Talk:OpenVPN - Site-to-Site Bridged VPN Between Two Routers

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 16:01, 8 April 2007 (edit)
1176047163 (Talk | contribs)

← Previous diff
Current revision (19:42, 26 October 2009) (edit) (undo)
Cambonicky (Talk | contribs)
(Wireless Clients get the IP assigned by the server router)
 
(15 intermediate revisions not shown.)
Line 1: Line 1:
 +== Same subnets doesn't work ==
 +When I connect to a router that has same subnet 192.168.1.x as the router I can connected to locally, I cannot ping any remote machine, or the remote router. If I set the remote router to 192.168.2.x, then everything works fine. (I am talking about connecting from a client machine to a remote router, I haven't tried router to router because I couldn't get it going when I followed this guides steps). - ''[[User:Jeffman|Jeffman]] 22:49, 9 Jul 2007 (CEST)''
 +== Help! ==
 +We have put in all the information exactly how it shows in the instructions. one router is 192.168.1.X and the other is 192.168.11.X. Still cant ping any hosts on the remote side. Is there a way to check the status? Anything will help. Thanks
 +=== Solution ===
 +The two routers have to be in the same sub-domain for the bridging to work, make both of them in the 11.x subdomain or the 1.x subdomain. Then make sure that the DHCP servers on each end issue IP addresses that do not overlap with those on the other end. (Added by xnok)
 +== Frame sizes? ==
 +I've used L2TPv3 on Cisco before and always ran into the same problem - it didn't support frame sizes around 1500. Since L3 packet + VPN overhead usually pushes it over the MTU threshold for the Internet, I need some way to fragment packets (errr...frames) either after or before it's bridged through the tunnel.
 +Does this method support that? If not, can it be tweaked further?
 +Solution:
 +I got the same problem, but after I assign Server to 192.168.1.1 and client to 192.168.1.2 everything work fine for me. I could ping both PC behind both Routers.
 +== OpenVPN is running at both ends, but I still can't connect ==
 +Make sure you have the "remote x.y.z" in your server config. If you have a dynamic IP, use a dynamic DNS service like dyndns.org to give your machines names. Finally, make sure on the DDNS setup page that both routers have successfully upated the DDNS database.
 +== Any other tips to debug? ==
 +* Enable SSH on the routers and login. cd to /tmp and look at the config files and dns resolution files.
 +* If you still can't find the problem, try running openvpn directly with the config file on the router interactively (remove the "daemon" directive). You may also want to increase the verbosity level to 5 or 8. I find this easier than trying to use the syslog.
 +* Try running openvpn with each one of the directives in the config file separately. This will catch any misspellings.
 +* Make sure your DNS entries are upto date.
 +* Make sure that port 1194 is open (or what ever port you picked)
 +* Check the time (on the upper right corner) of the routers. Both routers have to be approximately at the same time. An easy way to synchronize the two routers is to use NTP (on Setup page). Be sure to use the same time zone and daylight savings time settings.
 +* When all else fails, post to the dd-wrt forums!
 +== Server hosts can't ping client hosts ==
- +The only issue I am currently having is that hosts on the client network can ping hosts on the server network, but not the other way around. A host on the server network can ping the router on the client side though. I have icmp filtering on both routers turned off. Any ideas?
- +
- +
-<div style="display:none">+
-[l_sp_30]+
-[http://www.pakstop.com/blog/?u=lipka Vera Wang Wedding Dress]+
-[http://pipa.blogth.com/ No Credit Check Payday Loan]+
-[http://busek.log.ge/ No Teletrack Payday Loan]+
-[http://nireblog.com/blogs/polik/files/gewso.htm Ge Water Softener]+
-[http://nireblog.com/blogs/polik/files/faxless.htm Faxless Payday Loan]+
-[http://some.lintec.net.ua/kamagra/cheap-kamagra.html cheap kamagra]+
-[http://some.lintec.net.ua/kamagra/buy-kamagra-online-uk.html buy kamagra online uk]+
-[http://some.lintec.net.ua/kamagra/discount-kamagra.html discount kamagra]+
-[http://some.lintec.net.ua/kamagra/indian-pharmacy-kamagra.html indian pharmacy kamagra]+
-[http://some.lintec.net.ua/kamagra/kamagra-direct-from-india.html kamagra direct from india]+
-[http://some.lintec.net.ua/kamagra/kamagra-gel.html kamagra gel]+
-[http://some.lintec.net.ua/kamagra/kamagra-oral-jelly.html kamagra oral jelly]+
-[http://some.lintec.net.ua/kamagra/kamagra-overnight.html kamagra overnight]+
-[http://health.groups.yahoo.com/group/Generic_Atarax Buy Generic Atarax]+
-[http://in.groups.yahoo.com/group/Effexor-XR-drug/ buy effexor xr]+
-[http://de.groups.yahoo.com/group/Pamelor Pamelor]+
-[http://fr.groups.yahoo.com/group/Paxil-Online/ paxil online]+
-[http://it.groups.yahoo.com/group/Zyprexaa Zyprexa]+
-[http://uk.groups.yahoo.com/group/Generic_Zyrtec Generic Zyrtec]+
-[http://hk.groups.yahoo.com/group/Order-Allegra Order Allegra]+
-[http://espanol.groups.yahoo.com/group/Order-Clarinex-Online/ Order Clarinex Online]+
-[http://cf.groups.yahoo.com/group/Order-Claritin/ Order Claritin]+
-[http://mx.groups.yahoo.com/group/Order-Neurontin/ Order Neurontin]+
-[http://br.groups.yahoo.com/group/Amoxil-Online Amoxil Online]+
-[http://ar.groups.yahoo.com/group/Buy-Cipro Buy Cipro]+
-[http://es.groups.yahoo.com/group/Buy-Zithromax/ Buy Zithromax]+
-[http://br.groups.yahoo.com/group/Buy-Arava Buy Arava]+
-[http://br.groups.yahoo.com/group/Buy-Singulair Buy Singulair]+
-------------+
-[http://nireblog.com/blogs/alarm/files/alarm1.htm alarm chronograph man pulsar watch]+
-[http://nireblog.com/blogs/alarm/files/alarm2.htm bed wetting alarm]+
-[http://nireblog.com/blogs/alarm/files/alarm3.htm firex smoke alarm]+
-[http://nireblog.com/blogs/alarm/files/alarm4.htm alarm beyonce lyric ring]+
-[http://nireblog.com/blogs/alarm/files/alarm5.htm clifford car alarm]+
-[http://nireblog.com/blogs/alarm/files/alarm6.htm wireless driveway alarm]+
-[http://nireblog.com/blogs/alarm/files/alarm7.htm alf alarm clock]+
-[http://nireblog.com/blogs/alarm/files/alarm8.htm alarm detector smoke vocal voice]+
-[http://nireblog.com/blogs/alarm/files/alarm9.htm alarm clock docking ipod station]+
-[http://nireblog.com/blogs/alarm/files/alarm10.htm alarm blowfly clock]+
-[http://nireblog.com/blogs/alarm/files/alarm11.htm ademco alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm12.htm clifford alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm13.htm alarm greensboro system]+
-[http://nireblog.com/blogs/alarm/files/alarm14.htm brinks alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm15.htm triad alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm16.htm atlanta burglar alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm17.htm simplex fire alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm18.htm karr alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm19.htm alarm caddx system]+
-[http://nireblog.com/blogs/alarm/files/alarm20.htm aarp medical alert alarm system]+
-[http://nireblog.com/blogs/alarm/files/alarm21.htm ademco burglar alarm]+
-[http://nireblog.com/blogs/alarm/files/alarm22.htm alarm burglar charlotte]+
-[http://nireblog.com/blogs/alarm/files/alarm23.htm adt burglar alarm]+
-[http://nireblog.com/blogs/alarm/files/alarm24.htm visonic burglar alarm]+
-[http://nireblog.com/blogs/alarm/files/alarm25.htm reno burglar alarm]+
- +
- +
-[http://zjunja.moskva.com/data/uf/9980163/11/67/116704.alarm2.htm.txt bed wetting alarm]+
-[http://user-lol.moskva.com/data/uf/9980163/11/72/117299.clf.htm.txt cheap laminate flooring]+
- +
-[http://your.hostingclub.de/noteletrack.htm No Teletrack Payday Loan]+
-[http://your.hostingclub.de/wlf.htm Wilsonart Laminate Flooring]+
- +
-[http://fyad.org/lf3l armstrong laminate flooring]+
-[http://fyad.org/lf3m reno burglar alarm]+
-[http://fyad.org/lf3n alarm brookhaven burglar system]+
- +
-[http://alarmch.notlong.com alarm chronograph man pulsar watch]+
-[http://brinks.notlong.com brinks alarm system]+
- +
-[http://xrl.us/vbzr radionics alarm system]+
-[http://xrl.us/vbzv karr alarm system]+
- +
-[http://pho.se/k3 alarm caddx system]+
-[http://pho.se/k4 compustar car alarm]+
- +
-[http://doiop.com/woburn alarm medical woburn]+
-[http://doiop.com/burglar alarm burglar chapel hill]+
- +
- +
-[http://blogs.1up.in/busek/ez-payday-loan/ ez payday loan]+
-[http://blogs.1up.in/busek/sonic-payday-loan/ Sonic Payday Loan]+
-</div>+

Current revision

Contents

[edit] Same subnets doesn't work

When I connect to a router that has same subnet 192.168.1.x as the router I can connected to locally, I cannot ping any remote machine, or the remote router. If I set the remote router to 192.168.2.x, then everything works fine. (I am talking about connecting from a client machine to a remote router, I haven't tried router to router because I couldn't get it going when I followed this guides steps). - Jeffman 22:49, 9 Jul 2007 (CEST)

[edit] Help!

We have put in all the information exactly how it shows in the instructions. one router is 192.168.1.X and the other is 192.168.11.X. Still cant ping any hosts on the remote side. Is there a way to check the status? Anything will help. Thanks

[edit] Solution

The two routers have to be in the same sub-domain for the bridging to work, make both of them in the 11.x subdomain or the 1.x subdomain. Then make sure that the DHCP servers on each end issue IP addresses that do not overlap with those on the other end. (Added by xnok)

[edit] Frame sizes?

I've used L2TPv3 on Cisco before and always ran into the same problem - it didn't support frame sizes around 1500. Since L3 packet + VPN overhead usually pushes it over the MTU threshold for the Internet, I need some way to fragment packets (errr...frames) either after or before it's bridged through the tunnel.

Does this method support that? If not, can it be tweaked further?

Solution: I got the same problem, but after I assign Server to 192.168.1.1 and client to 192.168.1.2 everything work fine for me. I could ping both PC behind both Routers.

[edit] OpenVPN is running at both ends, but I still can't connect

Make sure you have the "remote x.y.z" in your server config. If you have a dynamic IP, use a dynamic DNS service like dyndns.org to give your machines names. Finally, make sure on the DDNS setup page that both routers have successfully upated the DDNS database.

[edit] Any other tips to debug?

  • Enable SSH on the routers and login. cd to /tmp and look at the config files and dns resolution files.
  • If you still can't find the problem, try running openvpn directly with the config file on the router interactively (remove the "daemon" directive). You may also want to increase the verbosity level to 5 or 8. I find this easier than trying to use the syslog.
  • Try running openvpn with each one of the directives in the config file separately. This will catch any misspellings.
  • Make sure your DNS entries are upto date.
  • Make sure that port 1194 is open (or what ever port you picked)
  • Check the time (on the upper right corner) of the routers. Both routers have to be approximately at the same time. An easy way to synchronize the two routers is to use NTP (on Setup page). Be sure to use the same time zone and daylight savings time settings.
  • When all else fails, post to the dd-wrt forums!

[edit] Server hosts can't ping client hosts

The only issue I am currently having is that hosts on the client network can ping hosts on the server network, but not the other way around. A host on the server network can ping the router on the client side though. I have icmp filtering on both routers turned off. Any ideas?