OpenWRT: Routing between LAN and OpenVPN

1

4

So, this is the current situation:

There is an OpenVPN-Server in the internet, there is an OpenWRT-Router at my place. The router is connected to the VPN as a client.

I want the router to behave just as usual, but with an extra routing between the VPN and the LAN. I successfully pinged between the two VPN adresses. Then I added a route on the VPN server for 192.168.1.0/24 via 10.8.0.2 (IP address of my local router), but I am not able to ping 192.168.1.1, the other network adress of my router...

The wohle thing clearly looks like a routing issue which I am not able to solve...

/etc/config/network:

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth0.1'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ipaddr '192.168.1.1'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config switch
        option name 'eth0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'eth0'
        option vlan '1'
        option ports '0t 2 3 4 5'

config switch_vlan
        option device 'eth0'
        option vlan '2'
        option ports '0t 1'

config interface 'vpn'
        option proto 'none'
        option ifname 'tun0'

/etc/config/firewall:

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wwan'

config zone
        option name 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option network 'vpn'
        option forward 'REJECT'


config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan wwan'

config zone
        option name 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option network 'vpn'
        option forward 'REJECT'

config forwarding
        option src 'lan'
        option dest 'wan'

config forwarding
        option dest 'lan'
        option src 'vpn'

config forwarding
        option dest 'vpn'
        option src 'lan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'

        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option target 'ACCEPT'
        option dest_port '1194'
        option src 'wan'
        option proto 'udp'
        option family 'ipv4'

config include
        option path '/etc/firewall.user'

Output of route

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         stdw-wh-84-0.st 0.0.0.0         UG    0      0        0 eth0.2
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 br-lan
212.201.84.0    *               255.255.254.0   U     0      0        0 eth0.2

Output of ifconfig -a

br-lan    Link encap:Ethernet  HWaddr 64:66:B3:C6:FC:82
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:534 errors:0 dropped:8 overruns:0 frame:0
          TX packets:458 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:97412 (95.1 KiB)  TX bytes:105023 (102.5 KiB)

eth0      Link encap:Ethernet  HWaddr 64:66:B3:C6:FC:82
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1495490 errors:0 dropped:13 overruns:0 frame:0
          TX packets:259329 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:500056893 (476.8 MiB)  TX bytes:220075895 (209.8 MiB)
          Interrupt:4

eth0.1    Link encap:Ethernet  HWaddr 64:66:B3:C6:FC:82
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:407 errors:0 dropped:0 overruns:0 frame:0
          TX packets:353 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:77176 (75.3 KiB)  TX bytes:81768 (79.8 KiB)

eth0.2    Link encap:Ethernet  HWaddr 64:66:B3:C6:FC:82
          inet addr:x.x.x.x  Bcast:x.x.x.255  Mask:255.255.254.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3090 errors:0 dropped:1098 overruns:0 frame:0
          TX packets:527 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:419453 (409.6 KiB)  TX bytes:104348 (101.9 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:26 errors:0 dropped:0 overruns:0 frame:0
          TX packets:26 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2549 (2.4 KiB)  TX bytes:2549 (2.4 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.2  P-t-P:10.8.0.2  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr 64:66:B3:C6:FC:83
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:130 errors:0 dropped:0 overruns:0 frame:0
          TX packets:131 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:22234 (21.7 KiB)  TX bytes:28345 (27.6 KiB)

wlan1     Link encap:Ethernet  HWaddr 64:66:B3:C6:FC:84
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:0 (0.0 B)  TX bytes:620 (620.0 B)

Part of output of ip route on the VPN server (attached VPN route, manually added route to my LAN):

10.8.0.0/24 dev tun0  proto kernel  scope link  src 10.8.0.1
192.168.1.0/24 via 10.8.0.2 dev tun0

I have absolutely no clue about iptables, so this is the best I can do.

WolleTD

Posted 2013-12-10T18:14:44.510

Reputation: 131

you left out the routing table and the output of ifconfig -a – MariusMatutiae – 2013-12-10T19:31:50.627

Added the outputs of route and ifconfig -a – WolleTD – 2013-12-10T21:14:48.220

Answers

0

I ran into this issue myself. So far, I've only gotten it so I can ping VPN machines from LAN. I did this by using a similar configuration to you except I set the VPN zone's Forward to ACCEPT instead of REJECT.

Setting the LAN zone's Forward to ACCEPT doesn't change anything for me.

As a side note, you have two wan zones in your config file which are exactly the same.

Sawtaytoes

Posted 2013-12-10T18:14:44.510

Reputation: 458

0

It could be a number of things, all very simple to solve...

Most likely, it's a two fold firewall issue within OpenWRT and the end device's firewall... either you copied and pasted doubles, or your firewall config is improperly configured as not only are there two WANs (mentioned above), there's two VPNs (while you can run multiple servers and clients from the same config file, each must have their own unique zone name)

On OpenWRT, you must allow traffic to pass from VPN to LAN and LAN to VPN... a firewall rule must also be utilized along with the forwarding you set up under the LAN and VPN zones to redirect traffic. I'd recommend taking a look at OpenVPN's HOWTO page

Firewall Traffic and Redirect Rules Required

config rule      
    option target 'ACCEPT'
    option proto 'tcp udp'
    option dest_port '1194'
    option family 'ipv4'
    option src '*'
    option name 'Allow Inbound VPN0'

config rule
    option target 'ACCEPT'
    option proto 'tcp udp'
    option src '*'
    option dest '*'
    option dest_port '1194'
    option family 'ipv4'
    option name 'Allow Forwarded VPN0'

config rule
    option target 'ACCEPT'
    option proto 'tcp udp'
    option family 'ipv4'
    option src '*'
    option src_ip '10.8.0.0/24' #-or whatever netmask you utilized-#
    option dest_ip '192.168.1.0/24'
    option name 'Allow Inbound VPN0 Traffic to LAN'

config rule
    option target 'ACCEPT'
    option proto 'tcp udp'
    option family 'ipv4'
    option src '*'
    option src_ip '10.8.0.0/24' #-or whatever netmask you utilized-#
    option dest '*'
    option dest_ip '192.168.1.0/24'
    option name 'Allow Forwarded VPN0 Traffic to LAN'

config rule
    option target 'ACCEPT'
    option family 'ipv4'
    option proto 'icmp'
    option src '*'
    option src_ip '10.8.0.0/24' #-or whatever netmask you utilized-#
    option dest 'wan'
    option name 'Allow Outbound ICMP Echo Request (8)'
    list icmp_type 'echo-request'

I'd recommend changing the subnet for your VPN to something other than 10.8.0.0/netmask as 10.8.0.0 covers 10.8.0.0 - 10.8.255.255.

You should also change the port to something other than 1194, in combination with choosing a different server subnet that is higher up (i.e. 10.25.100.1 for instance), as keeping defaults is doing half the job for a cyber intruder.

The port number should be higher than 1025 (as <1025 are privileged ports), but lower than 10000.

JW0914

Posted 2013-12-10T18:14:44.510

Reputation: 1

Asked: 2013-12-10T18:14:44.510

Viewed: 9 476 times

Active: 2019-12-07T01:01:35.263