Menu
What's new
By:
Filters Better Search

Routing between LAN and OpenVPN client

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

J

Jiri

New Around Here
For some reason I am facing troubles routing to LAN behind the router from OpenVPN server.

I am sorry if this has been asked, I have tried searching for topic without a satisfactory results.

My aim is to maintain a network behind Router Asus RT-AC86U, running Merlin 384.15, remotely from my RemoteServer.
On the Router, I have configured an OpenVPN client, IP 10.8.51.6, that connects onto my RemoteServer, IP 10.8.51.1. Note setting up OpenVPN server on the Router is not an option as it does not receive a public ip.

From RemoteServer, I can ping the Router, I can ssh to the Router, but I cannot even ping any LAN machine (lets say 192.168.51.12) on Router's LAN 192.168.51.0. (Ping inside LAN works fine.)

On RemoteServer I have:
Code: 
root@RemoteServer:/etc/openvpn# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    100    0        0 enp1s0
10.8.51.0       *               255.255.255.0   U     0      0        0 tun1
link-local      *               255.255.0.0     U     1000   0        0 tun1
192.168.0.0     *               255.255.255.0   U     100    0        0 enp1s0
192.168.51.0    10.8.51.2       255.255.255.0   UG    0      0        0 tun1

I have also attempted to configure firewall:
Code: 
root@RemoteServer:/etc/openvpn# ufw status
Status: active

To                         Action      From
--                         ------      ----
1194/udp                   ALLOW       Anywhere          
Anywhere                   ALLOW       10.8.51.6          
10.8.51.6                  ALLOW       Anywhere          
1194/udp (v6)              ALLOW       Anywhere (v6)

On Router:
I have disabled ipv4 and ipv6 firewalls in GUI / Firewall / General

Established OpenVPN connection details as printed in System Log are:
Code: 
Apr 30 00:02:52 rc_service: httpd 991:notify_rc start_vpnclient1
Apr 30 00:02:52 ovpn-client1[1869]: OpenVPN 2.4.8 arm-buildroot-linux-gnueabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb  8 2020
Apr 30 00:02:52 ovpn-client1[1869]: library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.08
Apr 30 00:02:52 ovpn-client1[1870]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 30 00:02:52 ovpn-client1[1870]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:52 ovpn-client1[1870]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:52 ovpn-client1[1870]: TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:1194
Apr 30 00:02:52 ovpn-client1[1870]: Socket Buffers: R=[524288->524288] S=[524288->524288]
Apr 30 00:02:52 ovpn-client1[1870]: UDP link local: (not bound)
Apr 30 00:02:52 ovpn-client1[1870]: UDP link remote: [AF_INET]xx.xx.xx.xx:1194
Apr 30 00:02:52 ovpn-client1[1870]: TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=6d19cea7 bf8a9784
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY OK: depth=1, C=UK, ST=xxx, L=xxx, O=xxx, OU=xxx, CN=xxx CA, name=RemoteServer, emailAddress=xxx
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY KU OK
Apr 30 00:02:52 ovpn-client1[1870]: Validating certificate extended key usage
Apr 30 00:02:52 ovpn-client1[1870]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY EKU OK
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY OK: depth=0, C=UK, ST=xxx, L=xxx, O=xxx, OU=jiri, CN=xxx, name=xxx, emailAddress=xxx
Apr 30 00:02:52 ovpn-client1[1870]: Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Apr 30 00:02:52 ovpn-client1[1870]: [Remote_vpn] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:1194
Apr 30 00:02:53 ovpn-client1[1870]: SENT CONTROL [Remote_vpn]: 'PUSH_REQUEST' (status=1)
Apr 30 00:02:53 ovpn-client1[1870]: PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.8.51.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.51.6 255.255.255.0'
Apr 30 00:02:53 ovpn-client1[1870]: OPTIONS IMPORT: timers and/or timeouts modified
Apr 30 00:02:53 ovpn-client1[1870]: OPTIONS IMPORT: --ifconfig/up options modified
Apr 30 00:02:53 ovpn-client1[1870]: OPTIONS IMPORT: route-related options modified
Apr 30 00:02:53 ovpn-client1[1870]: Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Apr 30 00:02:53 ovpn-client1[1870]: Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:53 ovpn-client1[1870]: Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Apr 30 00:02:53 ovpn-client1[1870]: Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:53 ovpn-client1[1870]: TUN/TAP device tun11 opened
Apr 30 00:02:53 ovpn-client1[1870]: TUN/TAP TX queue length set to 1000
Apr 30 00:02:53 ovpn-client1[1870]: /sbin/ifconfig tun11 10.8.51.6 netmask 255.255.255.0 mtu 1500 broadcast 10.8.51.255
Apr 30 00:02:53 ovpn-client1[1870]: updown.sh tun11 1500 1602 10.8.51.6 255.255.255.0 init
Apr 30 00:02:55 ovpn-client1[1870]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Apr 30 00:02:55 ovpn-client1[1870]: Initialization Sequence Completed

I have even tried to set some explicit rules in iptables:
Code: 
 admin@Router:/tmp/home/root# iptables -vL
Chain INPUT (policy ACCEPT 132 packets, 18447 bytes)
 pkts bytes target     prot opt in     out     source               destination  
   34  1136 ACCEPT     igmp --  eth0   any     anywhere             anywhere    

Chain FORWARD (policy ACCEPT 6 packets, 1714 bytes)
 pkts bytes target     prot opt in     out     source               destination  
    0     0 ACCEPT     all  --  any    tun11   192.168.51.0/24      anywhere    
    0     0 ACCEPT     all  --  tun11  any     anywhere             192.168.51.0/24
    0     0 ACCEPT     all  --  eth0   any     anywhere             base-address.mcast.net/4
  892  125K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    0     0 other2wan  all  --  !br0   eth0    anywhere             anywhere    
    0     0 ACCEPT     all  --  br0    br0     anywhere             anywhere    
   16   784 DROP       all  --  any    any     anywhere             anywhere             state INVALID
  180 65179 NSFW       all  --  any    any     anywhere             anywhere    
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT
  180 65179 OVPN       all  --  any    any     anywhere             anywhere             state NEW
.....

routes on the Router:
Code: 
admin@Router:/tmp/home/root# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.8.51.0       *               255.255.255.0   U     0      0        0 tun11
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
192.168.0.1     *               255.255.255.255 UH    0      0        0 eth0
192.168.51.0    *               255.255.255.0   U     0      0        0 br0

Any guess on what I may be missing?

Thanks in advance.
 
Last edited:
Jiri said:
For some reason I am facing troubles routing to LAN behind the router from OpenVPN server.

I am sorry if this has been asked, I have tried searching for topic without a satisfactory results.

My aim is to maintain a network behind Router Asus RT-AC86U, running Merlin 384.15, remotely from my RemoteServer.
On the Router, I have configured an OpenVPN client, IP 10.8.51.6, that connects onto my RemoteServer, IP 10.8.51.1. Note setting up OpenVPN server on the Router is not an option as it does not receive a public ip.

From RemoteServer, I can ping the Router, I can ssh to the Router, but I cannot even ping any LAN machine (lets say 192.168.51.12) on Router's LAN 192.168.51.0. (Ping inside LAN works fine.)

On RemoteServer I have:
Code: 
root@RemoteServer:/etc/openvpn# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    100    0        0 enp1s0
10.8.51.0       *               255.255.255.0   U     0      0        0 tun1
link-local      *               255.255.0.0     U     1000   0        0 tun1
192.168.0.0     *               255.255.255.0   U     100    0        0 enp1s0
192.168.51.0    10.8.51.2       255.255.255.0   UG    0      0        0 tun1

I have also attempted to configure firewall:
Code: 
root@RemoteServer:/etc/openvpn# ufw status
Status: active

To                         Action      From
--                         ------      ----
1194/udp                   ALLOW       Anywhere        
Anywhere                   ALLOW       10.8.51.6        
10.8.51.6                  ALLOW       Anywhere        
1194/udp (v6)              ALLOW       Anywhere (v6)

On Router:
I have disabled ipv4 and ipv6 firewalls in GUI / Firewall / General

Established OpenVPN connection details as printed in System Log are:
Code: 
Apr 30 00:02:52 rc_service: httpd 991:notify_rc start_vpnclient1
Apr 30 00:02:52 ovpn-client1[1869]: OpenVPN 2.4.8 arm-buildroot-linux-gnueabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb  8 2020
Apr 30 00:02:52 ovpn-client1[1869]: library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.08
Apr 30 00:02:52 ovpn-client1[1870]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 30 00:02:52 ovpn-client1[1870]: Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:52 ovpn-client1[1870]: Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:52 ovpn-client1[1870]: TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:1194
Apr 30 00:02:52 ovpn-client1[1870]: Socket Buffers: R=[524288->524288] S=[524288->524288]
Apr 30 00:02:52 ovpn-client1[1870]: UDP link local: (not bound)
Apr 30 00:02:52 ovpn-client1[1870]: UDP link remote: [AF_INET]xx.xx.xx.xx:1194
Apr 30 00:02:52 ovpn-client1[1870]: TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=6d19cea7 bf8a9784
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY OK: depth=1, C=UK, ST=xxx, L=xxx, O=xxx, OU=xxx, CN=xxx CA, name=RemoteServer, emailAddress=xxx
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY KU OK
Apr 30 00:02:52 ovpn-client1[1870]: Validating certificate extended key usage
Apr 30 00:02:52 ovpn-client1[1870]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY EKU OK
Apr 30 00:02:52 ovpn-client1[1870]: VERIFY OK: depth=0, C=UK, ST=xxx, L=xxx, O=xxx, OU=jiri, CN=xxx, name=xxx, emailAddress=xxx
Apr 30 00:02:52 ovpn-client1[1870]: Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Apr 30 00:02:52 ovpn-client1[1870]: [Remote_vpn] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:1194
Apr 30 00:02:53 ovpn-client1[1870]: SENT CONTROL [Remote_vpn]: 'PUSH_REQUEST' (status=1)
Apr 30 00:02:53 ovpn-client1[1870]: PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.8.51.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.51.6 255.255.255.0'
Apr 30 00:02:53 ovpn-client1[1870]: OPTIONS IMPORT: timers and/or timeouts modified
Apr 30 00:02:53 ovpn-client1[1870]: OPTIONS IMPORT: --ifconfig/up options modified
Apr 30 00:02:53 ovpn-client1[1870]: OPTIONS IMPORT: route-related options modified
Apr 30 00:02:53 ovpn-client1[1870]: Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Apr 30 00:02:53 ovpn-client1[1870]: Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:53 ovpn-client1[1870]: Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Apr 30 00:02:53 ovpn-client1[1870]: Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Apr 30 00:02:53 ovpn-client1[1870]: TUN/TAP device tun11 opened
Apr 30 00:02:53 ovpn-client1[1870]: TUN/TAP TX queue length set to 1000
Apr 30 00:02:53 ovpn-client1[1870]: /sbin/ifconfig tun11 10.8.51.6 netmask 255.255.255.0 mtu 1500 broadcast 10.8.51.255
Apr 30 00:02:53 ovpn-client1[1870]: updown.sh tun11 1500 1602 10.8.51.6 255.255.255.0 init
Apr 30 00:02:55 ovpn-client1[1870]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Apr 30 00:02:55 ovpn-client1[1870]: Initialization Sequence Completed

I have even tried to set some explicit rules in iptables:
Code: 
 admin@Router:/tmp/home/root# iptables -vL
Chain INPUT (policy ACCEPT 132 packets, 18447 bytes)
 pkts bytes target     prot opt in     out     source               destination
   34  1136 ACCEPT     igmp --  eth0   any     anywhere             anywhere  

Chain FORWARD (policy ACCEPT 6 packets, 1714 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    tun11   192.168.51.0/24      anywhere  
    0     0 ACCEPT     all  --  tun11  any     anywhere             192.168.51.0/24
    0     0 ACCEPT     all  --  eth0   any     anywhere             base-address.mcast.net/4
  892  125K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    0     0 other2wan  all  --  !br0   eth0    anywhere             anywhere  
    0     0 ACCEPT     all  --  br0    br0     anywhere             anywhere  
   16   784 DROP       all  --  any    any     anywhere             anywhere             state INVALID
  180 65179 NSFW       all  --  any    any     anywhere             anywhere  
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT
  180 65179 OVPN       all  --  any    any     anywhere             anywhere             state NEW
.....

routes on the Router:
Code: 
admin@Router:/tmp/home/root# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.8.51.0       *               255.255.255.0   U     0      0        0 tun11
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
192.168.0.1     *               255.255.255.255 UH    0      0        0 eth0
192.168.51.0    *               255.255.255.0   U     0      0        0 br0

Any guess on what I may be missing?

Thanks in advance.
Click to expand...
I'd first check that the VPN client on the Router is not blocking inbound traffic from RemoteServer

upload_2020-5-2_9-14-24.png
 
Martineau said:
I'd first check that the VPN client on the Router is not blocking inbound traffic from RemoteServer
Click to expand...

Thanks for coming back on my post. That is a brilliant idea, indeed. I am that type of person who forgets everything and everywhere. :)

This seems to be set up correctly this time.
VPN_Screenshot.png

Do you have any further ideas?
 
Jiri said:
Thanks for coming back on my post. That is a brilliant idea, indeed. I am that type of person who forgets everything and everywhere. :)

This seems to be set up correctly this time.
View attachment 23220
Do you have any further ideas?
Click to expand...
The GUI 'Inbound Firewall=Allow' option updates the OVPN chain

e.g. VPN Client 4's inbound firewall is ALLOW
Code: 
iptables  --line -t filter -nvL OVPN

Chain OVPN (2 references)
num   pkts bytes target     prot opt in     out     source               destination      
1        0     0 ACCEPT     all  --  tun14  *       0.0.0.0/0            0.0.0.0/0
2        0     0 DROP       all  --  tun11  *       0.0.0.0/0            0.0.0.0/0
and there should be a MASQUERADE rule outbound from the LAN thru VPN Client 4's tunnel.
Code: 
iptables  --line -t nat -nvL POSTROUTING

Chain POSTROUTING (policy ACCEPT 23032 packets, 1622K bytes)
num   pkts bytes target      prot opt in     out     source               destination      
1        0     0 MASQUERADE  all  --  *      tun14   192.168.51.0/24      0.0.0.0/0

On the RemoteServer you need to ensure you have enabled the option to create the required route/iroute directives to 192.168.51.0/24

upload_2020-5-3_9-46-31.png


Although you say you want to remotely administer 192.168.51.0/24, I assume this includes the router?, if not then you should explicitly block access inbound from the VPN Client.

If you simply want say Port Forwarding inbound from the VPN client, then you will need to create the necessary FORWARD/PREROUTING rules .

P.S. You should also be able to check if there are any hits on the rules.

EDIT: Just reread your OP...
Jiri said:
On Router:
I have disabled ipv4 and ipv6 firewalls in GUI / Firewall / General
Click to expand...
Is that true? :eek:
 
Martineau said:
The GUI 'Inbound Firewall=Allow' option updates the OVPN chain

e.g. VPN Client 4's inbound firewall is ALLOW
Click to expand...
Thanks a lot for coming back with so much detail, Martineau.

I confirm the VPN inbound setting for client 1.
Code: 
admin@Router:/tmp/home/root# iptables  --line -t filter -nvL OVPN
Chain OVPN (1 references)
num   pkts bytes target     prot opt in     out     source               destination       
1        0     0 ACCEPT     all  --  tun11  *       0.0.0.0/0            0.0.0.0/0


Martineau said:
and there should be a MASQUERADE rule ...
Click to expand...
I shall admit I am new to the topic, but I don't think I want any NAT between the RemoteServer and the Router.
Ideally I want to access machines on 192.168.51.0/255.255.255.0 network by IP address and port.

That applies for outbound from the LAN thru VPN Client 1's tunnel as well, although its not a hard requirement this way.
Do you have any particular reason you suggest masquerading?

Martineau said:
Although you say you want to remotely administer 192.168.51.0/24, I assume this includes the router?
Click to expand...
Well, a very good question. Yes, although I my intention was to discuss the related challenges I face in a different thread.
Also it appears wise to sort out the routing first - My hope is that for Router's gui I would simply access 192.168.51.254:80 (Routers interface on 192.168.51.0/255.255.255.0 network) once the 192.168.51.0/255.255.255.0 network becomes visible to VPN.

Martineau said:
If you simply want say Port Forwarding inbound from the VPN client...
Click to expand...
Port forwarding would be a very clumsy solution.

The application is a mobile class room. Selection of machines varies lesson by lesson.
Just imagine the face of a desperate teacher, who calls me that Crumbles do not work on his new Pi's and I will tell him to wait until I set up port forwarding for 15 machines... :)

Martineau said:
On disabled firewall:
Is that true? :eek:
Click to expand...
It's a testing environment, it helps to narrow down the problem. I do not see a problem with it, as long as it gets reverted before going to production :).

Is there any way of tracking individual packets (let's say icmp ping) as they pass iptables rules on Asus Merlin?
There seem to be some logging already enabled:
Code: 
admin@SCFKasus:/tmp/home/root# iptables -vS
..
-N logaccept
-N logdrop
...
-A logaccept -m state --state NEW -c 0 0 -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -c 0 0 -j ACCEPT
-A logdrop -m state --state NEW -c 0 0 -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -c 0 0 -j DROP
...
Do you know where I can find these logs?

Thanks a lot,
Jiri
 
Jiri said:
Is there any way of tracking individual packets (let's say icmp ping) as they pass iptables rules on Asus Merlin?
There seem to be some logging already enabled:
Code: 
[/COLOR][/FONT][/LEFT][/COLOR][/FONT][/LEFT]
[FONT=Georgia][COLOR=rgb(20, 20, 20)]
[LEFT][FONT=Georgia][COLOR=rgb(20, 20, 20)]
[LEFT]admin@SCFKasus:/tmp/home/root# iptables -vS
..
-N logaccept
-N logdrop
...
-A logaccept -m state --state NEW -c 0 0 -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -c 0 0 -j ACCEPT
-A logdrop -m state --state NEW -c 0 0 -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -c 0 0 -j DROP
...
Click to expand...
​

Yes use the 'non-terminating' '-j LOG' target (in a separate chain if appropriate) so that it is executed before the 'terminating' rule 'ACCEPT/DROP' etc.
Jiri said:
Do you know where I can find these logs?i
Click to expand...
System Log GUI usually '/tmp/syslog.log'

upload_2020-5-4_9-46-35.png
​

Jiri said:
Port forwarding would be a very clumsy solution.

The application is a mobile class room. Selection of machines varies lesson by lesson.
Just imagine the face of a desperate teacher, who calls me that Crumbles do not work on his new Pi's and I will tell him to wait until I set up port forwarding for 15 machines... :)

It's a testing environment, it helps to narrow down the problem. I do not see a problem with it, as long as it gets reverted before going to production :).
Click to expand...
Given the previous lack of detail, I can only try and helpfully suggest solutions - clumsy or not.
However, agreed, masquerading is only useful if you have subnets behind 192.168.51.0/255.255.255.0, and they too would need to access the RemoteServer.

However, given the scenario, perhaps TAP rather than TUN would be far easier or here's a thought why not run the OpenVPN server on 192.168.51.1 then the RemoteServer initiates a VPN Client connection with full access to 192.168.51.0/255.255.255.0 if you only need to act as administrator on the remote LAN?

Good luck
 
Last edited:
Hello , I write in this post because I have a similar issue on my VPN that I cannot manage to solve.
I can assess my VPN from mobile ISP and I can reach all the LAN devices attached to the 86U as from home.
All except one ... ... I cannot reach my Gigaset VOIP phone Web page; I can reach it when I am at home and attached to the router but I get no answer when connected with the VPN.

Do you have any suggestion about how to solve this problem ? is there any particular setting for this kind of device ?

Thanks
 
miazza said:
Hello , I write in this post because I have a similar issue on my VPN that I cannot manage to solve.
I can assess my VPN from mobile ISP and I can reach all the LAN devices attached to the 86U as from home.
All except one ... ... I cannot reach my Gigaset VOIP phone Web page; I can reach it when I am at home and attached to the router but I get no answer when connected with the VPN.

Do you have any suggestion about how to solve this problem ? is there any particular setting for this kind of device ?

Thanks
Click to expand...
I suggest you open your own thread
 
So finally solved!

Martineau, thanks a log for your help.
Martineau said:
a way of tracking individual packets (let's say icmp ping) .....usually '/tmp/syslog.log' ...
Click to expand...
Thanks for confirming me the location. I looked there several times, but did not have enough log level set up. Once I new the location, it was clear I am not logging enough or at the right place.

I ended up logging at OUTPUT table of RemoveServer (to check RemoteServer is routing correctly):
Code: 
iptables -t security -I OUTPUT -p icmp -j LOG --log-prefix "OUTPUT: security " --log-ip-options

And the earliest entry point of the Router:
Code: 
iptables -t raw -I PREROUTING 1 -p icmp -j LOG --log-prefix "PREROUTING: raw " --log-ip-options

This has clearly shown that ping packets from RemoteServer to Router were coming through and got logged as expected. Ping packets to Router's subnet 192.168.51.0/24 were routed correctly and also appeared on RemoteServer's tun interface, but they were nowhere to be seen at the Router above entry point of the router.

It was clear something unexpected was going on with the OpenVPN tunnel (as you indicated in your last post).

It turned out I was missing
Code: 
iroute 192.168.51.0 255.255.255.0
directive in the client config directory. An article that enlightens this problematic can be found here.

Once applied, all services started to work as expected and I can access the Route's gui via its LAN address (192.168.51.254:80).

Thanks a lot,
Jiri
 
You must log in or register to reply here.

Similar threads

T
[Help] Problems setting up OpenVPN
Replies
7
Views
276
Thookie
T
P
OVPN Problem. Asus rt ax56u (latest merlin firmware
Replies
9
Views
2K
pattox
P
G
ASUS Merlin 388.2.2 Authentication Error / Timeout Issue
Replies
2
Views
1K
ColinTaylor
C
A
ASUS XT8 dropout - momentarily disconnection
Replies
1
Views
970
Armin6150
A
A
Devices connect to my openvpn server correctly but no traffic from server to client
Replies
6
Views
1K
ragtap
R
Similar threads
Thread starter Title Forum Replies Date
C Routing my VPN Server through VPN Client 1 Having issues with Facetime Asuswrt-Merlin 50
O PI hole + unbound + domain vpn routing Asuswrt-Merlin 10
CaptnDanLKW VPN Stays connected but Stops Routing after DoH Change Asuswrt-Merlin 2
T [Solved]Configure Policy based routing for transparent proxy Asuswrt-Merlin 6
M OpenVPN / site to site with special security/routing constraints Asuswrt-Merlin 7
Acru Bug Report: nvram chilli_enable=1 when guest network is removed causes no routing to occur Asuswrt-Merlin 2
G [Help] Routing VPN server through VPN client (external VPN Provider) Asuswrt-Merlin 14
P IPv6 routing table flags Asuswrt-Merlin 2
K Asus router as adblock/firewall server (but not acting as a router) between modem and mesh routers Asuswrt-Merlin 7
C What is the difference between DNS Director and DHCP > manually assign DNS to each client? Asuswrt-Merlin 3

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 633 (members: 25, guests: 608)
Top