Questions on OpenVPN and AsusWRT

[rick155]

[SOLVED] Questions on OpenVPN and AsusWRT

I have problems sharing a usb disk with Samba over OpenVPN

local sharing works flawlessly, but I cannot access disk when using OpenVPN with TUN interface

I have left all the default values, just activated OpenVPN + created certificate

Disk is in the same workgroup as all the other pc and firewall of pc using OpenVPN has been deactivated

Router is using 192.168.2.1 /255.255.255.0
OpenVPN 10.8.0.1 / 255.255.255.0


When I connect with a different pc (connected with cellular data connection) I can see OpenVPN is connected, I can ping 10.8.0.1 but I can't see any folder using Start/Computer/Network

if I try to open Start/Run and type

\\10.8.0.1

or

\\Shared01

or

\\10.8.0.1\Shared01

I get an error message "Network path was not found"

I have tried also manually mapping network drive with no success

Reading on the forum there was a discussion in which Merlin told, in order to make network browse possible, you have to use TAP interface instead of TUN

by doing so it worked and I can also see the other pc locally connected and the usb drive


now my questions:

1) why it doesn't work with TUN interface ?

2) From the pc on OpenVPN I was able to see the locally connected pc and it's something that concerned me a little bit.
I need just to share my usb disk and would like to keep all the pc hidden/separated, is it possible ?

3) What's the difference, security-wise, between TUN and TAP ?

4) Since my purpose is only file sharing (no remote desktop or else) what would be the best choice between TUN/TAP and UDP/TCP ?

5) If router is restarted I have a new router IP and certificate does not work anymore.
I have to modify certificate or recreate another one and copy on the pc, but this is not always possible (thinking for instance if electricity goes out and I am outside so I cannot connect anymore until I return back home).
Is there a way to create a certificate with dynamically assigned ip (sort of like when using DDNS) ?

6) If I deactivate VPN I notice that my local pc connected via ethernet to router cannot browse anymore.
Even trying to access router web interface page brings to a strange message on the screen (something around configuration changed and that to access settings page I should reconnect using wireless).
In order to restore connectivity I have to restart router or unplug/plug ethernet cable.
Is it a bug or is it normal ?

 

[RMerlin]

Try using your LAN router IP (192.168.2.1) instead of the tunnel endpoint IP.

I can confirm that accessing router shares over a TUN tunnel works fine for me. You only need TAP if you want to have the remote end computers appear in your network browser. You can still directly access a share over TUN using its IP.

A TAP tunnel is far more tricky to properly configure, as it will bridge the two networks, rather than just tunnel between them.

 

[sinshiva]

not terribly important, but if you need to see the machines with the network browser, enabling the router to act as the master browser in the usb app > server center should help if you use tun. i think the smbd server probably needs to be enabled for this, but i could be wrong about that. i got a microsd card in mine, so i haven't tried without

 

[rick155]

Try using your LAN router IP (192.168.2.1) instead of the tunnel endpoint IP.

I can confirm that accessing router shares over a TUN tunnel works fine for me. You only need TAP if you want to have the remote end computers appear in your network browser. You can still directly access a share over TUN using its IP.

A TAP tunnel is far more tricky to properly configure, as it will bridge the two networks, rather than just tunnel between them.

Thanks Merlin, I am sure yesterday I tried with \\192.168.2.1 and it would only open a window with an icon "printer" and nothing else

today I tried again with the same configuration (TUN interface) and it worked!

It seems we should keep you in a lamp and rub it from time to time when we need to express a wish

speaking about security, are there any risks in using OpenVPN ? When you connect with Open VPN via TUN, is it like you were connected in LAN (and potentially interact with the other pc) ?

also between TCP and UDP which should I use ?

not terribly important, but if you need to see the machines with the network browser, enabling the router to act as the master browser in the usb app > server center should help if you use tun. i think the smbd server probably needs to be enabled for this, but i could be wrong about that. i got a microsd card in mine, so i haven't tried without

I have already activated Samba server if this is what you mean and I can see the USB disk from LAN but I couldn't see the same USB disk from OpenVPN

thanks anyway for your feedback

 

[RMerlin]

speaking about security, are there any risks in using OpenVPN ? When you connect with Open VPN via TUN, is it like you were connected in LAN (and potentially interact with the other pc) ?

It does create a tunnel between the two networks, so you can access devices that are on the other side of the tunnel.

also between TCP and UDP which should I use ?

Up to you. In theory, UDP should give better performance, however that didn't seem to be the case last time I tested it, about a year or two ago. I just use TCP because it's more reliable than UDP.

 

[sinshiva]

i like to use tcp with compression for public hotspots, particularly if the signal is weak. with udp and no compression, i see pretty much the same bandwidth, but half the latency. i generally only use the tcp server, though, like merlin suggested, for the reliability. i know people that would use vpns for games that only have lan support, like emulators and such, and for this udp is preferable

 

[rick155]

Thanks again for your help Merlin and Sinshiva

will select TCP then since I need reliability rather than performance

last question:

I only need to share files on internet, don't need remote access to my pc and don't want pc connected with OpenVPN to mess with local pc

Basically my goal would be to have a mix of AiDisk and OpenVPN

Aidisk allows users only to access ONLY USB disk, but doesn't have any encryption on data/login/password
OpenVPN allows encryption but it's like a virtual user connected to LAN port

Is it possible with OpenVPN to restrict access to USB disk only?

 

[RMerlin]

Thanks again for your help Merlin and Sinshiva

will select TCP then since I need reliability rather than performance

last question:

I only need to share files on internet, don't need remote access to my pc and don't want pc connected with OpenVPN to mess with local pc

Basically my goal would be to have a mix of AiDisk and OpenVPN

Aidisk allows users only to access ONLY USB disk, but doesn't have any encryption on data/login/password
OpenVPN allows encryption but it's like a virtual user connected to LAN port

Is it possible with OpenVPN to restrict access to USB disk only?

Closest you could do is configure the server not to push LAN info to the client, but I don't know if the router shares will still be accessible. You will have to try.

AiCloud does allow encrypted access - access it over https.

 

[rick155]

thanks for the answer Merlin

I didn't know AiCloud/Disk could use HTTPS (thought that was limited only to administration web interface)

the only thing I don't like is with HTTPS is that interface is a bit sluggish though I understand my router (N66U) doesn't sport a fast cpu so I can't be too picky

I guess I will evaluate both possibilities

thanks again