3
I've been banging my head against the wall on this for a week, so thought I'd finally turn to the experts. Much appreciated for any help.
[Note: originally posted this on ServerFault, was told this is a better place for it.]
What I'm trying to do: I have some resources on my local (home) network that I'd like to be able to access remotely. I need to be able to access them both on remote computers as well as on iOS devices. This last point means that I have to use TUN rather than TAP, as the iOS OpenVPN client doesn't support TAP. (It would also be nice to be able to use this VPN to access the broader internet when I'm in a sketchy public wifi area, but that's a secondary goal.)
What I've done so far: I have an old Linksys e1200 router, flashed DD-WRT with OpenVPN support on it (specifically DD-WRT v24-sp2 (06/07/14) vpnkong), and have successfully set up the OpenVPN & forwarded the ports from my main router so that I can connect to it remotely. (I know I can connect, because when I log into the VPN remotely I can access the routers admin page.) However, once my remote client is connected, I can't access the LAN resources.
I've been futzing around with all sorts of OpenVPN config/port forwarding/iptables commands but can't seem to get anything to work. That said, I'm pretty new at this level of network configuration, and am trying to learn how routing works, so if I'm doing something stupid, let me know; it's all changeable.
My setup:
<The Internets>
|
|
--------------------------------
| DSL modem |
| Internal IP: 192.168.1.254 |
--------------------------------
|
|
------------------------------- ----------------------------------
| Main router | | DD-WRT router running OpenVPN |
| 192.168.1.67 from modem | -------- | IP: 10.0.0.17 |
| Internal IP: 10.0.0.1 | | Subnet Mask: 255.255.255.0 |
| Subnet Mask: 255.255.255.0 | | Gateway: 10.0.0.1 |
| Hands out: 10.0.0.32-254 | | OpenVPN is server |
| | | 10.0.1.16/225.255.255.240|
------------------------------- ----------------------------------
| |
| |
Other things connected here And some connected here as well, for testing
I'm pretty sure that the DSL modem and the Main router are port forwarding correctly, since I'm able to connect the the DD-WRT router and OpenVPN remotely. I'm running things over TCP on port 443. (I do realize I have double NAT going on here, could change that if that's a problem. I could also plug the OpenVPN server directly into the DSL modem if that would be helpful in some way.)
I also know that when I hard plug my computer into the DD-WRT router, I can access all the LAN resources I want. So at least that is working correctly locally.
My current OpenVPN config:
server 10.0.1.16 255.255.255.240
push "dhcp-option DNS 10.0.0.1"
push "route 10.0.1.0 255.255.254.0"
push "route 10.0.0.0 255.255.254.0"
route 10.0.1.0 255.255.254.0
route 10.0.0.0 255.255.254.0
dev tun0
proto tcp
port 443
keepalive 15 30
cipher AES-256-CBC
daemon
verb 5
mute 5
comp-lzo
duplicate-cn
tls-server
client-to-client
dh /tmp/openvpn/dh.pem c
a /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 14
My current firewall on the OpenVPN router:
iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT
iptables -I FORWARD 1 --source 10.0.0.0/23 -j ACCEPT
iptables -t nat -s 10.0.0.0/23 -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -J ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
Other random (helpful?) information: On the OpenVPN router I have the WAN & DHCP disabled. In the "Setup > Advanced Routing" screen I have the operating mode set to "RIP2 Router" (my Main router is a RIP2 router also).
The Routing table on the DD-WRT:
Destination Subnet Mask Gateway Flags Metric Interface
10.0.1.18 255.255.255.255 0.0.0.0 UH 0 tun0
10.0.1.16 255.255.255.240 10.0.1.18 UG 0 tun0
10.0.0.0 255.255.255.0 0.0.0.0 U 0 LAN & WLAN
10.0.0.0 255.255.254.0 10.0.1.18 UG 0 tun0
169.254.0.0 255.255.0.0 0.0.0.0 U 0 LAN & WLAN
0.0.0.0 0.0.0.0 10.0.0.1 UG 0 LAN & WLAN
I'm happy to post whatever other info would be helpful. Thank you again! Much appreciated in advance.
You need to describe exactly what sort of "lan resources" you are trying to access, and how, and what exactly you mean by "not working". Some LAN resources require local broadcast discovery, which requires tap, some do not. Some require port forwards and/or NAT, some do not. – qasdfdsaq – 2015-07-01T11:09:54.943