3. TUN VPN setup
- Before you begin, please disable the firmware VPN first. (How to please see Netgear support page, by default it is disabled)
- Highly suggest to change the default gateway to other than 192.168.1.1 and 192.168.0.1, due to the possible conflicting with your client network.
- How to create the keys for OPENVPN please google it, there are a lot of resources. If you are lazy or something, you can just turn on the firmware VPN, and copy them from /tmp/openvpn/(firmware VPN only use dh1024.pem, but it is ok to use it. And there is no ta.key, you can do not use it, just a little bit less security)
- place ca.crt dh2048.pem server.key server.crt ta.key to /tmp/mnt/optware/entware/etc/openvpn/
Server side
- Create OPENVPN server config file
vi /tmp/mnt/optware/entware/etc/openvpn/openvpn.conf
- It could look like following:
port 1194
proto udp
dev tun
server 192.168.66.0 255.255.255.0
push "dhcp-option DNS 8.8.8.8"
push "route 192.168.55.0 255.255.255.0"
push "redirect-gateway def1"
keepalive 10 120
dh /opt/etc/openvpn/dh2048.pem
ca /opt/etc/openvpn/ca.crt
cert /opt/etc/openvpn/server.crt
key /opt/etc/openvpn/server.key
tls-auth /opt/etc/openvpn/ta.key 0
cipher AES-256-CBC
#multi users
duplicate-cn
user nobody
persist-key
persist-tun
verb 4
log openvpn.log
comp-lzo
- If you create separate client keys for each client or only have one client, delete the #multi users and duplicate-cn, it use the same key for all users. If you do no have ta.key, delete tls-auth /opt/etc/openvpn/ta.key 0. In this example default router gateway has changed to 192.168.55.1(you could change it at GUI setup)
Client side
- Create client config file, you can use other program in Mac or windows as you like. The router does not need it. You can change “client”on the file name to what ever you want.
vi /tmp/mnt/optware/entware/etc/openvpn/client.ovpn
- It could be look like the following:
remote your.mynetgear.com 1194
client
remote-cert-tls server
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
route-delay 30
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
- Please modify your.mynetgear.com to your Dynamic DNS address or static IP address. If you do not have ta.key, delete tls-auth ta.key 1.
- Copy your client.ovpn ca.crt client.crt client.key ta.key to your client.
- On windows, default location c:\Program Files\OpenVPN\config\
- On iPhone, use iTunes, choose your device, choose Apps, on File sharing choose OpenVPN app, and drop the files in it.(if you did not install OpenVPN, install it. TUN version is for free)
4. Firewall setup
- Open a hole for the VPN server and nat the traffic etc…
(warning: this could brick your router, before all you did could do it again, but may not this if have any mistake)
vi /usr/sbin/net-wall
- It should be look like this(adds the lines on button)
#!/bin/sh
if [ ! -f /tmp/modem ]; then
/usr/sbin/net-wall-bin $*
else
/usr/sbin/net-wall-bin -w eth2 $*
fi
if [ "$1" = "rule" ]; then
# Check config file existence
if [ -f /etc/netwall.conf ]; then
config=/etc/netwall.conf
elif [ -f /root/netwall-rules ]; then
config=/root/netwall-rules
else
exit 0
fi
# Add own rules
mv /tmp/netwall-rules /tmp/netwall-rules.tmp
cat $config > /tmp/netwall-rules
cat /tmp/netwall-rules.tmp >> /tmp/netwall-rules
rm -f /tmp/netwall-rules.tmp
else
# OpenVPN settings of iptables for TUN
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.66.0/24 -o eth0 -j MASQUERADE
fi
- Restart your router, It should be working now. If you alternate any port or proto, they need to match on server, client, and firewall rule.
Troubleshooting
- Use the following to check if the VPN server is up
/tmp/mnt/optware/entware/etc/init.d/S20openvpn check
- Use the following to check if the TUN0 interface is up
Ifconfig
- Use the following to check the detail log of the VPN server
cat /tmp/mnt/optware/entware/etc/openvpn/openvpn.log
5. Firmware TAP VPN
- By default, the Voxel’s firmware needs to add ca.crt dh2048.pem server.key server.crt to /root/openvpn/ after this it could running when you turn on it on the GUI setup.
Troubleshooting
- Use the following to check if the TAP0 interface is up
Ifconfig
- Use the following to check the detail log of the VPN server
cat /tmp/openvpn_log
6. Solve problem when turn on the firmware VPN, the Entware VPN TUN0 interface is down.
vi /tmp/mnt/optware/autorun/scripts/post-mount.sh
- Modify it to look like following:
#!/bin/sh
# Create symlinks to Entware
if [ -d /opt ]; then
if [ ! -e /opt/bin ]; then
/bin/ln -sf /tmp/mnt/$1/entware/bin /opt/bin
/bin/echo "Create link" > /tmp/entware.log
fi
if [ ! -e /opt/etc ]; then
/bin/ln -sf /tmp/mnt/$1/entware/etc /opt/etc
/bin/echo "Create link" >> /tmp/entware.log
fi
if [ ! -e /opt/lib ]; then
/bin/ln -sf /tmp/mnt/$1/entware/lib /opt/lib
/bin/echo "Create link" >> /tmp/entware.log
fi
if [ ! -e /opt/sbin ]; then
/bin/ln -sf /tmp/mnt/$1/entware/sbin /opt/sbin
/bin/echo "Create link" >> /tmp/entware.log
fi
if [ ! -e /opt/share ]; then
/bin/ln -sf /tmp/mnt/$1/entware/share /opt/share
/bin/echo "Create link" >> /tmp/entware.log
fi
if [ ! -e /opt/tmp ]; then
/bin/ln -sf /tmp/mnt/$1/entware/tmp /opt/tmp
/bin/echo "Create link" >> /tmp/entware.log
fi
if [ ! -e /opt/usr ]; then
/bin/ln -sf /tmp/mnt/$1/entware/usr /opt/usr
/bin/echo "Create link" >> /tmp/entware.log
fi
if [ ! -e /opt/var ]; then
/bin/ln -sf /tmp/mnt/$1/entware/var /opt/var
/bin/echo "Create link" >> /tmp/entware.log
fi
if [ ! -e /opt/swap ]; then
/bin/ln -sf /tmp/mnt/$1/entware/swap /opt/swap
/bin/echo "Create link" >> /tmp/entware.log
fi
else
/bin/ln -sf /tmp/mnt/$1/entware /tmp/opt
fi
#restart Entware-ng VPN
sleep 200
/tmp/mnt/optware/entware/etc/init.d/S20openvpn restart
#start firmware VPN again
sleep 30
/etc/init.d/openvpn start
- The both VPN will up after turning on the router for about 5 minutes. I still could not find out what is the exactly problem to cause it. Someone knows it, please share it.
7. Finally, I want to thanks Voxel’s great work and helps. He give us a chance to use more advance features on R7500. Thanks.
