet router, then it is being used as the default gateway for your network. If your wireless device does not have a static route for a given network set on it, it asks the default gateway. What I suspect is happening is that your iptables rules are not set to look for and accept any traffic from your VPN subnet, based on the input interface

You can view your iptables configuration using iptables -nvL --line-numbers. People wanting to use your device as a router would run into something like the following.

  1. Accept established connections.
  2. Accept connections to local addresses from the internet corresponding with any port forwarding rules you have in place.
  3. Accept traffic from the local subnet.
  4. Drop/Reject all remaining attempts that cross the rule chain.

If your OpenVPN subnet is not mentioned in stage #3, then it will be hitting stage #4 and dropping.

These procedures are neatly organized into rule chains based on task. What I am planning on doing is to define a chain for my OpenVPN subnets at the beginning of the "zone_lan_forward", the rule chain that handles local connections. It goes something like this:

iptables -N zone_lan_vpn

iptables -I zone_lan_forward -i tun+ -j zone_lan_vpn

What you do next depends on what kind of restrictions you want to apply to these clients. I have three different OpenVPN instances (One administrative and two levels of guest access), so I have divided this a bit further.

Users on the administrative VPN subnet are granted access to nearly everything, so I have implemented a DENY->ALLOW setup that bars only the specific addresses that are off the menu before accepting everything else. Guests are only allowed access to certain resources, so they are on an ALLOW->DENY setup.

The part that I am uncertain of with DD-WRT is how to set this up to occur automatically on boot. In OpenWRT, firewall rules are generated based on scripts (that should not be meddled with) in /lib/firewall. The config file, /etc/config/firewall, contains the following lines:

config 'include'

option 'path' '/etc/firewall.user'

The /etc/firewall.user file defined above is read as a BASH script whenever the firewall rules are reloaded, in order to allow user-specific adjustments. I'm not familiar with DD-WRT specifically, so I'm unsure if the same firewall setup method is used.

If your firewall rules are at the DD-WRT default, could you post the output of iptables -nvL --line-numbers on pastebin or similar, with your public address redacted? It would help me to get a better idea of the specific layout of DD-WRT. Are you able to confirm the IP address on the OpenVPN subnet that the remote client is getting? Could you also post the routing table of your router, as shown by the results of route -n? (Make sure that the OpenVPN server is running while you do this). If you redact network addresses from this, please identify what the purpose of the range was (e.g. local subnet, VPN subnet, public).

Of course, this could all be moot if there is an option for defining this access in the web interface. Is there an option in the web console of your router to filter users on the OpenVPN subnet?

I'm afraid I don't quite understand part two of your question. Do you only want certain IP addresses to be able to connect to the device via OpenVPN? Do you want this service to be on a server other than your DD-WRT router in the future?

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.