VPN setup RT_AC66u Asuswrt-merlin 380.59

[cliver]

Can anyone point me to a detailed guide to setting up a VPN server on my router and a handful of windows and android clients. All the ones i have read so far seem to be for older firmwares and OpenVPN.
My main aim is to be able to access my home network for maintenance and media streaming.
Obviously security is the main requirement with performance as good as possible.
I have set up a PPTP server and connected but believe OVPN is the way to go?
I have followed several guides using easy-rsa to set up certs etc. But am having troubles because easy-rsa doesn't work as described. I understand it isn't bundled with OVPN anymore but I get it when installing the latest version but I have to select it and it doesn't seem to be working properly. Should I download it separately?
Any pointers greatly appreciated as this is my first foray into VPN servers.
Regards
Clive

 

[XIII]

Did you already read this? https://github.com/RMerl/asuswrt-merlin/wiki/Configuring-OpenVPN-on-Merlin's-fw

 

[cliver]

Hi XIII,
Yes that was where I started. It was written for older firmwares which isn't a problem but it also refers to older versions of OVPN. The new version doesn't seem to work in the same way. Think I understand the key/certificate generation steps as described but the latest version of OVPN and the easy-rsa that comes with it doesn't seem to work the way described.

 

[PolarBear]

Hi Cliver

I am also groping around in the dark trying to do something similar, but may have some of the answers.

I am trying to set up an OpenVPN server on an RT-AC66U running Merlin 378.56_2, so I can access my NAS remotely, using OpenVPN client installed on my laptop.

I have puzzled with this and in fact bought a book "Mastering OpenVPN". Although the book is (I think) way too advanced for a OpenVPN beginner like me, parts of it have helped me get further along the road.

It seems that the documentation on github and elsewhere describes several different ways of setting up OpenVPN, without making it clear to a beginner like me which method is being described. (Point to Point mode, Client/Server mode etc.) This makes it difficult to know whether the wise advice given in one Wiki document applies to my use case, or if it applies to a different scenario. The book mentioned above helped me resolve a few of these questions.

In particular, it reinforced the message that I should be using UDP for the connection (not TCP) and I should use TUN not TAP. Both these seem to be the Merlin defaults, which is also indicates that this choice is probably the right way to go.

After installing the OpenVPN client on my laptop, I activated OpenVPN server using the Merlin set up screens. On the set up screen is a button "Export".

What seems to happen is that the client1.opvn file exported from the Merlin screen contains all the necessary keys and certificates, but as in-line text within the file. It's only necessary to save this file in C:\Program Files\OpenVPN\config\ on the laptop. (In fact I needed to save it elsewhere first, and then copy to the above directory using Windows administrator rights). It does not seem necessary to copy any other key- or certificate- files from the router across to the laptop.

Now I can start OpenVPN on my laptop and access the router remotely (success!) so the first part seems good.

Now I have 2 further steps I am still puzzling with:

1-I believe there are some key and certificate files now sitting on the router, which I should delete for security reasons (they are used by any clients, and for security reasons should reside only there). However, right now I am uncertain which of the several files on the router I should delete. Using the WinSCP "Find Files" function it seems some of them may be present in more than one directory of the router.

2-Although I can now log onto my test router remotely, I can't access the test NAS which is connected to it. This is even after enabling the WINS and Master Browser functionality on the router, and ensuring that I have a USB stick installed in the router. (It seems that in some software builds there is an issue with enabling Master Browser, if no USB stick is installed.)

Reading the documentation again, I think I need to add some routing information to the router, so that a remote OpenVPN client can find the NAS. I am not sure yet what exactly to add, and whether to add it to the "Advanced Settings" input screen in Merlin, or if I need to add a script somewhere on router. This is my next challenge when I have time to get back to this project.

I hope this info helps you get a bit further, and if you find the answers to the next steps, please feel free to share!
Good Luck!

best regards
PB

 

[cliver]

Hi Polar Bear,
Thanks for that. I'll give it a go later. Seems you have got further than me anyway.
Just an idea, have you tried turning the firewall off, both on router and laptop temporarily for testing? It seems firewall setup causes many issues with VPN and at least you will know that's what is causing your problem or not.

 

[PolarBear]

Hi Clive

No, I didn't try changing any firewall settings, perhaps I should relax them temporarily to see what happens (it is a test system after all). Thanks for the suggestion.

I suppose the reason I never tried changing the firewall settings is because I was expecting routing/forwarding issues as I am using a TUN set up, and this led me not to consider any other reason.

Routing is supposed to be less of an issue with TAP, but I don't want to switch to TAP since I will be using a slow connection in some cases, and the less traffic ( DHCP etc. ) which goes backwards and forwards the better.

PB

 

[cliver]

I only suggested it because many threads I have read seem to suggest firewall setup can cause many VPN issues.

 

[cliver]

I have just tried the basic setup as you described PolarBear. I exported the .OVPN file and choose it to my android phone. This where it used to go wrong as the file wouldn't import. I discovered I was importing it wrong [emoji18]. Got that sorted and now I am connected to my VPN via 4g on my mobile. I can access servers on my LAN via web interface/IP address and can get to my USB driver on the router using a file browser (es file explorer).
Seems to be doing everything I want although I haven't tried moving stuff around as I only have a small data allowance.
To access the USB/NAS I have to enter username and password PolarBear. Could that be your problem?
Had to use admin login as that's the only one on the router. Is it possible to set up another user without root privileges? I don't like the idea of using root by default especially from a remote location.

 

[cliver]

Copied it not choose

 

[cliver]

So, I have t running on one client device.
Now a few questions,
Do I use the same .ovpn file for all my devices (windows laptop, android tablet and android phone)?
I am not prompted for the userrname and password I set up in the general ovpn tab on the router.
How can I make it do this?
Are these default settings secure or is there anything I should do to improve the security of my vpn?

 

[PolarBear]

As I said before, I am new to VPN so I am open to correction if any VPN experts on here think I'm talking rubbish . . .

But for your question (1) Yes, I think you can use the same client1.ovpn file on all your devices that should connect to your OpenVPN Server 1. At least, that's how I understand it.

I would also like to know the answers to the 2nd and 3 rd questions if any experts are watching ?

PB

 

[cliver]

A couple of thoughts for you PB.
Mine worked straight if to my Android. So I would think that rules out your router firewall. Perhaps turn off the firewall in your laptop to try it?
I browsed to my USB drive by IP address. Maybe try that?

Sent from my Nexus 6P using Tapatalk

 

[L&LD]

Maybe this might help?

http://www.snbforums.com/threads/how-to-setup-a-vpn-server-with-asus-routers.33638/

 

[cliver]

Did you get your running PolarBear?
I have mine running with the exported .OVPN file on 3 clients OK.
I have now setup my own Certificate Authority on a windows 10 machine and have my server and client keys, certificates etc. Ready to go but I'm struggling with the following...
How do I?
1. Transfer the server keys etc. To the server?
2. Get the client certs and keys into a .VPN file for importing to my clients?

 

[PolarBear]

Finally getting there . . .

Maybe this might help?

http://www.snbforums.com/threads/how-to-setup-a-vpn-server-with-asus-routers.33638/

Thanks for the tip L&LD. I followed the instructions carefully, but still could not get it to work. The instructions mentioned "Manage Client-Specific Options". I was not sure what this does, but when I selected it, it asked me for key authority details. I did not know what to put here, as the Merlin ASUSwrt set up screen created all the certificates automatically, and included them automatically in-line inside the client1.ovpn file. So I left this unchecked.

As other matters became pressing, I had to put the project to one side for a few days.

Then I discovered what I had been doing wrong. My ISP gives me 2 separate public IP addresses, so on the second public IP address I had set up a test RT-AC66U with different IP pool, with a test NAS attached. This router/NAS were supposed to represent my home server for testing purposes.

But when I moved my test NAS from across to this test network, I had changed its fixed IP address to match, but forgotten to change the gateway and DNS IPs on its configuration screen. Doh!

When I relaised this, I changed from fixed IP to DHCP on the NAS, and then reserved its IP address on the router. The NAS now always picks up automatically the correct gateway and DNS IP addresses.

I also noticed that the NAS had a different Windows workgroup specified. So I changed that to match the test laptop I am using as an OpenVPN client. (I am not using a Windows domain.)

The router (RT-AC66U with Merlin 378.56_2) VPN server "Advanced" set up screen also has 2 settings for "Respond to DNS" and "Advertise DNS to clients". It looked like these should be enabled, so I did that too.

My test laptop (Windows 7 Ultimate) has OpenVPN client installed, and I have it connected to the network using my other public IP address. (It is *much* more convenient to have both VPN client and VPN server in the same building, during the testing phase )

On the OpenVPN client laptop I opened the Windows 7 firewall to accept UDP and TCP packets. The outside of the tunnel uses the Merlin default (UDP) but what is inside the tunnel is probably mainly TCP. I was not sure which I needed, so I opened both.

The Windows firewall settings need a "from" IP address - I was not sure if this should be the public IP address of my test router, its VPN 10.8.0.x number, or its internal 192.168.x.x number. So I opened for all of these.

So now my laptop (with OpenVPN client installed) can connect to my test NAS (behind another router on a different public IP address). I can map drives on my NAS, but only by specifying its IP address (192.168.x.x) and then clicking "Browse" in Windows Explorer.

I can't map using the NAS device name, nor can I ping it. Only using its internal IP address 192.168.x.x works.

So now I can access files while on the move, which I guess is success

Tasks remaining:
1-reverse some of the settings I changed to get it working, to find out which ones I really need, and which had no effect.
2-Similarly, on the OpenVPN client's Windows 7 firewall, to remove the "holes" I don't need
3-to remove from the test router those certificate and key files which should stay secret
4-to find a way to get the NAS to show up on the OpenVPN client, in Windows 7 Explorer under "Network"
5-to be able to map in Windows using the NAS device name rather than IP address.

The last two are necessary so that other members of the family can also access the NAS while travelling. I can't ask them to enter an IP address, as it will meet resistance and be "too complicated"

Setting this up has all been much more complicated than I first imagined, but satisying at the same time, now that it is (almost) working.

If any experts have got to the end of this very long post without falling asleep, I would really appreciate some tips about 4 and 5.

PolarBear.

 

[martinr]

I'm sorry I didn't catch this thread earlier. I'm running 378.55 and have been running the OpenVPN servers on my RT-AC68U for a couple of years now, with usernames and passwords as well as public key infrastructure (PKI) (keys and certs).

I would have advised you not to read any istructions on setting it up because it's all done for you and gets exported on the .ovpn file to your devices. The keys and certs are generated in the setting up process - you don't have to do anything. It's been made deceptively simple over the years. In fact it's so easy now that it takes just a few minutes to set up the router and the clients, so easy that we waste far more time disbelieving anything could be so easy and looking to generate PKI stuff. Perhaps around a year ago, Merlin moved the keys and certs to the jffs partition ( to overcome the previous problem of nvram's limited space filling up).

I now use separate usernames and passwords for each device - easier to revoke a single device. You set up all the desired settings on the router and then export the (same) .ovpn file to your devices, and, having elected to use usernames and passwords (as well as PKI), your device should then ask you for its username and password after importing the .ovpn file. Before I forget, if using OpenVPN on your Windows laptop, you must always open the program with admin rights otherwise you might think you're using the tunnel but you won't be. It's something Merlin often points out - something to do with correct routing.

I'd be very hesitant to start deleting client certs in the router; would they not be the clients' public certs anyway, needed for Openvpn to work and, being public certs, pose no risk whatsoever (in contrast to a private certificate)?

And no need to touch any firewall rules. I know it sounds hard to believe at present, but they couldn't have made the setting up any easier than it is.

If you have been generating your own certs etc I'd really be tempted to clean it all out and start afresh - unless you've got it running. And, yes, tun not tap unless you know why you should be using tap.

I have one server running on udp port 1194 and the other on tcp port 443: I have found the occasional public wifi that blocks vpn traffic to port 1194. And I also use Asus' excellent DDNS service.

If you later make changes to the router's vpn settings, you might well find you need to export a new .ovpn file, but it's possible to retain the old keys and certs- I've not been through this myself since Merlin put the PKI stuff into HFCs, so best take time with the settings first. So worth understanding the 4 settings on the advanced page:

http://www.snbforums.com/threads/noob-question-direct-clients-to-redirect-internet-traffic.33825/

 

[L&LD]

PolarBear,

Sorry, but your '4' and '5' questions will probably remain unanswered. I don't think that is possible.

You may simply want to create shortcuts for your other users instead.

To access the NAS' shares, use '\\192.168.xxx.xxx' in your shortcut.

To access the NAS webpage, use '192.168.xxx.xxx' in your shortcut.

 

[PolarBear]

How do I?
1. Transfer the server keys etc. To the server?
2. Get the client certs and keys into a .VPN file for importing to my clients?

Hi Clive

-1-
I guess the server you mention is in fact a router ? Someone on here a few months ago (sorry, I don't remember who to give appropriate credit, but thank you) recommended a tool called WinSCP. With this you can access the router (select protocol SCP on the WinSCP set up screen). I think you also have to enable SSH in Merlin first.

With this tool you can copy files from your C: drive to the appropriate directory on your router. You may also have to open a command window in WinSCP and run chmod on the router to set the appropriate permissions of the files after you have copied them across. Details are described on this forum somewhere.

-2-
As I understand it, the certificates can be inline actually inside the .ovpn file, in which case you do not need separate certificate files. This is how the "Export" button on the Merlin OpenVPN server set up screen works.
Alternatively, the certificates can be in separate files, which seems to be the way most of the guides describe.

Personally, I think that the Merlin way simplifies things enormously, as it's only necessary to copy the file client1.ovpn to the client.

Just a question, why did you decide to set up the certificates manually ? Does it offer better security ?

PolarBear

 

[PolarBear]

Thank you martinr, your comments are really helpful. I will go through your posting carefully later, when I have more time.

I have one server running on udp port 1194 and the other on tcp port 443: I have found the occasional public wifi that blocks vpn traffic to port 1194. And I also use Asus' excellent DDNS service.

This looks as though it is very important - if port 1194 is blocked when you are accessing from a remote location, it will be difficult if not impossible to change the port number in the server configuration file to regain access. So no VPN access until you get home !

Did I understand correctly that you have 2 server instances running on the router, identical except for the port number?

And then 2 configuration files (client1.ovpn and client2.ovpn) on the client, also identical except for the port number ?

Do you set up one to use UDP protocol and the other TCP, or are they both UDP ?

And then when travelling, when starting OpenVPN on the client, you first start the instance using 1194 and if you find it doesn't work, you use the instance with port 443 instead ?

This sounds like a really good tip coming from practical experience so I'd like to make sure I understand it. TIA - I appreciate it.

PolarBear

 

[martinr]

Thank you martinr, your comments are really helpful. I will go through your posting carefully later, when I have more time.

You're most welcome.

Another thing: your home network and the remote one ( to which you connect your device) must have different network addresses. If they are both, let's say, 192.168.1.x then, unferstandably, chaos would ensue.