So, this is the current situation:
There is an OpenVPN-Server in the internet, there is an OpenWRT-Router at my place.
The router is connected to the VPN as a client.
I want the router to behave just as usual, but with an extra routing between the VPN and the LAN.
I successfully pinged between the two VPN adresses. Then I added a route on the VPN server for 192.168.1.0/24 via 10.8.0.2 (IP address of my local router), but I am not able to ping 192.168.1.1, the other network adress of my router…
The wohle thing clearly looks like a routing issue which I am not able to solve…
/etc/config/network:
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config interface 'lan'
option ifname 'eth0.1'
option type 'bridge'
option proto 'static'
option netmask '255.255.255.0'
option ipaddr '192.168.1.1'
config interface 'wan'
option ifname 'eth0.2'
option proto 'dhcp'
config switch
option name 'eth0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'eth0'
option vlan '1'
option ports '0t 2 3 4 5'
config switch_vlan
option device 'eth0'
option vlan '2'
option ports '0t 1'
config interface 'vpn'
option proto 'none'
option ifname 'tun0'
/etc/config/firewall:
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wwan'
config zone
option name 'vpn'
option input 'ACCEPT'
option output 'ACCEPT'
option network 'vpn'
option forward 'REJECT'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wwan'
config zone
option name 'vpn'
option input 'ACCEPT'
option output 'ACCEPT'
option network 'vpn'
option forward 'REJECT'
config forwarding
option src 'lan'
option dest 'wan'
config forwarding
option dest 'lan'
option src 'vpn'
config forwarding
option dest 'vpn'
option src 'lan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option target 'ACCEPT'
option dest_port '1194'
option src 'wan'
option proto 'udp'
option family 'ipv4'
config include
option path '/etc/firewall.user'
Output of route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default stdw-wh-84-0.st 0.0.0.0 UG 0 0 0 eth0.2
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 0 0 0 br-lan
212.201.84.0 * 255.255.254.0 U 0 0 0 eth0.2
Output of ifconfig -a
br-lan Link encap:Ethernet HWaddr 64:66:B3:C6:FC:82
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:534 errors:0 dropped:8 overruns:0 frame:0
TX packets:458 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:97412 (95.1 KiB) TX bytes:105023 (102.5 KiB)
eth0 Link encap:Ethernet HWaddr 64:66:B3:C6:FC:82
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1495490 errors:0 dropped:13 overruns:0 frame:0
TX packets:259329 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:500056893 (476.8 MiB) TX bytes:220075895 (209.8 MiB)
Interrupt:4
eth0.1 Link encap:Ethernet HWaddr 64:66:B3:C6:FC:82
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:407 errors:0 dropped:0 overruns:0 frame:0
TX packets:353 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:77176 (75.3 KiB) TX bytes:81768 (79.8 KiB)
eth0.2 Link encap:Ethernet HWaddr 64:66:B3:C6:FC:82
inet addr:x.x.x.x Bcast:x.x.x.255 Mask:255.255.254.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3090 errors:0 dropped:1098 overruns:0 frame:0
TX packets:527 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:419453 (409.6 KiB) TX bytes:104348 (101.9 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:26 errors:0 dropped:0 overruns:0 frame:0
TX packets:26 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2549 (2.4 KiB) TX bytes:2549 (2.4 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.2 P-t-P:10.8.0.2 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
wlan0 Link encap:Ethernet HWaddr 64:66:B3:C6:FC:83
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:130 errors:0 dropped:0 overruns:0 frame:0
TX packets:131 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:22234 (21.7 KiB) TX bytes:28345 (27.6 KiB)
wlan1 Link encap:Ethernet HWaddr 64:66:B3:C6:FC:84
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:620 (620.0 B)
Part of output of ip route on the VPN server (attached VPN route, manually added route to my LAN):
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
192.168.1.0/24 via 10.8.0.2 dev tun0
I have absolutely no clue about iptables, so this is the best I can do.
Best Answer
I ran into this issue myself. So far, I've only gotten it so I can ping VPN machines from LAN. I did this by using a similar configuration to you except I set the VPN zone's Forward to ACCEPT instead of REJECT.
Setting the LAN zone's Forward to ACCEPT doesn't change anything for me.
As a side note, you have two
wanzones in your config file which are exactly the same.