6

I am setting a secondary (DD-WRT) router to act as a OpenVPN client so that all clients would get VPN access simply by connecting to the router. But seems clients traffic is always routed via the main gateway instead of the established VPN tunnel.

SETUP

ISP modem+router(gateway) <--LAN cable--> DD-WRT OpenVPN client <--LAN/WIFI--> clients

This secondary DD-WRT OpenVPN client can connect to the remote OpenVPN server ok.

I can ping hosts in the server side subnet by first telnetting into the DD-WRT.

The OpenVPN server also shows that the DD-WRT client is connected properly.

wget -O - http://icanhazip.com returns the remote server's public IP.

So the tunnel is up properly.

PROBLEM

Traffic from clients connected to my DD-WRT are routed through my gateway router, not through the VPN tunnel tun0.

I think I need to forward traffic from br0 interface to tun0 interface. I have tried following iptables rules and checked that IPv4 forward is enabled.

cat /proc/sys/net/ipv4/ip_forward ==> 1
cat /proc/sys/net/ipv4/conf/tun0/forwarding ==> 1 
cat /proc/sys/net/ipv4/conf/br0/forwarding ==> 1

# These rules are saved by pressing the 'Save firewall' button 
#and rebooting the DD-WRT router.
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

And separately

# These rules are saved by pressing the 'Save firewall' button 
# and rebooting the DD-WRT router.
iptables -I FORWARD -s 192.168.2.0/24 -d 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -s 192.168.66.0/24 -d 192.168.2.0/24 -j ACCEPT

SETTINGS

ISP modem+gateway router

No settings modified. It is as ISP has set it.

DD-WRT OpenVPN client

- Firmware: DD-WRT v24-sp2 (08/12/10) vpn
- SPI firewall: Disabled
- WAN: Disabled
- Operating mode: Router   (this disables NAT, right?)
- Gateway: 192.168.2.1
- Local DNS: 8.8.8.8
- NTP client: Enabled

I don't post VPN server/client configs because the client can connect to the server without errors and both ping and wget commands work properly from inside the DD-WRT.

So, my question is:

How do I route all traffic from clients connected to the DD-WRT to its OpenVPN tunnel tun0? Am I using iptables incorrectly? Add a new route perhaps?

If some info is missing please ask. Thank you in advance! :)

P.S. Below more info.

ROUTING TABLE (after VPN tunnel is up)

root@DD-WRT:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
87.219.xxx.xxx  192.168.2.1     255.255.255.255 UGH   0      0        0 br0
192.168.66.1    192.168.66.5    255.255.255.255 UGH   0      0        0 tun0
192.168.66.5    *               255.255.255.255 UH    0      0        0 tun0
192.168.5.0     192.168.66.5    255.255.255.0   UG    0      0        0 tun0
192.168.2 .0    *               255.255.255.0   U     0      0        0 br0
169.254.0.0     *               255.255.0.0     U     0      0        0 br0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         192.168.66.5    128.0.0.0       UG    0      0        0 tun0
128.0.0.0       192.168.66.5    128.0.0.0       UG    0      0        0 tun0
default         192.168.2.1     0.0.0.0         UG    0      0        0 br0

IP ROUTE SHOW

root@DD-WRT:~# ip route show
87.219.xxx.xxx via 192.168.2.1 dev br0
192.168.66.1 via 192.168.66.5 dev tun0
192.168.66.5 dev tun0  proto kernel  scope link  src 192.168.66.6
192.168.5.0/24 via 192.168.66.5 dev tun0
192.168.2.0/24 dev br0  proto kernel  scope link  src 192.168.2.160
169.254.0.0/16 dev br0  proto kernel  scope link  src 169.254.255.1
127.0.0.0/8 dev lo  scope link
0.0.0.0/1 via 192.168.66.5 dev tun0
128.0.0.0/1 via 192.168.66.5 dev tun0
default via 192.168.2.1 dev br0

IP RULE SHOW

root@DD-WRT:~# ip rule show
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default

OpenVPN CLIENT LOG

root@DD-WRT:~# cat /var/log/messages | grep openvpn
May 24 15:47:21 DD-WRT daemon.notice openvpn[699]: OpenVPN 2.1.1 mipsel-unknown-linux-gnu [SSL] [LZO2] [EPOLL] built on Aug 12 2010
May 24 15:47:21 DD-WRT daemon.warn openvpn[699]: WARNING: file '/tmp/openvpncl/client.key' is group or others accessible
May 24 15:47:21 DD-WRT daemon.notice openvpn[702]: UDPv4 link local: [undef]
May 24 15:47:21 DD-WRT daemon.notice openvpn[702]: UDPv4 link remote: 87.219.xxx.xxx:1194
May 24 15:47:23 DD-WRT daemon.notice openvpn[702]: [server] Peer Connection Initiated with 87.219.xxx.xxx:1194
May 24 15:47:25 DD-WRT daemon.notice openvpn[702]: TUN/TAP device tun0 opened
May 24 15:47:25 DD-WRT daemon.notice openvpn[702]: /sbin/ifconfig tun0 192.168.66.6 pointopoint 192.168.66.5 mtu 1500
May 24 15:47:26 DD-WRT daemon.notice openvpn[702]: Initialization Sequence Completed

IFCONFIG

root@DD-WRT:~# ifconfig
br0       
Link encap:Ethernet  HWaddr 00:1D:73:55:1C:A4
inet addr:192.168.2.160  Bcast:192.168.2.255  Mask:255.255.255.0
UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
RX packets:14119 errors:0 dropped:0 overruns:0 frame:0
TX packets:10639 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2068891 (1.9 MiB)  TX bytes:5382302 (5.1 MiB)

br0:0     
Link encap:Ethernet  HWaddr 00:1D:73:55:1C:A4
inet addr:169.254.255.1  Bcast:169.254.255.255  Mask:255.255.0.0
UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1

eth0      
Link encap:Ethernet  HWaddr 00:1D:73:55:1C:A4
UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
RX packets:13136 errors:0 dropped:0 overruns:0 frame:0
TX packets:10847 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2180726 (2.0 MiB)  TX bytes:5517739 (5.2 MiB)
Interrupt:4

eth1      
Link encap:Ethernet  HWaddr 00:1D:73:55:1C:A6
UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
RX packets:210 errors:0 dropped:0 overruns:0 frame:198105
TX packets:3683 errors:14 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:41273 (40.3 KiB)  TX bytes:963954 (941.3 KiB)
Interrupt:2 Base address:0x5000

lo        
Link encap:Local Loopback
inet addr:127.0.0.1  Mask:255.0.0.0
UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
RX packets:28 errors:0 dropped:0 overruns:0 frame:0
TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2034 (1.9 KiB)  TX bytes:2034 (1.9 KiB)

tun0      
Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.66.6  P-t-P:192.168.66.5  Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
RX packets:56 errors:0 dropped:0 overruns:0 frame:0
TX packets:62 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:4734 (4.6 KiB)  TX bytes:4428 (4.3 KiB)

vlan0     
Link encap:Ethernet  HWaddr 00:1D:73:55:1C:A4
UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
RX packets:13135 errors:0 dropped:0 overruns:0 frame:0
TX packets:10847 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1944080 (1.8 MiB)  TX bytes:5466622 (5.2 MiB)
Improve this question
5
  • Is interface forwading enabled? cat /proc/sys/net/ipv4/ip_forward needs to report 1, or both cat /proc/sys/net/ipv4/conf/tun0/forwarding and cat /proc/sys/net/ipv4/conf/br0/forwarding need to report 1. (the first enables forwarding globally, the second enables it per interface -- it can be done either way)
    – Andrew B
    May 24, 2014 at 16:18
  • @andrew-b cat /proc/sys/net/ipv4/ip_forward ==> 1 cat /proc/sys/net/ipv4/conf/tun0/forwarding ==> 1 cat /proc/sys/net/ipv4/conf/br0/forwarding ==> 1
    – user1534160
    May 24, 2014 at 17:26
  • Did you try creating a bridge ? I use such setup with tap adapter. For tun you might need NAT via iptables
    – Alec Istomin
    May 24, 2014 at 21:24
  • @alec-istomin I use tunneling because Android clients use OpenVPN Connect application and only tunneling is supported for that. To make the VPN available for all tunneling was the best option.
    – user1534160
    May 25, 2014 at 6:36
  • @alec-istomin To use NAT I must put the DD-WRT to Gateway mode, right? Wouldn't this cause issues because the primary router is also working as gateway?
    – user1534160
    May 25, 2014 at 6:37

1 Answer 1

Reset to default
2

Here I'm assuming that the lan and vpn interfaces on the server are br0 and tun0, respectively. 

# Enable IP forwarding.
echo 1 > /proc/sys/net/ipv4/ip_forward

# Allow postrouting to tun0. You may want to use "-s" here to strictly limit forwarding to IPs on your LAN.
iptables -t nat -A POSTROUTING -o tun0  -j MASQUERADE

# Enable forwarding from the LAN to the VPN (and back via related and established connections).
# Again, you may want to use "-s".
iptables -A FORWARD -i br0 -o tun0 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

It works for me on openwrt rotuer, and comes from @Xyne https://bbs.archlinux.org/viewtopic.php?pid=1208721#p1208721

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .