[James2k]

1. Yes, either example should go in the additional config section.

2. vpn_gateway is a variable for the VPN network within OpenVPN. Its not meant to be a placeholder it will be parsed by OpenVPN as a variable.

3. Yes, there would already be a route setup for the tun1 interface, you are just doing the routing rules within OpenVPN itself.

Because you are running route-nopull, you essentially have the VPN tunnel active but no traffic will use it, unless explicitly told to.

[mkaand]

Sorry for my serial posts. You're the man. Looks like you fixed the problem. What I did:

I removed my ip routes from startup.
I added all these lines to Additional Config field.
Reboot router.

[James2k]

No worries! Hopefully that should be more stable for you.

Even if OpenVPN disconnects, the changes should keep your specific routing rules in place and automatically re-establish the connection to the tunnel if it drops.

If you do still get disconnects you might want to investigate that further, maybe add a higher logging level like verb 5, to see whats going on in the logs.

[mkaand]

Thank you very much James. I don't think I'll see any problem in the future. Looks fixed as you said. Even if it drops your code adds routes again. I use my WRT1900AC v1 as a VPN Server. Kong's Build is very nice. I don't want to try other builds. My build is very stable.

I can connect to my home via my iPhone thru SoftEtherVPN
My garden IP Camera connects thru OpenVPN Server
I have access for some websites thats normally my ISP blocks (pandora.com, wikipedia.org etc) via OpenVPNClient
I use Recursive DNS (My internet connection secure)
I use ADBlock Plus filters on my Privoxy (same router)

As you see lots of thing working on this great router. Maybe you like my solution for Recursive DNS Resolution with DNSMasq. Check it:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=309795&highlight=

[mkaand]

James, I think my problem is still continue. IP route and VPN connection is OK but sometimes it drops and I do not have access to pandora.com and wikipedia.org even I can see the correct IP Routes. Here is the client log:

Clientlog:
19700101 03:00:37 W WARNING: file '/tmp/openvpncl/credentials' is group or others accessible
19700101 03:00:37 I OpenVPN 2.4.0 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jan 8 2017
19700101 03:00:37 I library versions: OpenSSL 1.0.2h 3 May 2016 LZO 2.09
19700101 03:00:37 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:16
19700101 03:00:37 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
19700101 03:00:37 W WARNING: Your certificate is not yet valid!
20170717 23:00:01 N RESOLVE: Cannot resolve host address: us1.vpnbook.com:25000 (Try again)
20170717 23:00:03 Socket Buffers: R=[180224->180224] S=[180224->180224]
20170717 23:00:03 I UDPv4 link local: (not bound)
20170717 23:00:03 I UDPv4 link remote: [AF_INET]198.7.62.204:25000
20170717 23:00:04 TLS: Initial packet from [AF_INET]198.7.62.204:25000 sid=67783fb5 12094186
20170717 23:00:04 W WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
20170717 23:00:05 VERIFY OK: depth=1 C=CH ST=Zurich L=Zurich O=vpnbook.com OU=IT CN=vpnbook.com name=vpnbook.com emailAddress=admin@vpnbook.com
20170717 23:00:05 VERIFY OK: nsCertType=SERVER
20170717 23:00:05 VERIFY OK: depth=0 C=CH ST=Zurich L=Zurich O=vpnbook.com OU=IT CN=vpnbook.com name=vpnbook.com emailAddress=admin@vpnbook.com
20170717 23:00:09 NOTE: --mute triggered...
20170717 23:00:09 1 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:00:09 I [vpnbook.com] Peer Connection Initiated with [AF_INET]198.7.62.204:25000
20170717 23:00:10 SENT CONTROL [vpnbook.com]: 'PUSH_REQUEST' (status=1)
20170717 23:00:11 PUSH: Received control message: 'PUSH_REPLY redirect-gateway def1 dhcp-option DNS 8.8.8.8 dhcp-option DNS 91.239.100.100 route 10.10.0.1 topology net30 ping 5 ping-restart 30 ifconfig 10.10.0.6 10.10.0.5'
20170717 23:00:11 N Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
20170717 23:00:11 N Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
20170717 23:00:11 N Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
20170717 23:00:11 NOTE: --mute triggered...
20170717 23:00:11 1 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:00:11 OPTIONS IMPORT: timers and/or timeouts modified
20170717 23:00:11 OPTIONS IMPORT: --ifconfig/up options modified
20170717 23:00:11 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
20170717 23:00:11 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
20170717 23:00:11 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
20170717 23:00:11 NOTE: --mute triggered...
20170717 23:00:11 1 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:00:11 I TUN/TAP device tun1 opened
20170717 23:00:11 TUN/TAP TX queue length set to 100
20170717 23:00:11 D do_ifconfig tt->did_ifconfig_ipv6_setup=0
20170717 23:00:11 I /sbin/ifconfig tun1 10.10.0.6 pointopoint 10.10.0.5 mtu 1500
20170717 23:00:11 /sbin/route add -net 208.85.40.0 netmask 255.255.255.0 gw 10.10.0.5
20170717 23:00:11 /sbin/route add -net 198.35.26.0 netmask 255.255.254.0 gw 10.10.0.5
20170717 23:00:11 I Initialization Sequence Completed
20170717 23:05:09 TLS: soft reset sec=0 bytes=9843/-1 pkts=128/0
20170717 23:06:05 VERIFY OK: depth=1 C=CH ST=Zurich L=Zurich O=vpnbook.com OU=IT CN=vpnbook.com name=vpnbook.com emailAddress=admin@vpnbook.com
20170717 23:06:05 VERIFY OK: nsCertType=SERVER
20170717 23:06:05 NOTE: --mute triggered...
20170717 23:06:10 1 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:06:10 N TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20170717 23:06:10 N TLS Error: TLS handshake failed
20170717 23:06:10 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
20170717 23:06:24 TLS: Initial packet from [AF_INET]198.7.62.204:25000 sid=9e91e8b0 f4ce39ab
20170717 23:06:31 VERIFY OK: depth=1 C=CH ST=Zurich L=Zurich O=vpnbook.com OU=IT CN=vpnbook.com name=vpnbook.com emailAddress=admin@vpnbook.com
20170717 23:06:31 NOTE: --mute triggered...
20170717 23:07:02 8 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:07:02 I [vpnbook.com] Inactivity timeout (--ping-restart) restarting
20170717 23:07:02 I SIGUSR1[soft ping-restart] received process restarting
20170717 23:07:02 Restart pause 5 second(s)
20170717 23:07:07 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20170717 23:07:07 I TCP/UDP: Preserving recently used remote address: [AF_INET]198.7.62.204:25000
20170717 23:07:07 Socket Buffers: R=[180224->180224] S=[180224->180224]
20170717 23:07:07 I UDPv4 link local: (not bound)
20170717 23:07:07 I UDPv4 link remote: [AF_INET]198.7.62.204:25000
20170717 23:07:07 TLS: Initial packet from [AF_INET]198.7.62.204:25000 sid=d6391194 b276c04f
20170717 23:07:14 VERIFY OK: depth=1 C=CH ST=Zurich L=Zurich O=vpnbook.com OU=IT CN=vpnbook.com name=vpnbook.com emailAddress=admin@vpnbook.com
20170717 23:07:14 VERIFY OK: nsCertType=SERVER
20170717 23:07:14 NOTE: --mute triggered...
20170717 23:07:14 2 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:07:14 I [vpnbook.com] Peer Connection Initiated with [AF_INET]198.7.62.204:25000
20170717 23:07:15 SENT CONTROL [vpnbook.com]: 'PUSH_REQUEST' (status=1)
20170717 23:07:15 PUSH: Received control message: 'PUSH_REPLY redirect-gateway def1 dhcp-option DNS 8.8.8.8 dhcp-option DNS 91.239.100.100 route 10.10.0.1 topology net30 ping 5 ping-restart 30 ifconfig 10.10.0.114 10.10.0.113'
20170717 23:07:15 N Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
20170717 23:07:15 N Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
20170717 23:07:15 N Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
20170717 23:07:15 NOTE: --mute triggered...
20170717 23:07:15 1 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:07:15 OPTIONS IMPORT: timers and/or timeouts modified
20170717 23:07:15 OPTIONS IMPORT: --ifconfig/up options modified
20170717 23:07:15 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
20170717 23:07:15 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
20170717 23:07:15 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
20170717 23:07:15 NOTE: --mute triggered...
20170717 23:07:15 1 variation(s) on previous 3 message(s) suppressed by --mute
20170717 23:07:15 I Preserving previous TUN/TAP instance: tun1
20170717 23:07:15 I Initialization Sequence Completed
20170717 23:12:14 TLS: soft reset sec=0 bytes=8165/-1 pkts=99/0
20170717 23:12:19 VERIFY OK: depth=1 C=CH ST=Zurich L=Zurich O=vpnbook.com OU=IT CN=vpnbook.com name=vpnbook.com emailAddress=admin@vpnbook.com
20170717 23:12:19 VERIFY OK: nsCertType=SERVER
20170717 23:12:19 NOTE: --mute triggered...
20170718 02:33:22 357 variation(s) on previous 3 message(s) suppressed by --mute
20170718 02:33:22 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20170718 02:33:22 D MANAGEMENT: CMD 'state'
20170718 02:33:22 MANAGEMENT: Client disconnected
20170718 02:33:22 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20170718 02:33:22 D MANAGEMENT: CMD 'state'
20170718 02:33:22 MANAGEMENT: Client disconnected
20170718 02:33:22 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20170718 02:33:22 D MANAGEMENT: CMD 'state'
20170718 02:33:22 MANAGEMENT: Client disconnected
20170718 02:33:23 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20170718 02:33:23 D MANAGEMENT: CMD 'status 2'
20170718 02:33:23 MANAGEMENT: Client disconnected
20170718 02:33:23 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20170718 02:33:23 D MANAGEMENT: CMD 'log 500'

[James2k]

[mkaand]

Hello James, my NTP settings and my router time correct. I am make sure. But I discovered when I copy paste your code from forum, the forum php script adds space char (whitespace) to end of each line. I delete these lines and reboot my router again. I am testing now. IF it is fail again. I delete your code but I will keep your ROUTE settings. Maybe it can fix my problem. I'll let you know.

[mkaand]

During the last 14 hours, your code works perfectly. I believe I made a mistake when I copy paste your code. AS I said forum adds whitespace each line. Still I am testing. IT supposed to be fail during 14 hours. I will wait more. Currently I have access pandora and wikipedia thru VPN.

[mkaand]

Hi James,

I am still struggling with Open VPN. I will share my Client log with you. Can you help me? First everything is OK but after sometimes I do not have access to pandora.com and wikipedia.org (I should able to access ONLY these websites via OpenVPN) After your modification my ip route always correct but still I have a problem. If I stopservice openvpn it tells me error about NAT, I re-run stopservice than I can stop the OpenVPN. Looks like this is related with DNS I guess or gateway. Only way to use OpenVPN reboot my router.

Here is the log:

[mkaand]

Maybe related with this: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=310247

[mkaand]

James, my problem related with my DNS modifications (Ubound and DNSMasq)

As I said before here is the my startup script:

[mkaand]

I found these lines in /tmp/openvpncl/route-up.sh folder. This explain why I cannot able to access pandora.com and wikipedia.org after re-connect. Looks like this is related with dnsmasq. And I modified my dnsmasq options. Please check my previous post.

[mkaand]

I created following custom.sh script:

[James2k]

Hi,

Sorry for not responding. Admittedly, your setup does seem quite bespoke, so its difficult to know where the issue is.

You'll want to potentially investigate why the VPN tunnel is not stable and keeps dropping. Adding higher verb logging on OpenVPN might reveal more clues, if its still not resolved.

[mkaand]