@AbOrigine - here is example how to get it working
on my ASUS router VPN Server side (192.168.0.1) I have added client1 entry 192.168.1.0/255.255.255.0
and connection works both ways, no need for additional scripts or anything else
VPN client side and VPN server side can't use the same IP range
script-security 2
# Assign static I/P addresses to clients (and optionally add ADVANCED CCD directives)
client-connect /jffs/scripts/VPNClientConnect.sh
route 192.168.3.0 255.255.255.0 vpn_gateway
route 192.168.4.0 255.255.255.0 vpn_gateway
push "route 192.168.3.0 255.255.255.0"
push "route 192.168.4.0 255.255.255.0"#!/bin/sh
#=============================================================================
#
# This VPN Server custom script will create a CCD/tmp_file based on 'User names' when they share the same 'Common name' e.g. 'client'
#
# i.e. CCD file '/jffs/configs/openvpn/ccd1/client' is inappropriate for multiple concurrent clients
#
# The remote subnets for each individual User (identified by login credentials) will be defined etc.
#
# e.g. VPN Server 192.168.5.0 will host two clients (each with its own LAN subnet) and all three will communicate with each other over the VPN tunnels
#
# Requires VPN Server directives:
#
# client-to-client
# duplicate-cn
# # Custom Configuration
# client-connect /jffs/scripts/VPNClientConnect.sh
#
logger -st "($(basename $0))" $$ "VPN Client user '"$username"' CCD configuration starting...." [$@]
# Configure the VPN Client CCD/file dynamically
STATUS="OK" # Let's be positive! ;-)
# Identify client
case "$username" in
"router")
echo "iroute 192.168.3.0 255.255.255.0" >>$1
;;
"iphone")
echo "iroute 192.168.4.0 255.255.255.0" >>$1
;;
*)
STATUS="FAIL"
;;
esac
if [ "$STATUS" == "OK" ];then
logger -st "($(basename $0))" $$ "VPN Client user '"$username"' CCD config:" `cat $1`
else
echo -e "\a"
logger -st "($(basename $0))" $$ "**WARNING VPN Client user '"$username"' not defined - dynamic CCD config skipped."
fi
#Send_email [file | "A_single_line_text_message_in_quotes_to_be_emailed" ] [email_method]
TEMPFILE="/tmp/VPNClientConnect"${username}".txt"
echo "Common Name: $common_name" >>$TEMPFILE
echo "Username: $username" >>$TEMPFILE
echo "I/P: $trusted_ip" >>$TEMPFILE
echo "PORT:$trusted_port" >>$TEMPFILE
echo "MTU: $tun_mtu" >>$TEMPFILE
#Send_email $TEMPFILE
logger -st "($(basename $0))" $$ "VPN Client CCD configuration ended."
exit 0mkdir /jffs/scripts
vi /jffs/scripts/VPNClientConnect.sh
#in this step paste script into file
#copy script from it's source,
#:set noautoindent
#i
#Shift+Insert, Esq
#:wq
#Enter
chmod +x /jffs/scripts/VPNClientConnect.sh#create copy of original smb.conf
cp /etc/smb.conf /jffs/smb.conf
vi /jffs/smb.conf
#now, find "hosts allow = 127.0.0.1 192.168.2.1/255.255.255.0 10.8.0.0/255.255.255.0" line and add " 192.168.3.1/255.255.255.0" in the end of it
#samba connection for me didn't work until I changed this line in both [global] and [ipc$] sections.
#I created fixsamba file as fix_things.sh in order to add there additional things later
vi /jffs/scripts/fix_things.sh
#put there https://github.com/dnlongen/ASUSWRT_Samba_Fixer/blob/master/fixsamba script same way as it was done in step 6 of VPN server configuration.
#make this script to run on USBmount event, which as I understood only way to execute scripts as close to router startup as possible.
chmod 755 /jffs/scripts/fix_things.sh
nvram set script_usbmount="/jffs/scripts/fix_things.sh"
nvram commitYes, new user (roadwarrior) can connect to both sites (server router clients and client router clients). If roadwarrior happened to be third router with it's own subnet of users, this subnet would be unavailable without script modification.
Jul 23 18:45:31 (VPNClientConnect.sh): 23404 VPN Client user '' CCD configuration starting.... [/tmp/openvpn_cc_f0b6122bf4b3e88a0545d4b828995b33.tmp]
Jul 23 18:45:31 (VPNClientConnect.sh): 23404 **WARNING VPN Client user '' not defined - dynamic CCD config skipped.
Jul 23 18:45:31 (VPNClientConnect.sh): 23404 VPN Client CCD configuration ended.Never mind. Dumb mistake. Did not have "Username/Password Authentication" enabled on server. Gremlin must have unchecked it for me... Amazing how something so simple can cost one hours and miles driven...
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
