DD-WRT - VPN tunnel with access restrictions

Question

I want to allow users to connect to my home network through my DD-WRT router using a VPN tunnel.

I want the users to be able to access a specific IP on my local network freely (10.10.10.5). I dont want clients to be able to browse internet through the VPN tunnel.

Anyone know how to set this up?

Answer 1

Configure your firewall to only allow the VPN the access they need. The device is likely tun0. DD-WRT should be using an iptables based firewall. Depending on memory you could look at installing shorewall or shorewall-lite.

In your case you likely want a REJECT policy for the device and rules to accept

• related and established traffic.
• incoming connections to your NAS
• incoming connections to your remote desktop
• incoming connections to your DNS if you push DNS servers
• access to the Internet for everything, or limited access if you prefer

If you only push a route to your network from the VPN users Internet access should be via their existing connection and you won't need to allow them access. However, this may allow access to your services via a proxy on the connecting servers. It is up to you to assess the risk.

Answer 2

Okay, if you configure the VPN within the dd-wrt, as long as you know the username and password, I believe by default all things on your internal network are now accessible to you.

The server is no longer directly facing the internet, and it's inherently more secure. Once the tunnel is established, IF dd-wrt access restrictions work correctly you basically have this:

1. A VPN tunnel with a specific subnet of IPs assigned to it (192.168.3.x or whatever)
2. An access restriction feature on your router that disables internet on specific IPs/ranges.
3. A secure tunnel that allows traffic in, assigns an IP that is not allowed internet access, but because of the VPN should still be able to communicate with hosts inside the network.

Answer 3

I ended up not using DD-WRT to accomplish this.

There seems to be a problem/bug with doing this in the dd-wrt build I have. Firmware: DD-WRT v24-sp2 (08/07/10) std

Not sure what the problem is but after two days of trying I could not get it to accept connections. There are also a few threads where people have seemingly configured it correctly without getting it to work http://www.dd-wrt.com/phpBB2/viewtopic.php?p=651839 (cant post more links or I would)

I instead solved this by setting up a dedicated VPN server running on my Hyper-V machine.

I used this guide to set it up under Windows server 2008 http://www.buchatech.com/2010/06/how-to-setup-vpn-access-on-server-2008/

Got it to work right away, forwarded TCP port 1723 from DD-wrt to the server.

As a side note: My DHCP router uses 192.168.1.50-100 and my VPN users get addresses from 192.168.1.200-210. This allows the VPN users access to the network without any NAT translation on the server and by not having any NAT translation they are also blocked from the internet :)