Thread: openVPN on N900 - configuring route to internet via VPN server (Win XP)
View Single Post
Pigro is offline Pigro
2011-03-04 , 13:09
Posts: 433 | Thanked: 274 times | Joined on Jan 2010
#1
I have openVPN set up on N900, to connect back to my Win XP home desktop (also running openVPN). The VPN is set up as tap (so I can browse to other PC's on my LAN) and I've got the network bridge setup on on XP.

I can connect the VPN and the N900 gets allocated an IP by my home router (netgear DG834PN flashed with DGTeam firmware). The router is set to serve DHCP, and I've restricted the pool of local LAN IP's, with the VPN server config allocating a separate pool to connecting VPN clients. That is all working fine and I can ping/Remote Desktop/VNC into my local machines on their local IP's over the VPN (while on a 3G connection) no problems. Also managed to mount local share on the server via wizzard mounter (albeit painfully slow to fresh contents of folders with many entries).

One additional thing I want to do is to be able to route ALL ip traffic over the VPN tunnel (not just stuff aimed at ip's on my local LAN) - so that when I'm on public wifi or gprs, I can surf securely when needed.

I've set my XP's .conf to do this (push redirect-gateway def1). However in practice I can't access the internet via my home DSL this way, it fails . I've read a lot on here about the fact that maemo doesn't properly set the deault gateway, but I'm using openVPN applet which includes a fix for that.

I initially thought that the problem may be that I needed to NAT the traffic on XP that comes from the VPN client so it can find its way out to the net over my LAN - I set IPEnableRouter in the registry and installed & configured NAT and enabled routing & remote Access service on XP, but no joy.

After much random hacking about, I have managed to get my VPN client onto the internet via my home router - but only by running udhcpc -fnq -i tap0 in xterm while the VPN is active. This causes my router's DHCP to serve a new IP to the client from the "main" pool of local IP addresses, replacing the VPN-specific IP it received when openVPN connected.

My networking skillz are pretty weak, and my head is now hurting. Given that I've made it work, I *know* there must be some elegant solution to this, but I can't see it for looking right now.

If any guru out there can advise how I should change things so that I don't need to negotiate a new lease form my DHCP server while on the VPN in order to route to internet via home DSL connection in the above scenario, I'd be very grateful.

Full details:

Router is 192.168.0.1, and DHCP serves 192.168.0.2 to 192.168.0.99
XP box is 192.168.0.10 (static IP).

server .ovpn config file on XP is:
Code:
local 192.168.0.10
port 1194
proto udp
dev tap
dev-node openVPN
ca "c:\\program files\\openvpn\\easy-rsa\\keys\\ca.crt"
cert "c:\\program files\\openvpn\\easy-rsa\\keys\\server.crt"
key "c:\\program files\\openvpn\\easy-rsa\\keys\\server.key" 
dh "c:\\program files\\openvpn\\easy-rsa\\keys\\dh1024.pem"

ifconfig-pool-persist ipp.txt
server-bridge 192.168.0.10 255.255.255.0 192.168.0.150 192.168.0.160
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.0.1"
keepalive 10 120
comp-lzo
max-clients 2
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
;log         openvpn.log
;log-append  openvpn.log
verb 6
;mute 20
client .ovpn on N900 is:

Code:
script-security 2
up /etc/openvpn/maemo-update-resolvconf
down /etc/openvpn/maemo-update-resolvconf
resolv-retry infinite
client
remote xxxxxxxxxx.no-ip.org 1194
dev tap0
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/n900.crt
key /etc/openvpn/n900.key
comp-lzo
verb 3
here is the situation with VPN active on a 3G connection, BEFORE I negotiate the new lease:

Code:
/etc/openvpn # ping vaio
PING vaio (192.168.0.10): 56 data bytes
64 bytes from 192.168.0.10: seq=0 ttl=128 time=250.824 ms
64 bytes from 192.168.0.10: seq=1 ttl=128 time=118.927 ms
^C
--- vaio ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 118.927/184.875/250.824 ms
/etc/openvpn # ping www.google.com
PING www.google.com (74.125.230.144): 56 data bytes
^C
--- www.google.com ping statistics ---
13 packets transmitted, 0 packets received, 100% packet loss
/etc/openvpn # route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
<my_DSL_static_IP> 10.94.53.135 255.255.255.255 UGH 0 0 0 gprs0
10.94.53.135 * 255.255.255.255 UH 0 0 0 gprs0
192.168.0.0 * 255.255.255.0 U 0 0 0 tap0
default vaio 128.0.0.0 UG 0 0 0 tap0
128.0.0.0 vaio 128.0.0.0 UG 0 0 0 tap0
default 10.94.53.135 0.0.0.0 UG 0 0 0 gprs0
default * 0.0.0.0 U 0 0 0 gprs0
/etc/openvpn # ifconfig
gprs0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.94.53.135 P-t-P:10.94.53.135 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MTU:1400 Metric:1
RX packets:188 errors:0 dropped:0 overruns:0 frame:0
TX packets:152 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:24247 (23.6 KiB) TX bytes:17188 (16.7 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2501 errors:0 dropped:0 overruns:0 frame:0
TX packets:2501 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:213922 (208.9 KiB) TX bytes:213922 (208.9 KiB)

phonet0 Link encap:UNSPEC HWaddr 15-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP POINTOPOINT RUNNING NOARP MTU:4000 Metric:1
RX packets:28311 errors:0 dropped:0 overruns:0 frame:0
TX packets:18103 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:2373868 (2.2 MiB) TX bytes:804857 (785.9 KiB)

tap0 Link encap:Ethernet HWaddr B2:54:A5:CB:9C:59
inet addr:192.168.0.150 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::b054:a5ff:fecb:9c59/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:104 errors:0 dropped:0 overruns:0 frame:0
TX packets:43 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:7359 (7.1 KiB) TX bytes:3827 (3.7 KiB)
and again, after I've obtained the new lease:

Code:
/etc/openvpn # udhcpc -fnq -i tap0
udhcpc (v0.9.9-pre) started
Sending discover...
Sending select for 192.168.0.7...
Lease of 192.168.0.7 obtained, lease time 259200
/etc/udhcpc/default.script: exec: line 7: /etc/udhcpc/default.zeroconf.dhcpup: not found
Resetting default routes
adding dns 208.67.222.222
adding dns 208.67.220.220
/etc/openvpn # ping vaio
PING vaio (192.168.0.10): 56 data bytes
64 bytes from 192.168.0.10: seq=0 ttl=128 time=256.988 ms
64 bytes from 192.168.0.10: seq=1 ttl=128 time=134.002 ms
^C
--- vaio ping statistics ---
3 packets transmitted, 2 packets received, 33% packet loss
round-trip min/avg/max = 134.002/195.495/256.988 ms
/etc/openvpn # ping www.google.com
PING www.google.com (74.125.230.145): 56 data bytes
64 bytes from 74.125.230.145: seq=0 ttl=54 time=518.769 ms
64 bytes from 74.125.230.145: seq=1 ttl=54 time=185.974 ms
64 bytes from 74.125.230.145: seq=2 ttl=54 time=295.166 ms
^C
--- www.google.com ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 185.974/333.303/518.769 ms
/etc/openvpn # route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
<my_DSL_static_IP> 10.94.53.135 255.255.255.255 UGH 0 0 0 gprs0
10.94.53.135 * 255.255.255.255 UH 0 0 0 gprs0
192.168.0.0 * 255.255.255.0 U 0 0 0 tap0
default router 0.0.0.0 UG 0 0 0 tap0
default 10.94.53.135 0.0.0.0 UG 0 0 0 gprs0
default * 0.0.0.0 U 0 0 0 gprs0
/etc/openvpn # ifconfig
gprs0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.94.53.135 P-t-P:10.94.53.135 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MTU:1400 Metric:1
RX packets:259 errors:0 dropped:0 overruns:0 frame:0
TX packets:180 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:10
RX bytes:34098 (33.2 KiB) TX bytes:20926 (20.4 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2501 errors:0 dropped:0 overruns:0 frame:0
TX packets:2501 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:213922 (208.9 KiB) TX bytes:213922 (208.9 KiB)

phonet0 Link encap:UNSPEC HWaddr 15-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP POINTOPOINT RUNNING NOARP MTU:4000 Metric:1
RX packets:28571 errors:0 dropped:0 overruns:0 frame:0
TX packets:18299 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:2389392 (2.2 MiB) TX bytes:810693 (791.6 KiB)

tap0 Link encap:Ethernet HWaddr B2:54:A5:CB:9C:59
inet addr:192.168.0.7 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::b054:a5ff:fecb:9c59/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:172 errors:0 dropped:0 overruns:0 frame:0
TX packets:65 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:12744 (12.4 KiB) TX bytes:6758 (6.5 KiB)

/etc/openvpn #
__________________
n900: "with power comes responsibility".

If you buy a niche, highly modifiable smartphone and proceed to mess it up by blindly screwing around, don't just blame the phone, also blame yourelf.
Last edited by Pigro; 2011-03-10 at 15:47. Reason: added wizzard mounter info
 

The Following 3 Users Say Thank You to Pigro For This Useful Post: