Hope someone can help me and understand what is wrong in my setup.
I have installed OpenWrt Chaos Calmer 15.05 on m TP Link router. The router have the WAN connected and a WiFi and wired subnet on 192.168.1.0/24 subnet. The OpenVPN server works good and I'm able to connect with iPhone, Androids etc without any problem.
I have on a remote location use an Android as a WiFi hotspot to share the internet with my family. Subnet 192.168.43.0/24. The recent week I thought it would be nice to be able to get access from my home network with the remote network, because I have some cams I want to access. I can’t get a public IP address from my mobile network supplier. I root my Android mobile and install the OpenVPN client app to that mobile and connect to the home OpenVPN server. The mobile was able to use the VPN and was able to ping the home network router and access the internet via VPN, but not any other devices in the to subnets was able to ping or access each other.
The tunnel is setup on network 10.8.0.0 and the remote Android get IP address 10.8.0.10.
I was starting on the remote subnet to try to get the access via the tunnel for all devices and be able to access the devices on the 192.168.1.0/24 network. After some hours I got t to work by the following changes in the firewall and the router. This is run on the Android device:
iptables -t filter -F FORWARD iptables -t nat -F POSTROUTING iptables -t filter -I FORWARD -j ACCEPT iptables -t nat -I POSTROUTING -j MASQUERADE ip rule add from 192.168.43.0/24 lookup 61 ip route add table 61 default dev tun0 ip route add table 61 192.168.43.0/24 dev wlan0 ip route add table 61 broadcast 255.255.255.255 dev wlan0
So now all devices on the 192.168.43.0/24 subnet can ping all devices on the 192.168.1.0/24 and of course all traffic is routed via the tunnel to the internet.
I try to set up similar routing at home to be able to also getting the devices on network 192.168.1.0/24 to access the remote subnet but I not succeed. I assume the firewall is stopping, or should it not be possible, is a tunnel not able to “see” the remote subnet, just single hosts?
I have try to add route to 192.168.43.0/24 via 10.8.0.10 dev tun0 but just time out.
The routing on my router is looks like this (I have masked my public ip address).
Destination Gateway Genmask Flags Metric Ref Use Iface default ua-8xxxxx 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0 10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0 85.x.x.0 * 255.255.240.0 U 0 0 0 eth0 85.x.x.1 * 255.255.255.255 UH 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 br-lan 192.168.43.0 10.8.0.10 255.255.255.0 U 0 0 0 tun0
Please not the router not have ip commands and I assume only one routing table.
The iptables I very unsure about, I have use these commands:
iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -d 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -i tun0 -o eth1 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -i eth0 -o eth1 -s 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -t nat -I POSTROUTING -o eth1 -s 10.8.0.0/24 -j MASQUERADE iptables -t nat -I POSTROUTING -o eth1 -s 192.168.1.0/24 -j MASQUERADE
Please help me to solving the issue if this is a possible setup.