OpenVPN

[Travison]

Hey,

I'm having some issues with OpenVPN after I updated to 384.5 on my RT-AC68U, from version 384.4_2.

After the update my VPN client (on my phone) connected successfully to the router but could not connect to the internet, but it was working before the update. I think the problem lies in "Client will use VPN to access [ ] LAN only [x] Internet only [ ] Both" because I had it set to Internet only. Once I changed it to Both, everything seemed to work fine. I don't however wish to give access to my LAN so I hope this is a temporary bug.

I'm guessing it's because I advertise my local LAN DNS (the router) to the vpn clients so firewall/route rules are preventing access?

 

[kfp]

I don't however wish to give access to my LAN so I hope this is a temporary bug.

I'm guessing it's because I advertise my local LAN DNS (the router) to the vpn clients so firewall/route rules are preventing access?

No, the previous behaviour is the bug.

But you’re right about why it’s not working. Going forward you’ll have to either advertise a different DNS server or give VPN access to LAN.

 

[Travison]

No, the previous behaviour is the bug.

But you’re right about why it’s not working. Going forward you’ll have to either advertise a different DNS server or give VPN access to LAN.

There is just an option for "Advertise DNS to clients", that seems to advertise the DHCP dns. If I select 'No' what DNS will be used on the client? Will it be the WAN DNS on the router?

Isn't it possible to have a firewall script allowing only access to the DNS on the lan? Something like (where vpn network is 10.x.x.x and localnetwork 192.168.x.x):

iptables -A INPUT -s 10.x.x.x -d 192.168.x.x --dport 53 -j ALLOW

 

[kfp]

There is just an option for "Advertise DNS to clients", that seems to advertise the DHCP dns. If I select 'No' what DNS will be used on the client? Will it be the WAN DNS on the router?

Isn't it possible to have a firewall script allowing only access to the DNS on the lan? Something like (where vpn network is 10.x.x.x and localnetwork 192.168.x.x):

iptables -A INPUT -s 10.x.x.x -d 192.168.x.x --dport 53 -j ALLOW

You can do that in the .opvn configuration file, search for ‘dhcp-option’

https://openvpn.net/index.php/open-source/documentation/howto.html

And yes it is possible change the behaviour by adding iptable rules.