OpenVPN on Dedicated Wireless Access Point (VAP)

From DD-WRT Wiki

Revision as of 20:40, 26 September 2012 by Vespian (Talk | contribs)
Jump to: navigation, search

This guide will walk you through the steps required to set up a Virtual Access Point (VAP) that is funneled through an OpenVPN tunnel, while the main access point is pushed through your normal WAN link provided by your ISP. I will link to other sections of the Wiki where possible.

Note: This procedure was tested on an ASUS RT-N16 running DD-WRT v24-sp2 (12/08/11) big (SVN revision 17990M NEWD-2 K2.6 Eko)

I was not successful in getting to work on builds past 18946. TLS Auth fails to negotiate properly.


Set up OpenVPN

You will need to set up your VPN. I am not going to rewrite the entire guide on how to accomplish that, as it can be found here (for username/password auth) or here(for PKI).

Just a few things to make sure of here besides the default setup.

1. ENSURE that redirect-gateway def1 is NOT set in your additional config dialog. We need to define our own routes later.

2. ENSURE that route no-pull is NOT set in your additional config dialog. (This will allow OpenVPN to set up the basic routing and iptables rules that you will need)

Also, take note that TUN interfaces are for routing, and TAP interfaces are for bridging. The following instructions are built around a TUN interface being set up by OpenVPN. If you have a TAP interface the instructions below will not work for you. Under most circumstances you will not need the features of a bridged TAP connection.

If you need to use a TAP connection, set up is fairly simple. Follow these instructions until you get to the point where you assign wl0.1 to br1... and put the TAP interface created by OpenVPN on the same bridge as wl0.1... and you're done.

IMPORTANT: Make sure your VPN connects before moving on with this guide. You can verify connection in the Status -> OpenVPN tab. It will say STATUS: CONNECTED.


Create and Configure Your VAP.

Go to your wireless tab and on the bottom of the page hit the "Add" Button under -Virtual Interfaces-

Image:VAP1.jpg




Make sure you leave it bridged, there is a bug in Broadcoms proprietary driver that causes problems with unbridged VAPs. Leaving it bridged as such will allow you to set up WPA security on the new WLAN.

Image:VAP2.jpg




Secure the VAP. Go to Wireless -> Wireless Security and set up WPA.

Image:VAP3.jpg




Now we need to separate the two access points. Navigate to Setup -> Networking and click "Add" under "Create Bridge" You will see a new bridge populate the menu. Fill it it's network information (make sure that it is different than your main network) and apply settings. The router will reboot.

Image:VAP4.jpg




In the "Assign to Bridge" pane, click 'Add' to add a new assignment. Select 'your new bridge (br1) and VAP (wl0.1) from the drop down menu, and disable STP. Apply settings. The router will reboot. After the page refreshes the bridge assignments should look like the picture below.

Image:VAP5.jpg




Down at the bottom of the same screen, in the DHCPd pane, click the add button. Once the page refreshes select the new bridge you created earlier and apply settings. The router will reboot.

Image:VAP6.jpg




Under Setup -> Basic Setup make sure the boxes for Use DNSMasq for DHCP and Use DNSMasq for DNS are checked. Save settings.

Then, navigate to Services -> Services and ensure that DNSMasq is enabled, Local DNS is disabled, and No DNS Rebind is Enabled. Enter the following into Additional DNSMasq Options: dhcp-option=br1,6, 8.8.8.8, 8.8.4.4

When you are finished it should look like the picture below. Apply settings.

Image:VAP7.jpg



Policy Based Routing

Now all we have left to do is set up our IP route maps so the router knows what to do with information coming in on the new VAP. You will not need to use iptables at all for this provided you set up OpenVPN correctly.

A few notes before we start...

@netaddr is the network address of your VAP. IE: 10.13.37.0/24

The device designation of your tunnel device set up by OpenVPN needs to at least start with the characters 'tun' for this script to work. For most people it will be named tun0 or tun1.

Go to Administration -> Commands and save the following as your startup script, and reboot your router.


sleep 30; tun1_addr=$(ifconfig tun1 | sed -nr 's/.*P-t-P:([^ ]+) .*/\1/p'); tun_name=$(ifconfig | sed -n 's/.*\(tun[^ ]\).*/\1/p'); ip rule add from @netaddr table 200; ip route add default via $tun1_addr dev $tun_name table 200; ip route flush cache;


This script waits 30 seconds... pulls the P-t-P address of your tunnel interface and the interface name and adds the proper entries to your routing table.

You should now be able to connect to both access points. Go to www.whatismyip.com on both and make sure that the IP addresses are different (They should be if you are connecting to a remote VPN).