3

I got asus rt-n18u router and I want to setup vpn access from local network

So I've isntalled optware and vpnc on the router and successfully created vpn connection on tun0 interface (ifconfig below). The problem is I cant ping/connect to VPN from local network, however I can from router itself.

The question - how to forward br0 to tun0?

ip_forward set to 1.

iptables and routing table provided below.

ifconfig output:

br0        Link encap:Ethernet  HWaddr F0:79:59:D3:7D:20
           inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
           UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
           RX packets:32993 errors:0 dropped:0 overruns:0 frame:0
           TX packets:40247 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0
           RX bytes:4436741 (4.2 MiB)  TX bytes:31815424 (30.3 MiB)

eth0       Link encap:Ethernet  HWaddr F0:79:59:D3:7D:20
           inet addr:212.XX.XX.XX  Bcast:212.XX.XX.XX  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:412673 errors:0 dropped:0 overruns:0 frame:0
           TX packets:431752 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000
           RX bytes:105828668 (100.9 MiB)  TX bytes:121288162 (115.6 MiB)
           Interrupt:179 Base address:0x4000

eth1       Link encap:Ethernet  HWaddr F0:79:59:D3:7D:20
           UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
           RX packets:12545 errors:0 dropped:0 overruns:0 frame:212071
           TX packets:22614 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000
           RX bytes:1704797 (1.6 MiB)  TX bytes:14120516 (13.4 MiB)
           Interrupt:163

lo         Link encap:Local Loopback
           inet addr:127.0.0.1  Mask:255.0.0.0
           UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
           RX packets:4023 errors:0 dropped:0 overruns:0 frame:0
           TX packets:4023 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0
           RX bytes:858801 (838.6 KiB)  TX bytes:858801 (838.6 KiB)

tun0       Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-0
0-00
           inet addr:198.XX.XX.XX  P-t-P:198.XX.XX.XX  Mask:255.255.255.255
           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1412  Metric:1
           RX packets:284 errors:0 dropped:0 overruns:0 frame:0
           TX packets:1172 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:500
           RX bytes:26331 (25.7 KiB)  TX bytes:95242 (93.0 KiB)

vlan1      Link encap:Ethernet  HWaddr F0:79:59:D3:7D:20
           UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
           RX packets:230007 errors:0 dropped:0 overruns:0 frame:0
           TX packets:205941 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0
           RX bytes:24156339 (23.0 MiB)  TX bytes:98109904 (93.5 MiB)

tun0 - vpn

eth0 - WAN

br0 - local interface

Here is routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
193.XX.XX.XX    1.45.XX.XX      255.255.255.255 UGH   0      0        0 eth0
147.XXX.XXX.XXX *               255.255.255.255 UH    0      0        0 tun0
212.90.XX.XX    *               255.255.255.255 UH    0      0        0 eth0
172.24.6.254    *               255.255.255.255 UH    0      0        0 tun0
147.XXX.XXX.XXX *               255.255.255.255 UH    0      0        0 tun0
147.XXX.XXX.XXX *               255.255.255.255 UH    0      0        0 tun0
198.18.1.0      *               255.255.255.0   U     0      0        0 tun0
XXX.XXX.XXX.XXX *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
147.XXX.XXX.XXX *               255.255.255.0   U     0      0        0 tun0
147.XXX.XXX.XXX *               255.255.255.0   U     0      0        0 tun0
212.XXX.XXX.XXX *               255.240.0.0     U     0      0        0 tun0
10.0.0.0        *               255.0.0.0       U     0      0        0 tun0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         1.45.XX.XX      0.0.0.0         UG    0      0        0 eth0

And iptables -L

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N FUPNP
-N PControls
-N SECURITY
-N logaccept
-N logdrop
-A INPUT -p udp -m udp --dport 4672 -j ACCEPT
-A INPUT -p udp -m udp --dport 4665 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4662 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 51413 -j ACCEPT
-A INPUT -p udp -m udp --dport 51413 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD ! -i br0 -o eth0 -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A OUTPUT -p udp -m udp --dport 4672 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 4665 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 4662 -j ACCEPT
-A FUPNP -d 192.168.1.202/32 -p udp -m udp --dport 59077 -j ACCEPT
-A FUPNP -d 192.168.1.202/32 -p tcp -m tcp --dport 59077 -j ACCEPT
-A FUPNP -d 192.168.1.169/32 -p udp -m udp --dport 59077 -j ACCEPT
-A FUPNP -d 192.168.1.169/32 -p tcp -m tcp --dport 59077 -j ACCEPT
-A PControls -j ACCEPT
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec
 -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec
 -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A SECURITY -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN
-A SECURITY -p icmp -m icmp --icmp-type 8 -j DROP
-A SECURITY -j RETURN
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequen
ce --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence -
-log-tcp-options --log-ip-options
-A logdrop -j DROP

I am new to networking, so I appreciate any help!

Improve this question
1
  • Instead of forwarding, maybe just add the vpn connection into the bridge. brctl br0 or bridge br0 or tab complete br
    – rjt
    Jun 21, 2016 at 22:07

1 Answer 1

Reset to default
4 
iptables -I FORWARD -o tun0 -j ACCEPT 

iptables -I FORWARD -i tun0 -j ACCEPT 

iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE
Improve this answer
4
  • 1
    Some explanation of what this is doing or why would help this be a better answer.
    – chicks
    Jun 22, 2016 at 11:55
  • I don't get it...
    – Pierre.Vriens
    Jun 22, 2016 at 17:57
  • these lines adding NAT routing for local br0 interface to tun0 vpn interface
    – Kirill Bazarov
    Jun 22, 2016 at 19:21
  • Thanks! That was a lifesaver.
    – yaromir
    Jun 21, 2023 at 22:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .