OpenVPN -> Router Cascade : Problems and Oddities

[brianj.wagner]

Hello experts!

I have followed OpenVPN's very own installation and setup instructions on setting up my server.

Facts
* Router1 is the ISP provided router that takes the coax from the wall. It has VERY limited features.
* Router2 is an Asus RT-AC56U running Merlin 374.40
* Router2's WAN port is connected to a Router1 LAN port and they are on different subnets (which is fine)
* Router1's network address is 192.168.0.0
* Router2's network address is 99.99.99.0
* I have a pay-for VPN (Private Internet Access) that works just fine with the exact facts above when enabled; all clients connected to Router2's traffic flows through the VPN.
* My compressed server.conf:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 5

According to the log, the VPN actually connects successfully. Some other things like the routing table and an external IP check

wget -qO- http://checkip.dyndns.com/

also confirm this. I'm able to run

nslookups

from both the Client and Router2, but I still can't browse from the Client or Router2... with an exception:

wget -qO- http://checkip.dyndns.com/

always returns with a 200 (and an IP address), even when I can't pull up google.com or amazon.com.

When I set the server to verb 6 it appears that the responses are being sent back through the tunnel appropriately which leads me to believe that Router1 is receiving the packets but it doesn't know how to give them to Router2 (a double-NAT situation), but if that is true, why would my connection to my pay-for VPN work without any trouble?

What changes will I need to make to get this thing working? Please let me know what further information you need. Thanks for your help.

 

[CaptainSTX]

Have you given router 2 a static IP in router 1's range.

You could, using the firmware on router two, give it a static WAN IP such as 192.168.0.1.

You then set the LAN IP of router 2 to what you want, but I don't believe that 99.99.99.0 is a valid private IP.


10.0.0.0 through 10.255.255.255
169.254.0.0 through 169.254.255.255 ( APIPA only)
172.16.0.0 through 172.31.255.255
192.168.0.0 through 192.168.255.255

The above are what I believe are valid private IP ranges.

After giving router 2 a valid LAN IP set the DHCP range in the same subnet.

 

[brianj.wagner]

I do have Router2 with a static IP in the range of Router1, and it was that way before I posted. I changed the LAN range of Router2 to be 172.16.0.0/24, but it is still behaving the same way.

 

[CaptainSTX]

All I can suggest is you reboot everything so all the private IPs are refreshed.