OpenVPN setup with Tomato router... Im ALMOST there, but something isn't right

dcarrco

Reputable
Aug 2, 2015
4
0
4,510
hey folks. i don't like to ask questions that have answers elsewhere so I have looked around and checked various HOWTOs and can't quite make the last leap here with my personal VPN. lets see if i can lay it out clearly. I have an ASUS RT-N66U router with Tomato firmware 1.30 (latest) on it. I set up the VPN server page as described in Serverwatch article and created keys and copied them over from my laptop to the router configuration page.

My router is already set up with DDNS and since the OpenVPN is built into the router i don't think I need to do anything with the firewall. I copied client key and CA and all that into a directory and loaded a local copy of the OpenVPN CLIENT.CONF with the cert names.

So when I run "openvpn client.conf" on my laptop as root it connects and finally says "Connection Established".

Running IFCONFIG on my laptop gives me a WLAN0 IP address that matches the wifi network I'm connected to at a coffeeshop and trying to login to my house VPN from (192.168.5.58). I also have a TAP0 interface that has the correct IP address for my local bridged VPN (192.168.1.50) so at this point i should be able to PING a computer on my local network and I cant reach any of them. i have disabled the firewall on my laptop by running UFW DISABLE. I have tried pinging my home router at 192.168.1.1 and also another computer that i know is at 192.168.1.5. nothing doing.

-$ Ping 192.168.1.1

"Destination Host Unreachable"

Because the whole server config side is on the router, it's difficult to know how it is set up in there, but I am assuming it's done correctly. Maybe bad assumption.

*edit. so maybe it has to do with PUSHING dns options to the client? not sure how to do that in Debian Linux. i loaded OpenVPN and the GUI onto a windows laptop and tried that but still same behavior. I checked the boxes on the router setup to apply DNS but still no go.

any ideas? i have attached screenshots of the config pages of Tomato VPN. I will keep trying.

140x5e9.jpg


2retjme.jpg
 
Solution
go to the coffeeshop.
connect to the VPN and run the equivalent of ipconfig /all

i thinks its ifconfig -a or nmcli dev show eth0, you probably know linux better than me. post the results here.

as far as DNS goes, you are pinging by IP address so DNS does not matter.
 


thats whats confusing. the one adapter is showing that it got handed an IP from my defined range.
something in the routing? my laptop doesn't know to funnel everything through? i don't know. this is IFCONFIG.
the 192.168.1.50 is correct. the WLAN IP is through my coffeeshop router. the OPENVPN command in the terminal
acts like everything is working correctly.

eth0 Link encap:Ethernet HWaddr 71:93:3c:a6:3e:12
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:11542 errors:0 dropped:0 overruns:0 frame:0
TX packets:11542 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1018295 (1.0 MB) TX bytes:1018295 (1.0 MB)

tap0 Link encap:Ethernet HWaddr e1:53:43:cd:ca:e9
inet addr:192.168.1.50 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fc80::f178:28ff:fe12:caf9/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:50 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:8713 (8.7 KB)

wlan0 Link encap:Ethernet HWaddr 71:93:0b:53:c2:b6
inet addr:192.168.43.29 Bcast:192.168.43.255 Mask:255.255.255.0
inet6 addr: fe80::72e5:bef:fe52:c5a2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5394766 errors:0 dropped:0 overruns:0 frame:0
TX packets:6830028 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1868721730 (1.8 GB) TX bytes:9473752272 (9.4 GB)

 



seems right.

2 things that I noticed, which may or may not have anything to do with your problem.

On the basic configuration screenshot the check box next to DHCP is not selected, so is 192.168.1.50 manually assigned to tap0 interface?

its possible the coffeeshop firewall may be blocking all or some UDP traffic. Try it from another location and see if it fails again.
 
Solution


I tried it from my laptop at another coffeeshop. I found some info on the internet about routing options in the client config. Here's the output of NetStat -rn showing my routing. I had the DHCP option checked and the 192.168.1.50 address WAS handed out by my VPN server.

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 128.0.0.0 UG 0 0 0 tap0
0.0.0.0 172.16.0.1 0.0.0.0 UG 0 0 0 wlan0
66.90.150.69 172.16.0.1 255.255.255.255 UGH 0 0 0 wlan0
128.0.0.0 192.168.1.1 128.0.0.0 UG 0 0 0 tap0
172.16.0.0 0.0.0.0 255.255.254.0 U 0 0 0 wlan0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
 
[/quotemsg]


seems right.

2 things that I noticed, which may or may not have anything to do with your problem.

On the basic configuration screenshot the check box next to DHCP is not selected, so is 192.168.1.50 manually assigned to tap0 interface?

its possible the coffeeshop firewall may be blocking all or some UDP traffic. Try it from another location and see if it fails again.
[/quotemsg]

I tried it from my laptop at another coffeeshop. I found some info on the internet about routing options in the client config. Here's the output of NetStat -rn showing my routing. I had the DHCP option checked and the 192.168.1.50 address WAS handed out by my VPN server.

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 128.0.0.0 UG 0 0 0 tap0
0.0.0.0 172.16.0.1 0.0.0.0 UG 0 0 0 wlan0
66.90.150.69 172.16.0.1 255.255.255.255 UGH 0 0 0 wlan0
128.0.0.0 192.168.1.1 128.0.0.0 UG 0 0 0 tap0
172.16.0.0 0.0.0.0 255.255.254.0 U 0 0 0 wlan0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
[/quotemsg]

172.16 is the other coffee shop right?
everything seems correct, have you tried PPTP server instead?
is there a VPN log on the server side that we cal review for clues?
 
i feel so ashamed. i had compression disabled on the server and enabled on the client. turned compression off at both ends and it started working fine. its either that or all the weird IPTABLES commands i entered in the terminal. anyway, seems to be working. thanks for your help.