WRT54G as standalone VPN server?

[russellhobbs]

I'm attempting to set up a VPN server so I can connect my android phone via TAP and use the VPN internet connection when traveling. My router includes OpenVPN but doesn't support TAP, thus the reason for the additional device. (alternately if there's a TAP-supported OpenVPN client for KitKat, I'd look at that, too). So I'm looking to use a WRT54G router with Tomato 1.28 as that standalone OpenVPN server.

IP range on the router is 192.168.1.1-100. The WRT54G's (aka my "VPN Server") WAN IP is assigned a static IP within the router's subnet. The server LAN range is 192.168.1.200-254, and the VPN network is 10.8.0.x

I've already set up port forwarding on my main router and connected my "VPN Server" to the router using the WAN port on the server. I was also able to successfully get the VPN service to start up. Certs and keys and access all work when the WRT is connected directly to the modem as a router. However, when the WRT is behind my new router, I can't seem to connect my phone to the server.

Not knowing much about this, I've googled everything I could think of and read most of it twice. Is this an issue that can be resolved with a static route, and if so where do I do that? Is it a static route in the router, the WRT54 settings, the VPN server configuration, or the client config file on the phone?

 

[Solandri]

Try setting up your new router so the WRT's IP is DMZ. That will forward every port to the WRT. If it works, then you know the problem is another port(s) you need to forward.

 

[russellhobbs]

Try setting up your new router so the WRT's IP is DMZ. That will forward every port to the WRT. If it works, then you know the problem is another port(s) you need to forward.

Hi Solandri. Moving to the DMZ didn't work.

At the same time, I was able to look at the tomato logs, and I'm seeing packets requested from the router to the VPN WAN address, but not seeing anything with the IP address of the VPN network (though to be fair, I don't know if I should). There are quite a few entries in the VPN routing table, some of which match the router's IPs, but I can't tell if they were automagically added or if they're carryover from when the WRT was my primary router.