Hope someone can help me and understand what is wrong in my setup.

I have installed OpenWrt Chaos Calmer 15.05 on m TP Link router. The router have the WAN connected and a WiFi and wired subnet on subnet. The OpenVPN server works good and I'm able to connect with iPhone, Androids etc without any problem.

I have on a remote location use an Android as a WiFi hotspot to share the internet with my family. Subnet The recent week I thought it would be nice to be able to get access from my home network with the remote network, because I have some cams I want to access. I can’t get a public IP address from my mobile network supplier. I root my Android mobile and install the OpenVPN client app to that mobile and connect to the home OpenVPN server. The mobile was able to use the VPN and was able to ping the home network router and access the internet via VPN, but not any other devices in the to subnets was able to ping or access each other.

The tunnel is setup on network and the remote Android get IP address

I was starting on the remote subnet to try to get the access via the tunnel for all devices and be able to access the devices on the network. After some hours I got t to work by the following changes in the firewall and the router. This is run on the Android device:

iptables -t filter -F FORWARD
iptables -t nat -F POSTROUTING
iptables -t filter -I FORWARD -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE
ip rule add from lookup 61
ip route add table 61 default dev tun0                    
ip route add table 61 dev wlan0                    
ip route add table 61 broadcast dev wlan0 

So now all devices on the subnet can ping all devices on the and of course all traffic is routed via the tunnel to the internet.

I try to set up similar routing at home to be able to also getting the devices on network to access the remote subnet but I not succeed. I assume the firewall is stopping, or should it not be possible, is a tunnel not able to “see” the remote subnet, just single hosts?

I have try to add route to via dev tun0 but just time out.

The routing on my router is looks like this (I have masked my public ip address).

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ua-8xxxxx         UG    0      0        0 eth0   UG    0      0        0 tun0        *      UH    0      0        0 tun0
85.x.x.0        *        U     0      0        0 eth0
85.x.x.1        *      UH    0      0        0 eth0     *        U     0      0        0 br-lan   U     0      0        0 tun0

Please not the router not have ip commands and I assume only one routing table.

The iptables I very unsure about, I have use these commands:

iptables -I FORWARD -i tun0 -o eth0 -s -d -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o eth1 -s -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i eth0 -o eth1 -s -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -I POSTROUTING -o eth1 -s -j MASQUERADE
iptables -t nat -I POSTROUTING -o eth1 -s -j MASQUERADE

Please help me to solving the issue if this is a possible setup.

  • 1
    Hi I forgot to mention all devices on subnet are able to ping (the remote Android) but not the IP as is the same device but different interface (tun0 and ap0) – Jan Aug 20 '18 at 18:18
  • Please edit your questions rather then posting your clarifications and new insights as comments. – HBruijn Aug 20 '18 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.