OpenVPN server on ASUS issues...

[smcgrath12]

Hello, I am not sure why my OpenVPN server is not working on ASUS RT-AC66U. This is my first time setting up OpenVPN on Merlin (I am running 380.59). I recently changed my software from DD-WRT to Merlin (mainly because I have AT&T Fiber and I only get 300 Mbps download on DD-WRT, versus around 950 Mbps on Merlin).

My router LAN IP is 192.168.4.0/24
My OpenVPN server IP is 192.168.9.0/24

My OpenVPN implementation was working on DD-WRT for connected Windows and IOS clients. I am using the same certificates for authentication on Merlin. Here is what I had on DD-WRT. The only exception is that the original router for DD-WRT as ASUS RT-68. Now, my router is ASUS RT-66.

--------------------------------------------------

1. In my "Commands", for the "Startup" script, I had this line "echo "1" > /proc/sys/net/ipv4/ip_forward"

--------------------------------------------------

2. For the OpenVPN additional config, I had this:

push "route 192.168.4.0 255.255.255.0"
server 192.168.9.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
dev tun0
proto udp
port 443
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001

-------------------------------------------------------------------

3. In my "Commands", for the "Firewall" script, I had this:

# Allow hostile traffic to connect to the OpenVPN server
iptables -I INPUT 1 -p udp --dport 443 -j ACCEPT

# Allow TUN interface connections to OpenVPN server
iptables -I INPUT 2 -i tun0 -j ACCEPT

# Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i tun0 -o br0 -s 192.168.9.0/24 -d 192.168.4.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from VPN to access "the world"
iptables -I FORWARD -i tun0 -o vlan2 -s 192.168.9.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from LAN to access "the world"
iptables -I FORWARD -i eth0 -o vlan2 -s 192.168.4.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Masquerade traffic from VPN to "the world" -- done in the nat table
iptables -t nat -I POSTROUTING -o vlan2 -s 192.168.9.0/24 -j MASQUERADE

# Masquerade traffic from LAN to "the world"
iptables -t nat -I POSTROUTING -o vlan2 -s 192.168.4.0/24 -j MASQUERADE

--------------------------------------------------------------------------------------------

And here is a sample CLIENT config for a Windows client that worked for the OpenVPN server running previously on DD-WRT:

remote xxxxxxxxxxx 443
client
remote-cert-tls server
dev tun0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
route-delay 30
ca ca.crt
cert client1.crt
key client1.key

-------------------------------------------------------------------------------------------

Now, I can connect to my OpenVPN server on Merlin fine, but thats where the good things end. I cannot ping any LAN clients from VPN clients or vice-versa, nor can the VPN clients access WAN.

I have tried a lot of different options (like pushing LAN to OpenVPN clients, etc) in the OpenVPN server config page on Merlin. But, it doesn't matter...

Can someone tell me if I even need any of these scripts, and if so, where do I need to put these existing scripts on Merlin after I enable the JFFS support? And do I need to change anything in these scripts for it to work on Merlin? One thing I did notice, my tun "number" sometimes is "tun0" and other times, it is "tun21" after a reboot of Merlin.

I have read this page https://github.com/RMerl/asuswrt-merlin/wiki/User-scripts But, I am not sure which scripts I need to tinker to make this work? Do I need CCD files to make this work?

Any help will be much appreciate.. Thanks.

EDIT: The 66 is my test router. Eventually, I am going to import the config back to main 68 router.

 

[liqili2005]

Although it's an ancient post, I came across the same issue running Openvpn in AP mode.
Just in case someone is still interested, other than create nat rules on your main router(gateway) to allow VPN traffic in and out, you need do a couple of things on the VPN server.
1. enable firewall(enabled by default)
2. add the following lines to service-start script(10.8.0.0/24 is the vpn network).

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE