Asus AC86U - Open VPN, access to LAN

[Vicky1986]

Hi
My name is Wiktoria and this is my first post on the forum I am looking for help in setting up my AC86u router.

I would like all OPENVPN Clients B to have LAN access Clients A. (B->A, A->B) How should this be set?

Here are my settings:

SERVER is a public IP: 54.31.52.70 and LAN IP is: 10.8.0.0 (work in DEBIAN 8)
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
verb 3

CLIENT A is a Router AC86U LAN IP is 192.168.1.0

CLIENT B:
client
dev tun
proto udp
remote 54.31.52.70 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3

 

[bbunge]

Hi
My name is Wiktoria and this is my first post on the forum I am looking for help in setting up my AC86u router.

I would like all OPENVPN Clients B to have LAN access Clients A. (B->A, A->B) How should this be set?

Here are my settings:

SERVER is a public IP: 54.31.52.70 and LAN IP is: 10.8.0.0 (work in DEBIAN 8)
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
verb 3

CLIENT A is a Router AC86U LAN IP is 192.168.1.0

View attachment 19997


CLIENT B:
client
dev tun
proto udp
remote 54.31.52.70 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3

You just opened yourself up to being hacked. Suggest you reset your router and start over with different settings especially the OpenVPN port.

 

[cmkelley]

You just opened yourself up to being hacked. Suggest you reset your router and start over with different settings especially the OpenVPN port.

Meh, password login is disabled, and I've never really seen the point in using a non-standard port. Presuming Wiktoria used a suitably strong cipher for the PKI, it's hardly worth worrying about. There's no information posted that's of particular use except the IP address, and given that information, a portscan to find which port is being used is trivial.

I run an OpenVPN server on the standard port and I get knocked on a few times a month, but OpenVPN is pretty robust, I certainly don't worry about it.