OpenVPN server on DD-WRT?

[smapdi]

Can anyone point me to a good tutorial on how to set up OpenVPN on a router using DD-WRT as a server? I've seen a ton of tutorials on having the router act as a client to another OpenVPN server but nothing recent on how to make my router an OpenVPN server.

I just want to be able to use OpenVPN to connect back to my home network when I'm away.

If it helps any this would be on an Netgear R7000 so I don't believe resource constraints would apply.

 

[yorgi]

Can anyone point me to a good tutorial on how to set up OpenVPN on a router using DD-WRT as a server? I've seen a ton of tutorials on having the router act as a client to another OpenVPN server but nothing recent on how to make my router an OpenVPN server.

I just want to be able to use OpenVPN to connect back to my home network when I'm away.

If it helps any this would be on an Netgear R7000 so I don't believe resource constraints would apply.

I think DD WRT only does PPTP VPN Server
I don't think it supports Open VPN server as you are asking.

 

[smapdi]

I think DD WRT only does PPTP VPN Server
I don't think it supports Open VPN server as you are asking.

There is both an option for OpenVPN Server/Daemon and OpenVPN Client which leads me to believe that you can run a standalone server.

 

[yorgi]

There is both an option for OpenVPN Server/Daemon and OpenVPN Client which leads me to believe that you can run a standalone server.

View attachment 6804

I haven't touched a DD WRT router in a while. I never setup a VPN server with DD WRT.
For what its worth take a look at this http://www.snbforums.com/threads/how-to-setup-a-vpn-server-with-asus-routers.33638/
its setting up a VPN server with ASUS. I am sure ASUS has copied some code from Tomato or WRT
maybe it might help. When you enable the VPN server do you get other options?
If you can show the options maybe I can help you out more.

 

[smapdi]

This is what I get when I enable it:

I can figure out some of the needed parts but I believe there is additional iptables rules and settings.

Any help would be greatly appreciated

 

[smapdi]

I haven't touched a DD WRT router in a while. I never setup a VPN server with DD WRT.
For what its worth take a look at this http://www.snbforums.com/threads/how-to-setup-a-vpn-server-with-asus-routers.33638/
its setting up a VPN server with ASUS. I am sure ASUS has copied some code from Tomato or WRT
maybe it might help. When you enable the VPN server do you get other options?
If you can show the options maybe I can help you out more.

Since you mention Asus routers, would installing Asuswrt-Merlin on my R7000 be worthwhile? I'm honestly not married to DD-WRT and don't mind switching as long as the project is stable and maintained.

 

[yorgi]

Since you mention Asus routers, would installing Asuswrt-Merlin on my R7000 be worthwhile? I'm honestly not married to DD-WRT and don't mind switching as long as the project is stable and maintained.

Hmm if you can install Merlin on it go for it

 

[sfx2000]

Hmm if you can install Merlin on it go for it

Netgear R7000 - nope... AsusWRT on Netgear is not an RMerlin build, it's a fork, and not very well supported...

OP is better off working the DDWRT solution perhaps, or reverting back to factory...

 

[smapdi]

Netgear R7000 - nope... AsusWRT on Netgear is not an RMerlin build, it's a fork, and not very well supported...

OP is better off working the DDWRT solution perhaps, or reverting back to factory...

It's actually XWRT which is a port of Merlin to the R7000 (http://xvtx.ru/xwrt/about.htm) last update was May so it's not terribly out of date.

I'm actually somewhat set up with OpenVPN in DD-WRT but I think either my iptables rules are messed up or the config is wrong because I can't seem to get a connection with either the Android client nor with the Ubuntu command line one.

This is what my settings look like:

The TLS Auth Key and Certificate Revoke List are blank. I checked running processes on the router and I see that the OpenVPN process is running and bound to port 1194

My firewall script looks like this:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.254.0/24 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.111.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Does this look right to you guys?

 

[smapdi]

OK, so I got a client to connect by following this guide (switching out the TCP 443 parts for UDP)

http://www.teksec.org/2013/openvpn-tutorial-dd-wrt-howto-configure-properly-part-2/

Now I just need to figure out why I cannot ping the gateway nor reach the internet when the connection is established.

 

[sfx2000]

It's actually XWRT which is a port of Merlin to the R7000 (http://xvtx.ru/xwrt/about.htm) last update was May so it's not terribly out of date.

I have a hard time with AsusWRT being run on non-ASUS equipment - esp. when Netgear has a great opensource effort on their own with the DDWRT and OpenWRT communities...

 

[smapdi]

I have a hard time with AsusWRT being run on non-ASUS equipment - esp. when Netgear has a great opensource effort on their own with the DDWRT and OpenWRT communities...

The R7000 may have really great DD-WRT support but the OpenWRT support is incredibly underwhelming. Since the Broadcom drivers for the 2.4 and 5 GHz radios is closed source, the OpenWRT port doesn't have WiFi which makes it useful for the 4 devices I have physically plugged into my router but worthless for the 10 + wireless clients I have.

 

[yorgi]

It's actually XWRT which is a port of Merlin to the R7000 (http://xvtx.ru/xwrt/about.htm) last update was May so it's not terribly out of date.

I'm actually somewhat set up with OpenVPN in DD-WRT but I think either my iptables rules are messed up or the config is wrong because I can't seem to get a connection with either the Android client nor with the Ubuntu command line one.

This is what my settings look like:

View attachment 6820


The TLS Auth Key and Certificate Revoke List are blank. I checked running processes on the router and I see that the OpenVPN process is running and bound to port 1194

My firewall script looks like this:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.254.0/24 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.111.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Does this look right to you guys?

Try changing the hash algorithm to SHA1
I think that is your problem

 

[yorgi]

It's actually XWRT which is a port of Merlin to the R7000 (http://xvtx.ru/xwrt/about.htm) last update was May so it's not terribly out of date.

I'm actually somewhat set up with OpenVPN in DD-WRT but I think either my iptables rules are messed up or the config is wrong because I can't seem to get a connection with either the Android client nor with the Ubuntu command line one.

This is what my settings look like:

View attachment 6820


The TLS Auth Key and Certificate Revoke List are blank. I checked running processes on the router and I see that the OpenVPN process is running and bound to port 1194

My firewall script looks like this:

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.254.0/24 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.111.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Does this look right to you guys?

where did you get those certificates? I don't see in any certificates in that URL you posted.
he seems to be talking about certificates and where to paste them but no download link for them.
Did DD WRT generate the certificates?
Without certificates you will never be able to set i up properly.
also y0u didn't completely follow that guide. You changed things all over the place
I would suggest duplicating that guide and finiding proper certificates because just grabbing parts from here and there wont help you out much.
Personally I would not bother with DD WRT...I would put stock firmware
here is a guide for netgear products and VPN servers
Netgear is a good company I don't get why you would want to put DD WRT on it. That firmware was great in the 90s, now its old news.
http://kb.netgear.com/app/answers/detail/a_id/23854/~/how-do-i-use-the-vpn-service-on-my-nighthawk-router-with-my-windows-client?
Netgear seems to have a very thorough and up to date VPNServer and client.
go that route because your router will work better as well.

 

[smapdi]

where did you get those certificates? I don't see in any certificates in that URL you posted.
he seems to be talking about certificates and where to paste them but no download link for them.
Did DD WRT generate the certificates?
Without certificates you will never be able to set i up properly.
also y0u didn't completely follow that guide. You changed things all over the place
I would suggest duplicating that guide and finiding proper certificates because just grabbing parts from here and there wont help you out much.
Personally I would not bother with DD WRT...I would put stock firmware
here is a guide for netgear products and VPN servers
Netgear is a good company I don't get why you would want to put DD WRT on it. That firmware was great in the 90s, now its old news.
http://kb.netgear.com/app/answers/detail/a_id/23854/~/how-do-i-use-the-vpn-service-on-my-nighthawk-router-with-my-windows-client?
Netgear seems to have a very thorough and up to date VPNServer and client.
go that route because your router will work better as well.

The certs are generated via the easy-rsa scripts that come with the OpenVPN software. Using certs from some random website would be really, really dumb especially since you don't want anyone to have the private key of your VPN. The parts of the tutorial I modified are only a) for switching to the standard UDP port for OpenVPN (the tutorial used the HTTPS port which most home ISPs block) and b) using a different non-routeable /24 address space. Neither of these would break the setup. At this point the only issue is the iptables rules which I think I can figure out.

I assume using the Netgear Genie does the same thing as the link you put in shows that it provides the CA cert, server cert, server private key as well as the Diffie Hellman PEM. I'm not going back to Netgear firmware as it doesn't give me the level of control a 3rd party firmware does.

Thanks for the suggestions though.