OpenVPN host resolution, bi-directional routing, and more

[ssideratos]

My apologies in advance if there is a clear guide somewhere but google search has turned up many posts, and I've spent 2 long days trying various combinations, none of which seemed to work for me.

I have set up OpenVPN between two Asus RT-AC68 routers. The AC68U is Server, and the AC68P is Client. I used guides I found via google to generated my own keys on a Windows machine and successfully configured server and client with my own certificates and keys.

WHAT WORKS

The client router, AC68P, successfully connects to the server router, AC68U, and I am able to ping, or reach any machine on the server LAN via it's IP address from the client LAN.


WHAT MORE I WOULD LIKE TO DO (in order of importance)

1) FIRST: Resolve (Server Side) HOSTSNAMES from remote location (Client Side)
While I can reach any machine on the server LAN from the client LAN via it's IP address, it would be much more useful and convenient if server LAN, HOSTNAMES (Computer Names) could be resolved from the Client LAN machines.

All machines on both server and client networks are assigned consistent ip addresses through DHCP reservations, so I know I could create a master host file and put that on all my machines, but google searches lead me to believe that it can be done otherwise (via the client lan using the server lan DNS if it fails to resolve locally?)

Google searches already led me to make the following changes

On the Server Side:
Respond to DNS Yes
Advertise DNS to clients Yes

On the Client Side
Create NAT on tunnel: Yes (default, but I had tried No previously as some guides suggested, but then nothing worked)
Accept DNS Configuration: Strict


2) SECOND: Have the VPN connection be bi-directional [SOLVED 07/29/2015 - See Next 2 Posts]
I can reach the server LAN ip addresses from the client LAN, but I would like to configure it such that I can reach the client LAN machines from the server LAN. Of course, by IP address, but also ideally via HOSTNAMES as above, which I haven't even get working in the "normal" direction yet.


3) THIRD: Add additional client and or servers and have the routers route between them
As a last step, assuming two clients, B and C, connected to server A, I would like for client B to reach client C through server A. I have already configured each site with a different IP address range, i.e.
Server Site A 192.168.1.xxx
Client Site B 192.168.2.xxx
Client Side C 192.168.3.xxx

Another way would be to configure Site B as a Server, in addition to it's role as a Client of Site A, and then configure Client C to go to Server B, but Client C should be able to get to Site A through B.


I have found numerous discussions on google with others wishing to do the same, but haven't found anything that works.

I imagine this thread would be useful to many, and if there is somewhere that has already clearly described how to accomplish one or more of the above, especially using Merlin's (currently 378.55) firmware, a link would be very much appreciated.

Thanks in advance, and it may make sense to tackle 1 issue at a time in the order outlined so the steps to accomplish each goal are clearly documented separately.

 

[ssideratos]

Still researching my issues on google. Nothing I found earlier worked. Today, I found another article that so clearly describes how to do what I want to do, but it doesn't work either. Does anyone know if I'm missing something, or if it's broken in 378.55? This is the first time I've tried to configure OpenVPN so I can't tell if it's configuration issue, or the features are broken.

Basically, it seems bi-directional communication should be EASY.

Basically, it boils down to

On Server
1) Set Manage Client-Specific Options "Yes"
2) That exposes "Allow Client <--> Client" which should allow for bi-directional communication. Set that to "Yes"
3) In Allowed Clients. Add the information of the client router
UserName = Common Name of Client = Client01
IP Address = 192.168.3.1 (IP Address of client router)
Subnet Mask = 255.255.255.0
Push = "Yes"

On the Client
1) Accept DNS Configuration = "Strict"
2) Enable NAT on tunnel = "No"

It's all outlined in this guide
http://tomatovpn.keithmoyer.com/2009/03/client-specific-options.html

And that seems to agree with my interpretations of everything else I read via google searches.

Unfortunately, when I follow these steps.

NOTHING WORKS

I can't even reach the Server LAN from the Client LAN even by IP Address, which works otherwise if I leave enable "Create NAT on tunnel" as "Yes"

Any idea if I'm still missing something, or am I doing everything I should be doing, but it's just broken?

Again, help appreciated.

 

[ssideratos]

I got the VPN connection to work bi-directional. I can reach any machine from other side using it's IP Address.

What I did.

1) While troubleshooting, I toggled and every option back and forth on the Client Side to see if that would expose any hidden options that might lend a clue. Firewall had some interaction with Create NAT on tunnel, and I was prepared to test those combinations. But before starting my systematic testing, I returned the values to the original unchanged "Firewall: Automatic" and "Create NAT on tunnel: Yes". Why then do I include this background since I didn't really change anything? Honestly, it is because I can imagine a scenario where just changing and putting the values back to their original and applying in-between, which I did, may have caused some configuration files to be updated again, and possibly corrected.

BUT

2) What I suspect really got bi-directional VPN working is
On the server side, the change I made from my previous post is
In the allowed clients, for the value of IP address, instead of using 192.168.3.1 (the address of the client router), I used 192.168.3.0 instead. Even though it says IP Address, I suspect it doesn't want the IP Address of the router, but the LAN segment.

After another set of reboots, IT WORKED.

I can access any machine on the SERVER LAN from any machine on the CLIENT LAN using IP Address, and do the same in reverse (access any CLIENT LAN machine from any SERVER LAN machine by IP Address).

What is stills strange is that on the
"Create NAT on tunnel" value is still set to YES on the client OpenVPN settings contrary to everything that I read.

Just for completeness, I have also just tested setting "Create NAT on tunnel" to "NO" and that works now too. So, I've left it off, even though I have observed no visible effect, but if it is doing something, I don't need/want any unnecessary NATing between my VPN endpoints.



Does anyone have any info on how to get name resolution working?