I have an OpenWRT router with WAN(eth1) and LAN(eth0) interface.
I wanted to install an openVPN server on this router, so I could access from the WAN side into the LAN side.
My LAN(eth0) has a DHCP server configured over, and has a static IP of 172.20.51.61/24. When I connect any PC to LAN(eth0) it gets some IP in this range 172.20.51.100/24 to 172.20.51.150/24.
I have installed openvpn easy rsa and other required utilities and also generated keys for client and server. I have copied those keys to client as well.
What I would want is a very basic steps and configuration to gain some confidence, to establish a connection from client to server.
The net based blogs mention so much extra information..it becomes difficult for networking beginners to follow.
Edit: the /etc/easy-rsa/vars file has following contents.
export EASY_RSA="/etc/easy-rsa" export OPENSSL="openssl" export PKCS11TOOL="pkcs11-tool" export GREP="grep" export KEY_CONFIG=`/usr/sbin/whichopensslcnf $EASY_RSA` export KEY_DIR="$EASY_RSA/keys" et PKCS11_MODULE_PATH="dummy" export PKCS11_PIN="dummy" export KEY_SIZE=2048 export CA_EXPIRE=3650 export KEY_EXPIRE=3650 export KEY_COUNTRY="IN" export KEY_PROVINCE="MH" export KEY_CITY="Pune" export KEY_ORG="My Org" export KEY_EMAIL="firstname.lastname@example.org" export KEY_OU="MyOrganizationalUnit" export KEY_NAME="EasyRSA" # PKCS11 Smart Card # export PKCS11_MODULE_PATH="/usr/lib/changeme.so" # export PKCS11_PIN=1234 # If you'd like to sign all keys with the same Common Name, # uncomment the KEY_CN export below # You will also need to make sure your OpenVPN server config # has the duplicate-cn option set # export KEY_CN="CommonName"
Edit 2: I have given WAN a static IP
192.168.18.100/24 which a VPN client with IP
192.168.18.101/24 will try to access.
The server configuration is:
package openvpn config 'openvpn' 'samplevpnconfig' option 'enable' '1' option 'port' '1194' option 'proto' 'udp' option 'dev' 'tun0' option 'client_to_client' '1' option 'keepalive' '10 120' option 'comp_lzo' '1' option 'persist_key' '1' option 'persist_tun' '1' option 'verb' '3' option 'mute' '20' option 'ifconfig_pool_persist' '/tmp/ipp.txt' option 'status' '/tmp/openvpn-status.log' option 'ca' '/etc/openvpn/ca.crt' option 'cert' '/etc/openvpn/server.crt' option 'key' '/etc/openvpn/server.key' option 'dh' '/etc/openvpn/dh1024.pem' #this should be on a completely different subnet than your LAN option 'server' '192.168.18.100 255.255.255.0' list 'push' 'route 172.20.51.61 255.255.255.0' #this should MATCH your current LAN info list 'push' 'dhcp-option DNS 172.20.51.1' #this should MATCH your current LAN info list 'push' 'dhcp-option DOMAIN 172.20.51.1' #this should MATCH your current LAN info
Where 172.20.51.61 is LAN (eth0) static IP address. Honestly I have no idea what those non obvious parameters mean.
The client configuration in Client machine /etc/openvpn/client.conf
client proto udp dev tun0 remote 192.168.18.100 1194 resolv-retry infinite nobind persist-key persist-tun verb 3 comp-lzo ca /etc/openvpn/ca.crt cert /etc/openvpn/myclient.crt key /etc/openvpn/myclient.key
WHen I try the following command: #openvpn client.conf
I get TLS error: (check your network connectivity)
and tcpdump on server gives:
13:57:19.026056 IP 192.168.18.101.34212 > 192.168.18.100.openvpn: UDP, length 14 13:57:19.026147 IP 192.168.18.100 > 192.168.18.101: ICMP 192.168.18.100 udp port openvpn unreachable, len0
But connectivity seems proper(ping, tcpdump show packet comming)