RT-AC66U Merlin OpenVPN Won't Pass Traffic

[berkscanuck]

I'm having a serious amount of issues getting the Merlin OpenVPN client to work properly with my VPN provider. I'm at the end of my abilities to try and debug, and am hoping I can get some help from someone much smarter than me! The threads here have been a big help getting me this far.

My VPN provider is StreamVia (www.streamvia.com). I have successfully gotten StreamVia working with Tunnelblick on a number of Macs with no issue, so I know OpenVPN works fine. This includes Macs sitting under the RT-AC66U. The RT-AC66U has another router/DSL-Modem between it and the Interent. The RT-AC66U has a LAN address of 10.0.0.1. It's gateway (the router/DSL-Modem) is 192.168.1.1.
The RT-AC66U has its Firewall on (left default settings), and the DNS servers are 8.8.8.8, and 8.8.4.4.

The OpenVPN config file for StreamVia for Tunelblick that I use on the Macs that I have been basing my Merlin config on is here:

client
auth-user-pass
dev tun
proto udp
tun-mtu 1500
tun-mtu-extra 32
mssfix 1400
fragment 1400
remote site1.uk.streamvia.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca streamvia-ca.crt
tls-auth streamvia-ta.key 1
comp-lzo
verb 3​

I've also been reverse engineering the setup script that StreamVia provides for DD-WRT. The relevant parts of this script are here:

mkdir /tmp/streamvia
cat > /tmp/streamvia/streamvia-pass.txt << MARK1
USERNAME
PASSWORD
MARK1
chmod 0600 /tmp/streamvia/streamvia-pass.txt
cat > /tmp/streamvia/streamvia.conf << MARK2
client
auth-user-pass streamvia-pass.txt
dev tun
proto udp
tun-mtu 1500
tun-mtu-extra 32
mssfix 1400
fragment 1400
remote SERVER_NAME
port 1194
resolv-retry infinite
nobind
route-delay 2
persist-key
persist-tun
ca /tmp/streamvia/ca.crt
tls-auth /tmp/streamvia/ta.key 1
comp-lzo
verb 3
MARK2
cat > /tmp/streamvia/ca.crt << MARK3
-----BEGIN CERTIFICATE-----
<CERTIFICATE SNIPPED>
-----END CERTIFICATE-----
MARK3
cat > /tmp/streamvia/ta.key << MARK4
-----BEGIN OpenVPN Static key V1-----
<Static Key SNIPPED>
-----END OpenVPN Static key V1-----
MARK4
cat > /tmp/streamvia/streamviadaemon << MARK5
#!/bin/sh
while :
do
date >> /tmp/streamvia/streamvia.log
sleep 60
NOPROCS=\`ps w | grep openvpn | grep -v grep | wc -l\`
if [ \$NOPROCS -eq 0 ]
then
echo "openvpn not running, i will start it" >> /tmp/streamvia/streamvia.log
openvpn --config streamvia.conf --daemon
else
echo "openvpn running fine, sleeping" >> /tmp/streamvia/streamvia.log
fi
done
MARK5
chmod a+x /tmp/streamvia/streamviadaemon
cd /tmp/streamvia
sleep 5
/tmp/streamvia/streamviadaemon &
exit 0
###########################################################
#
# The End
#
###########################################################​

Based on all of this, I came up with the following config in the Merlin OpenVPN Client Settings for Client1:
Start with WAN: No
Interface Type: TUN
Protocol: UDP
Server Address and Port: site1.uk.streamvia.com 1194
Firewall: Automatic
Authorization Mode: TLS
Username/Password Authentication: Yes
Username: <my username>
Password: <my password>
Username Auth Only: No
Extra HMAC authorization: Outgoing
Create NAT on Tunnel: No (although I get same results when I try Yes)
Poll Interval: 0
Redirect Internet Traffic: No (although I get same results when I try Yes)
Accept DNS Configuration: Disabled (I have tried other values too)
Encryption Cipher: Default
Compression: Disabled
TLS Renegotiation Time: -1
Connection Retry -1
Verify Server Certificate: No
Custom Configuration:

mssfix 1400
fragment 1400
comp-lzo
verb 6
resolv-retry infinite
nobind
persist-key
persist-tun​

I have also populated the Static Key and the Certificate Authority on the OpenVPN Keys for Client1.

I had significant issues getting the VPN to authenticate, and was only able to do by setting Extra HMAC authorization to Outgoing. Any other value and the VPN would not authenticate. I don't think Outgoing is correct, and perhaps this is the cause of some of my other issues? But its the only value where authentication works!

Once I get the VPN established, no matter what I set "Create NAT on Tunnel" to or "Redirect Internet Traffic" to, I have the same result: all hosts connected to the RT-AC66U have no Internet connectivity - but the VPN tunnel is up. I have tried all 4 permutations for these 2 variables. I notice that traffic is passing, except for the pre-compress bytes and post-compress bytes, which makes me think that nothing is being sent into the tunnel?

Mar 29 18:43:09 openvpn[1347]: TUN/TAP read bytes,9614
Mar 29 18:43:09 openvpn[1347]: TUN/TAP write bytes,776
Mar 29 18:43:09 openvpn[1347]: TCP/UDP read bytes,5951
Mar 29 18:43:09 openvpn[1347]: TCP/UDP write bytes,13252
Mar 29 18:43:09 openvpn[1347]: Auth read bytes,776
Mar 29 18:43:09 openvpn[1347]: pre-compress bytes,0
Mar 29 18:43:09 openvpn[1347]: post-compress bytes,0​

Any help would be appreciated, this is driving me crazy. I have been at this for a while, and tried everything I can think of.n I will post the log in a followup to this post.

 

[berkscanuck]

Here is an excerpt from the log file:

Mar 29 20:09:58 notify_rc : start_vpnclient1
Mar 29 20:09:58 openvpn[1677]: OpenVPN 2.3.0 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 2 2013
Mar 29 20:09:58 openvpn[1677]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mar 29 20:09:58 openvpn[1677]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mar 29 20:09:58 openvpn[1677]: Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Mar 29 20:09:58 openvpn[1677]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 29 20:09:58 openvpn[1677]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 29 20:09:58 openvpn[1677]: LZO compression initialized
Mar 29 20:09:58 openvpn[1677]: Control Channel MTU parms [ L:1578 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mar 29 20:09:58 openvpn[1677]: Socket Buffers: R=[114688->131072] S=[114688->131072]
Mar 29 20:09:58 kernel: tun: Universal TUN/TAP device driver, 1.6
Mar 29 20:09:58 kernel: tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Mar 29 20:09:59 openvpn[1677]: Data Channel MTU parms [ L:1578 D:1400 EF:46 EB:135 ET:32 EL:0 AF:3/1 ]
Mar 29 20:09:59 openvpn[1677]: Fragmentation MTU parms [ L:1578 D:1400 EF:45 EB:135 ET:33 EL:0 AF:3/1 ]
Mar 29 20:09:59 openvpn[1687]: UDPv4 link local: [undef]
Mar 29 20:09:59 openvpn[1687]: UDPv4 link remote: [AF_INET]83.142.226.35:1194
Mar 29 20:09:59 openvpn[1687]: UDPv4 WRITE [42] to [AF_INET]83.142.226.35:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Mar 29 20:09:59 openvpn[1687]: UDPv4 READ [54] from [AF_INET]83.142.226.35:1194: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
Mar 29 20:09:59 openvpn[1687]: TLS: Initial packet from [AF_INET]83.142.226.35:1194, sid=7015ff41 3db4cfb0
Mar 29 20:09:59 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #2 ] [ 0 ]
Mar 29 20:09:59 openvpn[1687]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mar 29 20:09:59 openvpn[1687]: UDPv4 WRITE [142] to [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=1 DATA len=100
Mar 29 20:09:59 openvpn[1687]: UDPv4 WRITE [142] to [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #4 ] [ ] pid=2 DATA len=100
Mar 29 20:09:59 openvpn[1687]: UDPv4 WRITE [52] to [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #5 ] [ ] pid=3 DATA len=10
Mar 29 20:10:00 openvpn[1687]: UDPv4 READ [50] from [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #2 ] [ 1 ]
Mar 29 20:10:00 openvpn[1687]: UDPv4 READ [50] from [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #3 ] [ 2 ]
Mar 29 20:10:00 openvpn[1687]: UDPv4 READ [154] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #4 ] [ 3 ] pid=1 DATA len=100

<snip>

Mar 29 20:10:02 openvpn[1687]: UDPv4 READ [142] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #23 ] [ ] pid=20 DATA len=100
Mar 29 20:10:03 openvpn[1687]: VERIFY OK: depth=1, C=AA, ST=Net, L=The Cloud, O=StreamVia, CN=StreamVia CA, emailAddress=hostmaster@streamvia.com
Mar 29 20:10:03 openvpn[1687]: VERIFY OK: depth=0, C=AA, ST=Net, L=The Cloud, O=StreamVia, CN=server, emailAddress=hostmaster@streamvia.com
Mar 29 20:10:03 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #25 ] [ 20 ]
Mar 29 20:10:03 openvpn[1687]: UDPv4 READ [142] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #24 ] [ ] pid=21 DATA len=100

<snip>

Mar 29 20:10:05 openvpn[1687]: UDPv4 READ [50] from [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #33 ] [ 7 ]
Mar 29 20:10:05 openvpn[1687]: UDPv4 READ [154] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #34 ] [ 8 ] pid=28 DATA len=100
Mar 29 20:10:05 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #36 ] [ 28 ]
Mar 29 20:10:05 openvpn[1687]: UDPv4 READ [142] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #35 ] [ ] pid=29 DATA len=100
Mar 29 20:10:05 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #37 ] [ 29 ]
Mar 29 20:10:05 openvpn[1687]: UDPv4 READ [140] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #36 ] [ ] pid=30 DATA len=98
Mar 29 20:10:05 openvpn[1687]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 29 20:10:05 openvpn[1687]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 29 20:10:05 openvpn[1687]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 29 20:10:05 openvpn[1687]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 29 20:10:05 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #38 ] [ 30 ]
Mar 29 20:10:07 openvpn[1687]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mar 29 20:10:07 openvpn[1687]: UDPv4 WRITE [132] to [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #39 ] [ ] pid=9 DATA len=90
Mar 29 20:10:08 openvpn[1687]: UDPv4 READ [50] from [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #37 ] [ 9 ]
Mar 29 20:10:08 openvpn[1687]: UDPv4 READ [142] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #38 ] [ ] pid=31 DATA len=100
Mar 29 20:10:08 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #40 ] [ 31 ]
Mar 29 20:10:08 openvpn[1687]: UDPv4 READ [142] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #39 ] [ ] pid=32 DATA len=100
Mar 29 20:10:08 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #41 ] [ 32 ]
Mar 29 20:10:08 openvpn[1687]: UDPv4 READ [124] from [AF_INET]83.142.226.35:1194: P_CONTROL_V1 kid=0 pid=[ #40 ] [ ] pid=33 DATA len=82
Mar 29 20:10:08 openvpn[1687]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,comp-lzo no,sndbuf 262144,rcvbuf 262144,route 10.41.133.1,topology net30,ping 10,ping-restart 60,ifconfig 10.41.133.110 10.41.133.109'
Mar 29 20:10:08 openvpn[1687]: OPTIONS IMPORT: timers and/or timeouts modified
Mar 29 20:10:08 openvpn[1687]: OPTIONS IMPORT: LZO parms modified
Mar 29 20:10:08 openvpn[1687]: OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Mar 29 20:10:08 openvpn[1687]: Socket Buffers: R=[131072->229376] S=[131072->229376]
Mar 29 20:10:08 openvpn[1687]: OPTIONS IMPORT: --ifconfig/up options modified
Mar 29 20:10:08 openvpn[1687]: OPTIONS IMPORT: route options modified
Mar 29 20:10:08 openvpn[1687]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mar 29 20:10:08 openvpn[1687]: TUN/TAP device tun11 opened
Mar 29 20:10:08 openvpn[1687]: TUN/TAP TX queue length set to 100
Mar 29 20:10:08 openvpn[1687]: /sbin/route add -net 83.142.226.35 netmask 255.255.255.255 gw 192.168.1.1
Mar 29 20:10:08 openvpn[1687]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.41.133.109
Mar 29 20:10:08 openvpn[1687]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.41.133.109
Mar 29 20:10:08 openvpn[1687]: /sbin/route add -net 10.41.133.1 netmask 255.255.255.255 gw 10.41.133.109
Mar 29 20:10:08 openvpn[1687]: Initialization Sequence Completed
Mar 29 20:10:08 openvpn[1687]: UDPv4 WRITE [50] to [AF_INET]83.142.226.35:1194: P_ACK_V1 kid=0 pid=[ #42 ] [ 33 ]
Mar 29 20:10:18 openvpn[1687]: UDPv4 READ [61] from [AF_INET]83.142.226.35:1194: P_DATA_V1 kid=0 DATA len=60
Mar 29 20:10:18 openvpn[1687]: UDPv4 WRITE [61] to [AF_INET]83.142.226.35:1194: P_DATA_V1 kid=0 DATA len=60
​

 

[rolfjacobs]

berkscanuck,

Were you able to find a solution to your Client VPN connection problem?

I am having the same issue. I have (2) RT-AC66U running 3.0.0.4.270 26b and have sucessfully connected to the Router1 configured as server from an OpenVPN client app in Windows but I have been unable to connect from the CLIENT1 configuration tab in Router2 with the same keys.

The Client1 seems to connect to Router1 running server but all PC's behind Router2 are disconnected like you describe in your post. I have to cycle power to regain access.

According to a friend with more VPN experience than I, he has been able to connect to the Router1 (RT-AC66U) with both a win client and from another router (his personal router... brand?) running Tomato and is able to sucessfully establish a connection from the CLIENT1 configuration area in Tomato. He is then able to PING Router2 and the PC behind the Router2 from a PC behind Router1

Your Thoughts

rolfjacobs at h0t mail .c0m

 

[drice717]

Same Problem

BUMP

Oct 8 23:11:00 openvpn[2931]: SENT CONTROL [35l0u1rq25rcnglcmp.com]: 'PUSH_REQUEST' (status=1)
Oct 8 23:11:01 openvpn[2931]: PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10'
Oct 8 23:11:01 openvpn[2931]: OPTIONS IMPORT: timers and/or timeouts modified
Oct 8 23:11:01 openvpn[2931]: TUN/TAP device tun0 opened
Oct 8 23:11:01 openvpn[2931]: TUN/TAP TX queue length set to 100
Oct 8 23:11:01 openvpn[2931]: updown.sh tun0 1500 1557 init
Oct 8 23:11:01 openvpn[2931]: NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing
Oct 8 23:11:01 openvpn[2931]: Initialization Sequence Completed