1

Hope someone can help me, I have a LinkSys WRT1900 ACS v2 router on which i have installed LEDE. I have 2 vlans (192.165.5.1/24, 192.168.10.1/24), I have also OpenVPN setup and my goal was to have traffic from 1 vlan (.10.1) routed through VPN and traffic from the other vlan (.5.1) not go though VPN.

I have this working in so many words, but for the non vpn vlan to connect to the internet, i have had to add the following as a start up script

ip route add default via 192.168.0.1 table 10
ip rule add from 192.168.5.2 table 10
ip rule add from 192.168.5.3 table 10
ip....

The above works fine, one vlan goes via VPN and the other not through VPN, the only issue with this is that the moment i put the above code for each ip address and reboot my router for the changes to take affect, i can no longer ping between vlans, and i really would like to connect to devices locally on either vlan.

If i take out the table above, I dont get internet on non VPN VLAN, but can ping devices on both vlans locally.

if it helps, i have added some further info for you below.

OpenVPN Config File

client
dev tun
proto udp
remote *****OMITTED*****
resolv-retry infinite
remote-random
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0

explicit-exit-notify 3

remote-cert-tls server

#mute 10000
auth-user-pass secret

comp-lzo
verb 3
pull
fast-io
cipher AES-256-CBC
auth SHA512

<ca>
*****OMITTED*****
</ca>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
*****OMITTED*****
</tls-auth>

Router IP Routing Table

root@LEDE:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.8.0.1        128.0.0.0       UG    0      0        0 tun0
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth1.2
10.8.0.0        *               255.255.0.0     U     0      0        0 tun0
89.34.98.194    192.168.0.1     255.255.255.255 UGH   0      0        0 eth1.2
128.0.0.0       10.8.0.1        128.0.0.0       UG    0      0        0 tun0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth1.2
192.168.0.1     *               255.255.255.255 UH    0      0        0 eth1.2
192.168.5.0     *               255.255.255.0   U     0      0        0 br-VLAN5
192.168.10.0    *               255.255.255.0   U     0      0        0 br-VLAN10
root@LEDE:~#

Any help would really be appreciated, and please take it easy on me as i am rather new to all this.

Many thanks

0

The problem is about routing, not about using a VPN or VLANs (but the integration with the VPN can certainly add difficulty).

  • About the main issue: communication between LANs

The table 10 is in use for IPs from 192.168.5.0/24, so when such an IP gets the default route, this route will be used for any destination, including other LANs' IPs even if that's not intended. So it has to be populated manually with the routes to the other LANs, which, contrary to the main table, aren't added automatically.

before:

# ip route get 192.168.10.3 from 192.168.5.2 iif br-VLAN5
192.168.10.3 from 192.168.5.2 via 192.168.0.1 dev eth1.2 table 10 
    cache  iif br-VLAN5

fix:

# ip route add 192.168.10.0/24 dev br-VLAN10 table 10

after:

# ip route get 192.168.10.3 from 192.168.5.2 iif br-VLAN5
192.168.10.3 from 192.168.5.2 dev br-VLAN10 table 10 
    cache  iif br-VLAN5
  • For the first minor issue: having to add an ip rule for every single IP used from VLAN5

Normally there's no reason to use one rule per single IP from VLAN5 and this should be enough:

ip rule add from 192.168.5.0/24 table 10

But because OP made a comment telling it doesn't work when 192.168.5.1 is included, I can only say perhaps something else is interfering (other network configurations not shown, including iptables). There's still simplification possible (command netmask 192.168.5.2:192.168.5.255 gives "only": 192.168.5.2/31 192.168.5.4/30 192.168.5.8/29 192.168.5.16/28 192.168.5.32/27 192.168.5.64/26 192.168.5.128/25).

  • will do, i wanted to reply fully but as i hit enter it posted the comment. – Ess Tukay Dec 4 '17 at 12:40
  • The reason why I don’t have 192.168.5.0/24 because as I use this, again I get no internet on this VLAN, I assumed this was because it included the 192.168.5.1, so I then simply added entire DHCP ranger one ip at time and it worked. – Ess Tukay Dec 4 '17 at 15:18
  • As for your suggestion of, (ip route add 192.168.10.0/24 dev br-VLAN10 table 10) Thank you incredibly for this, adding this entry allows me to access/ping devices on VLAN 10 (192.168.10.0/24) from VLAN 5 (192.168.5.0/24) I cannot ping back from VLAN 10 to VLAN 5 but I am really not bothered about that as I don’t have much need for pinging/access from VLAN10 to VLAN5. – Ess Tukay Dec 4 '17 at 15:19
  • All the 10.8.0.1 and 128.0.0.0 have been added automatically by the VPN, I have not added these manually myself. – Ess Tukay Dec 4 '17 at 15:19
  • I did try once to have the rules for the VPN as you suggested but in my testing all that did was switch the problems over to VPN accessing the internet and that combined with the VPN settings made things further more complicated, hence I settled for this way. – Ess Tukay Dec 4 '17 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.