0

Hope someone can help me and understand what is wrong in my setup.

I have installed OpenWrt Chaos Calmer 15.05 on m TP Link router. The router have the WAN connected and a WiFi and wired subnet on 192.168.1.0/24 subnet. The OpenVPN server works good and I'm able to connect with iPhone, Androids etc without any problem.

I have on a remote location use an Android as a WiFi hotspot to share the internet with my family. Subnet 192.168.43.0/24. The recent week I thought it would be nice to be able to get access from my home network with the remote network, because I have some cams I want to access. I can’t get a public IP address from my mobile network supplier. I root my Android mobile and install the OpenVPN client app to that mobile and connect to the home OpenVPN server. The mobile was able to use the VPN and was able to ping the home network router and access the internet via VPN, but not any other devices in the to subnets was able to ping or access each other.

The tunnel is setup on network 10.8.0.0 and the remote Android get IP address 10.8.0.10.

I was starting on the remote subnet to try to get the access via the tunnel for all devices and be able to access the devices on the 192.168.1.0/24 network. After some hours I got t to work by the following changes in the firewall and the router. This is run on the Android device:

iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from 192.168.43.0/24 lookup 61
ip route add table 61 default dev tun0                    
ip route add table 61 192.168.43.0/24 dev wlan0                    
ip route add table 61 broadcast 255.255.255.255 dev wlan0 

So now all devices on the 192.168.43.0/24 subnet can ping all devices on the 192.168.1.0/24 and of course all traffic is routed via the tunnel to the internet.

I try to set up similar routing at home to be able to also getting the devices on network 192.168.1.0/24 to access the remote subnet but I not succeed. I assume the firewall is stopping, or should it not be possible, is a tunnel not able to “see” the remote subnet, just single hosts?

I have try to add route to 192.168.43.0/24 via 10.8.0.10 dev tun0 but just time out.

The routing on my router is looks like this (I have masked my public ip address).

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ua-8xxxxx       0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
85.x.x.0        *               255.255.240.0   U     0      0        0 eth0
85.x.x.1        *               255.255.255.255 UH    0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 br-lan
192.168.43.0    10.8.0.10       255.255.255.0   U     0      0        0 tun0

Please not the router not have ip commands and I assume only one routing table.

The iptables I very unsure about, I have use these commands:

iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -d 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o eth1 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i eth0 -o eth1 -s 192.168.1.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -I POSTROUTING -o eth1 -s 10.8.0.0/24 -j MASQUERADE
iptables -t nat -I POSTROUTING -o eth1 -s 192.168.1.0/24 -j MASQUERADE

Please help me to solving the issue if this is a possible setup.

  • 1
    Hi I forgot to mention all devices on subnet 192.168.1.0/24 are able to ping 10.8.0.10 (the remote Android) but not the IP 192.168.43.1 as is the same device but different interface (tun0 and ap0) – Jan Aug 20 '18 at 18:18
  • Please edit your questions rather then posting your clarifications and new insights as comments. – HBruijn Aug 20 '18 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.