Problem with OpenVPN and WPA2 Enterprise

[Hellman]

We have a problem with Asuswrt-Merlin, the same problem that we also had with our older routers running Tomato.
When the router and the modem is powered up, the router is finished starting first and starts sending wifi, and also tries to establish the OpenVPN-tunnel. The computers now tries to connect to the wifi, but since the router cant connect to our Radius through the tunnel yet, the connections will fail. Now the modem is finished starting and the OpenVPN-tunnel will establish. But the computers will still not be able to connect, and when we sniff the traffic in the tunnel we can se that there is no Radius-traffic.
If we do:

killall nas
nas /etc/nas.conf /var/run/nas.pid lan

it will start working and the authentications goes through the VPN-tunnel.
On Tomato we had these commands scheduled every three minutes so that it would be no more than three minutes delay after startup until it would work. In Asuswrt-Merlin there is no sheduler, can that be added?
Or even better ofcourse, can the problem be fixed?
If we start the modem first and wait till it is finished, and then start the router, we have never had the problem.

 

[RMerlin]

In Asuswrt-Merlin there is no sheduler, can that be added?

Asuswrt-Merlin does have Cron.

https://github.com/RMerl/asuswrt-merlin/wiki/Scheduled-tasks-(cron-jobs)
https://github.com/RMerl/asuswrt-merlin/wiki/User-scripts

 

[martinr]

......
If we start the modem first and wait till it is finished, and then start the router, we have never had the problem.

Is that not a practical solution? I thought that was the recommended sequence in general anyway.

 

[Hellman]

Is that not a practical solution? I thought that was the recommended sequence in general anyway.

Yes, when we install it we do that. But we have many offices running this solution, and sometimes there is power failures or someone accidently turns the power off, then the router and modem starts at the same time and the router are often finished starting first. The problem could also occur if the OpenVPN-tunnel for some reason goes down an up.

 

[Hellman]

Asuswrt-Merlin does have Cron.

https://github.com/RMerl/asuswrt-merlin/wiki/Scheduled-tasks-(cron-jobs)
https://github.com/RMerl/asuswrt-merlin/wiki/User-scripts

Thanks for the tip, I will let our Linux guys look in to that!
I am not good at Linux at all, and would have liked a scheduler in GUI like Tomato, but it can probaply be fixed with cron as you suggested.

 

[martinr]

Yes, when we install it we do that. But we have many offices running this solution, and sometimes there is power failures or someone accidently turns the power off, then the router and modem starts at the same time and the router are often finished starting first. The problem could also occur if the OpenVPN-tunnel for some reason goes down an up.

Understood. By the way, did you see this?

http://www.snbforums.com/threads/rm...g-for-wan-connection-at-boot.9981/#post-60998

There might possibly be some food for thought in there.

Good luck. If you post back with the outcome it may well help others in future.

 

[sfx2000]

Shouldn't be using remote RADIUS for auth - what happens to the local net if the ISP loses connectivity on the remote end (happens...)

I would suggest two RADIUS servers - one on each end, and sync them up over the tunnel and limit each server's scope to the local IP subnets on each end.

 

[Hellman]

Shouldn't be using remote RADIUS for auth - what happens to the local net if the ISP loses connectivity on the remote end (happens...)

I would suggest two RADIUS servers - one on each end, and sync them up over the tunnel and limit each server's scope to the local IP subnets on each end.

We have many small offices with few computers, we cant have servers at each office. The servers are actually Microsoft NPS servers that authenticate the computers and users through Active Directory so the servers must have connection to our core, so placing servers att each small office will not help if the tunnel goes down. OpenVPN is very stable and we do not have much connection loss, the problem that we have is if there is a power loss and the modem and router restarts, then will the radius authentication stop from the router.

 

[Hellman]

We created a init-start script that created a cron job that every third minute run a script that run:

killall nas
nas /etc/nas.conf /var/run/nas.pid lan

Now radius authentications is working as it should. Thanks for your help!

Btw, I found that this problem has existed a long time: http://wl500g.info/archive/index.php/t-2055.html
Sad that there has not been a solution for it.