I have an OpenWRT router with WAN(eth1) and LAN(eth0) interface.

I wanted to install an openVPN server on this router, so I could access from the WAN side into the LAN side.

My LAN(eth0) has a DHCP server configured over, and has a static IP of When I connect any PC to LAN(eth0) it gets some IP in this range to

I have installed openvpn easy rsa and other required utilities and also generated keys for client and server. I have copied those keys to client as well.

What I would want is a very basic steps and configuration to gain some confidence, to establish a connection from client to server.

The net based blogs mention so much extra information..it becomes difficult for networking beginners to follow.

Edit: the /etc/easy-rsa/vars file has following contents.

export EASY_RSA="/etc/easy-rsa"
export OPENSSL="openssl"          
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"

export KEY_CONFIG=`/usr/sbin/whichopensslcnf $EASY_RSA`
export KEY_DIR="$EASY_RSA/keys"
et PKCS11_MODULE_PATH="dummy"                                          
export PKCS11_PIN="dummy"
export KEY_SIZE=2048
export CA_EXPIRE=3650
export KEY_EXPIRE=3650
export KEY_COUNTRY="IN"                                                
export KEY_PROVINCE="MH"                                               
export KEY_CITY="Pune"                                                 
export KEY_ORG="My Org"                                                              
export KEY_EMAIL="me@myhost.mydomain"                                                       
export KEY_OU="MyOrganizationalUnit"
export KEY_NAME="EasyRSA"
# PKCS11 Smart Card                                                    
# export PKCS11_MODULE_PATH="/usr/lib/changeme.so"                     
# export PKCS11_PIN=1234                                               

# If you'd like to sign all keys with the same Common Name, 
# uncomment the KEY_CN export below
# You will also need to make sure your OpenVPN server config 
# has the duplicate-cn option set 
# export KEY_CN="CommonName"

Edit 2: I have given WAN a static IP which a VPN client with IP will try to access.

The server configuration is:

package openvpn
config 'openvpn' 'samplevpnconfig'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tun0'

        option 'client_to_client' '1'
        option 'keepalive' '10 120'
        option 'comp_lzo' '1'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'verb' '3'
        option 'mute' '20'
        option 'ifconfig_pool_persist' '/tmp/ipp.txt'
        option 'status' '/tmp/openvpn-status.log'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'
        option 'dh' '/etc/openvpn/dh1024.pem'

        #this should be on a completely different subnet than your LAN
        option 'server' ''
        list 'push' 'route' #this should MATCH your current LAN info
        list 'push' 'dhcp-option DNS' #this should MATCH your current LAN info
        list 'push' 'dhcp-option DOMAIN' #this should MATCH your current LAN info

Where is LAN (eth0) static IP address. Honestly I have no idea what those non obvious parameters mean.

The client configuration in Client machine /etc/openvpn/client.conf

proto udp
dev tun0

remote 1194
resolv-retry infinite
verb 3
ca /etc/openvpn/ca.crt
cert /etc/openvpn/myclient.crt
key /etc/openvpn/myclient.key

WHen I try the following command: #openvpn client.conf

I get TLS error: (check your network connectivity)

and tcpdump on server gives:

13:57:19.026056 IP > UDP, length 14
13:57:19.026147 IP > ICMP udp port openvpn unreachable, len0

But connectivity seems proper(ping, tcpdump show packet comming)

  • Do you want bridged or routed connection? Bridged means that OpenVPN is essentially an "encrypted cable" and behaves pretty much like ethernet, VPN will be using LAN subnet, hosts managed by the LAN DHCP. Routed means a separate subnet for VPN (separate firewall zone and rules), IP management inside OpenVPN. – sam_pan_mariusz Jul 23 '15 at 13:44
  • @sam_pan_mariusz I am guessing Routed connection is what is typically used...So lets say I am outside my home router WAN(eth1), and want to access lan(eth0) network devices on the LAN side, I think this should mean Routed connection. Can you please guide me on this. – RootPhoenix Jul 23 '15 at 14:17

First, I never recommend keeping SSL CA private key on a device directly connected to WAN. This is insecure.

In OpenWRT a configuration for OpenVPN is in /etc/config/openvpn - option names are almost identical as in OpenVPN original config, except for in OpenWRT hyphens (-) should be converted to underscores (_).

Follow this howto. Remove ifconfig_pool_persist if you don't need static addresses, or use ccd option for this (more reliable) with /etc/openvpn/ccd. Replace IP subnet and routes with your own. Add a digit in the end of interface name to avoid firewall configuration problems. I also recommend using tap interface (more flexible), not tun, but it's up to you. Add tls_auth to better protect against DoS attacks, in OpenVPN manual there's an example how to generate a key (search for --genkey).

To enable service autostart, use /etc/init.d/openvpn enable.

When you have OpenVPN up, configure firewall.

| improve this answer | |
  • My /etc/easy-rsa/keys folder contains a file called serial which has "01" as entry. Also while generating certificates I found that "01.pem" file is getting created in the keys directory...however on the blogs they have mentioned dh2048.pem or dh1024.pem file. Does my setup have something wrong ? – RootPhoenix Jul 24 '15 at 4:26
  • The dh????.pem files contain Diffie–Hellman pairs, they have little to do with actual certs. Read OpenVPN manual on --dh. Your certificate and key files can have any name, just edit paths in config. If you find any troubles using easy-rsa, switch to a GUI application, XCA being a nice, free example (it employs openssl internally, just like easy-rsa). – sam_pan_mariusz Jul 24 '15 at 4:52
  • When I generate keys for client using build-key client_name, it does not ask for "ENTER EXPORT PASSWORD" but when i generate using build-key-pkcs12 client_name... it asks for EXPORT PASSWORD.. will this be used later on..which one should I use.? – RootPhoenix Jul 24 '15 at 5:22
  • Check OpenVPN manual for --askpass. PKCS12 file contains (among others) a certificate private key. Key password can be empty, and I believe it's the only reasonable way to go for you. – sam_pan_mariusz Jul 24 '15 at 6:18
  • I did the steps mentioned in link. Adding tun0 interface. COnfiguring firewall zones etc. But when I try to connect the server using #openvpn client.conf I get unreachable error even though I am able to ping it. – RootPhoenix Jul 24 '15 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.