Running Two Instances of OpenVPN for UDP & TCP

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
RickNY
DD-WRT Novice


Joined: 31 Aug 2007
Posts: 4

PostPosted: Sun Nov 09, 2008 3:48    Post subject: Running Two Instances of OpenVPN for UDP & TCP Reply with quote
I edited this post to include my solution.. The original message with my problem is at the bottom of this.. I *think* I got this figured out and running now.. This was done on a Buffalo WHR-G125 running DD-WRT v24-sp2 (10/29/08) vpn - build 10690. This was the goal: To have OpenVPN running and capable of accepting connections via either UDP or TCP depending on where I was connecting from. To do so would require separate instances of OpenVPN. If I connect to the VPN from work, it requires I go through a Squid proxy - which needs to run over TCP.. Most other places I can get away with using it over UDP, which I prefer. Originally, I needed to run it on Port 443 because at school, the only thing open is 80 & 443.. At work, if I go through 80 or 443, it needs to pass through the Squid proxy.. I havent confirmed yet, but I may be able to pass it through 1194 from work without the need for the proxy -- I'll test it Monday. If that works, then what it comes down to is me needing to have OpenVPN listen on both 443 and 1194 with separate instances..

I am using a routed setup for both instances.. I wanted to redirect everything through the VPN when it was in use. I can access my Windows files at home by adding a hosts entry to my client machine (for convenience -- I could also access via its LAN IP), and I have Internet access through the VPN.

This is how I did it:

LAN Network: 192.168.32.0
VPN Network: 10.32.71.0 (TCP) & 10.77.77.0 (UDP)
Setup keys, etc..


First, in GUI, I setup OpenVPN Daemon:

OpenVPN GUI Config:
    port 443
    proto tcp-server
    dev tun0
    cipher AES-256-CBC
    comp-lzo
    dh /tmp/openvpn/dh.pem
    ca /tmp/openvpn/ca.crt
    cert /tmp/openvpn/cert.pem
    key /tmp/openvpn/key.pem
    tls-auth /tmp/openvpn/ta.key 0
    server 10.32.71.0 255.255.255.0
    client-to-client
    keepalive 10 120
    push "route 192.168.32.0 255.255.255.0"
    push "redirect-gateway"
    push "dhcp-option DNS 208.67.222.222"
    push "dhcp-option DNS 208.67.220.220"
    persist-key
    persist-tun
    verb 5

client1.ovpn (TCP)
    remote my.server.address 443
    client
    proto tcp-client
    dev tun0
    comp-lzo
    resolv-retry infinite
    nobind
    float
    persist-key
    persist-tun
    ns-cert-type server
    verb 3
    cipher AES-256-CBC
    ca ca.crt
    cert client1.crt
    key client1.key
    tls-auth ta.key 1
    ping 10
    ping-restart 60


Then, I entered the following in my Startup command window to create the 2nd instance.. The sleep commands I had to play around with to account for the openvpn directory to be created and populated with my keys from the GUI..:

Startup
    openvpn --mktun --dev tun1
    sleep 10
    echo "
    port 1194
    proto udp
    dev tun1
    cipher AES-256-CBC
    comp-lzo
    dh /tmp/openvpn/dh.pem
    ca /tmp/openvpn/ca.crt
    cert /tmp/openvpn/cert.pem
    key /tmp/openvpn/key.pem
    tls-auth /tmp/openvpn/ta.key 0
    server 10.71.71.0 255.255.255.0
    client-to-client
    keepalive 10 120
    push "route 192.168.32.0 255.255.255.0"
    push "redirect-gateway"
    push "dhcp-option DNS 208.67.222.222"
    push "dhcp-option DNS 208.67.220.220"
    persist-key
    persist-tun
    verb 5
    " > /tmp/openvpn-udp.conf

    sleep 5

    /usr/sbin/openvpn --daemon --config /tmp/openvpn-udp.conf

... and created a 2nd client file:
client1-udp.ovpn
    remote my.server.address 1194
    client
    proto udp
    dev tun0
    comp-lzo
    resolv-retry infinite
    nobind
    float
    persist-key
    persist-tun
    ns-cert-type server
    verb 3
    cipher AES-256-CBC
    ca ca.crt
    cert client1.crt
    key client1.key
    tls-auth ta.key 1
    ping 10
    ping-restart 60


Finally, I added the following firewall rules:

Firewall
    iptables -I INPUT -p tcp --dport 443 -j ACCEPT
    iptables -I INPUT -p udp --dport 1194 -j ACCEPT
    iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
    iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
    iptables -I FORWARD 1 --source 10.32.71.0/24 -j ACCEPT
    iptables -I FORWARD 1 --source 10.71.71.0/24 -j ACCEPT


Everything seems to be working OK.. Does anyone see anything here that may be a problem?

Hope it helps anyone that was thinking of doing the same..

Rick


My original message was:

I have DD-WRT set up on my gateway WHR-G125.. I have a second WRT54G also with DD-WRT that sits on the LAN as a switch.. My gateway router is set up to handle OpenVPN via TCP for when I am accessing wireless networks that require a proxy.. I would like to know if it is possible to somehow set up the 2nd WRT54G to run its own instance of OpenVPN to handle UDP connections when I dont need to go through a proxy server.

If thats not possible, is it possible to run 2 instances of OpenVPN on the gateway? I suspect not.

Thanks,
Rick


Last edited by RickNY on Tue Nov 18, 2008 21:31; edited 2 times in total
Sponsor
spanman
DD-WRT User


Joined: 27 Sep 2008
Posts: 446
Location: Port Of Spain

PostPosted: Sat Nov 15, 2008 11:23    Post subject: Reply with quote
I tried your setup, this is not working for me.
RickNY
DD-WRT Novice


Joined: 31 Aug 2007
Posts: 4

PostPosted: Sat Nov 15, 2008 14:51    Post subject: Reply with quote
spanman wrote:
I tried your setup, this is not working for me.


Did you get just one working first? I got the first one set up via the GUI and actually working before I moved on to the other one.. Also, at one point in the very beginning, I realized I needed to do a 30-30-30 reset on the device because it just was not working at all..

How far are you getting?
spanman
DD-WRT User


Joined: 27 Sep 2008
Posts: 446
Location: Port Of Spain

PostPosted: Sat Nov 15, 2008 22:58    Post subject: Reply with quote
I did a 30/30/30 reset. The first openvpn is running and i can connect with it (this is the one on tcp 443 in GUI) however the second one does not connect , i get an error saying READ UDPV4"connection reset by peer {WSAECONNRESET} {CODE 10054}.
Looking at it i dont think you can run 2 instances of openvpn, also why does the startup have tun1 and the client config for it has tun0, that really don;t make any sence to me even though i dont know much about openvpn.
spanman
DD-WRT User


Joined: 27 Sep 2008
Posts: 446
Location: Port Of Spain

PostPosted: Mon Nov 17, 2008 21:46    Post subject: Reply with quote
I changed my statup script to this and now it works great. Maybe you can try it and see if it works for you also. Then maybe the Guru's can have a look at it to see if everything is ok with the setup then they can make it a sticky for those who want to run openvpn on 2 ports. Can you change the subject of this topic to (OPENVPN ON 2 SEPERATE PORTS 1194 & 443)or something like that so people can come in and view it?

my startup

# Move to writable directory and create scripts
cd /tmp
ln -s /usr/sbin/openvpn /tmp/myvpn

# Config
echo "
proto udp
port 1194
dev tun1
cipher AES-256-CBC
comp-lzo
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
tls-auth /tmp/openvpn/ta.key 0
server 10.71.71.0 255.255.255.0
client-to-client
keepalive 10 120
push "route 192.168.32.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
persist-key
persist-tun
verb 5
daemon
" > openvpn-udp.conf

# Create interfaces
/tmp/myvpn --mktun --dev tun1

# Initiate the tunnel
sleep 5
/tmp/myvpn --config openvpn-udp.conf
omostan
DD-WRT Novice


Joined: 10 Jun 2009
Posts: 10

PostPosted: Sat Jun 13, 2009 7:58    Post subject: I succeded in setting my server up and worked but... Reply with quote
First of all thanks for sharing your ideas with others. This is what I have been looking for!

I succeded in setting up my server just like Rick's initial configuration. The edited startup script was not able to bring up the udp-client, so I switched back to Rick's startup script and both worked but...

This was ONLY for a while. Though the udp-client still work very fine, the tcp-client doesn't. Initially both were working very fine with slow pace on the tcp-client. When I checked the process then, there were two processes registered for openvpn.

Now that only one is working, the server does not start the tcp-client process. I can only see the udp-client process. I have rebooted the router (WRT54GL v1.1) several times to no avail.

Any help will be appreciated. Thanks!
omostan
DD-WRT Novice


Joined: 10 Jun 2009
Posts: 10

PostPosted: Thu Mar 26, 2015 9:49    Post subject: Reply with quote
After two years, I can see that nobody posted any reply to my request above. So, I've decided to post the final solution to my problem here. Below is my startup script to setup the UDP protocol for the second instance of OpenVPN I run on my network router.

====================== BEGIN STARTUP =======================

# Move to writable directory and create scripts
cd /tmp
ln -s /usr/sbin/openvpn /tmp/openvpn-udp

# Config
echo "
proto udp
port 1194
dev tun1
cipher AES-256-CBC
comp-lzo
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
tls-auth /tmp/openvpn/ta.key 0
server 10.71.71.0 255.255.255.0
client-to-client
keepalive 10 120
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
persist-key
persist-tun
verb 5
daemon
" > openvpn-udp.conf

# Create interfaces
/tmp/myvpn --mktun --dev tun1

# Initiate the tunnel
sleep 5
/tmp/openvpn-udp --daemon --config openvpn-udp.conf

# TCP OpenVPN Startup
sleep 15
cd /tmp/openvpn/
openvpn --daemon --config openvpn.conf

====================== END STARTUP ========================

The important (different from above configuration) part is:

# TCP OpenVPN Startup
sleep 15
cd /tmp/openvpn/
openvpn --daemon --config openvpn.conf

Setting a delay before starting the OpenVPN daemon ensures that both instances are started properly.
dapupster
DD-WRT Novice


Joined: 09 Jun 2008
Posts: 13

PostPosted: Wed Nov 25, 2015 7:29    Post subject: bumping this... Reply with quote
I'm trying to set up a separate instance of OPENWRT on my DDWRT router but am having problems getting the second instance/interface running. Any ideas?

I am running the following firmware:

DD-WRT v24-sp2 (02/26/15) kongac
(SVN revision 26365M)

I looked at this thread as well as the thread here:

https://forums.openvpn.net/topic13032.html

Here are the details of my config:

I have 2 routers, both w/ DDWRT. One is the server. The other is the client, and both routers are bridged using TAP0 on port 1194. The LAN is 192.168.2.x with 192.168.2.1 being the router itself.

Unfortunately, my iPhone will NOT dial into the OPENVPN server on my router since it's configured in TAP mode. I am apparently forced to use TUN.

I tried to just create a new instance linked to the openvpn binary ("myvpn2") with a corresponding new configuration file. However, when I run IPCONFIG after sshing into the router, I don't see the TUN1 interface appearing at all. I do see the TAP0 interface, and it's running fine.

Here's a copy of my STARTUP commands. Please note that I am not using the VPN GUI. I was hoping to just have everything running from the startup commands.

I'm guessing that it's okay for the TAP0 interface to be on the 192.168.2.x network, but I'm guessing that the TUN1 needs to be on its own separate network which would then be routed. I'm not sure how to do this, though.


===BEGIN STARTUP COMMANDS===

cd /tmp
openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up




echo "
# Tunnel options
mode server # Set OpenVPN major mode
proto udp # Setup the protocol (server)
port 1194 # TCP/UDP port number
dev tap0 # TUN/TAP virtual network device
keepalive 15 60 # Simplify the expression of --ping
daemon # Become a daemon after all initialization
verb 3 # Set output verbosity to n
comp-lzo # Use fast LZO compression

# OpenVPN server mode options
client-to-client # tells OpenVPN to internally route client-to-client traffic
duplicate-cn # Allow multiple clients with the same common name

# TLS Mode Options
tls-server # Enable TLS and assume server role during TLS handshake
ca ca.crt # Certificate authority (CA) file
dh dh1024.pem # File containing Diffie Hellman parameters
cert server.crt # Local peer's signed certificate
key server.key # Local peer's private key
" > openvpn.conf




echo "
# Tunnel options
mode server # Set OpenVPN major mode
proto udp # Setup the protocol (server)
port 21194 # TCP/UDP port number
dev tun1 # TUN/TAP virtual network device
keepalive 15 60 # Simplify the expression of --ping
daemon # Become a daemon after all initialization
verb 3 # Set output verbosity to n
comp-lzo # Use fast LZO compression

# OpenVPN server mode options
client-to-client # tells OpenVPN to internally route client-to-client traffic
duplicate-cn # Allow multiple clients with the same common name

# TLS Mode Options
tls-server # Enable TLS and assume server role during TLS handshake
ca ca.crt # Certificate authority (CA) file
dh dh1024.pem # File containing Diffie Hellman parameters
cert server.crt # Local peer's signed certificate
key server.key # Local peer's private key
" > openvpn2.conf



echo "
-----BEGIN CERTIFICATE-----
(erased)
-----END CERTIFICATE-----
" > ca.crt

echo "
-----BEGIN RSA PRIVATE KEY-----
(erased)
-----END RSA PRIVATE KEY-----
" > server.key

chmod 600 server.key
echo "
-----BEGIN CERTIFICATE-----
(erased)
-----END CERTIFICATE-----
" > server.crt

echo "
-----BEGIN DH PARAMETERS-----
(erased)
-----END DH PARAMETERS-----
" > dh1024.pem

sleep 5
ln -s /usr/sbin/openvpn /tmp/myvpn
/tmp/myvpn --config openvpn.conf


ln -s /usr/sbin/openvpn /tmp/myvpn2

/tmp/myvpn2 --mktun --dev tun1

sleep 5
/tmp/myvpn2 --config openvpn2.conf




route add -net 192.168.2.0/24 dev br0

# Ban DHCP traffic from the bridge so DHCP servers do not conflict

echo "begin-base64 644 -" > /tmp/ebt_ip.o.gz.u64
echo "H4sIADwAAAACA5VWz28bVRD+dteON20KG9eq3BJUB21UVy1m2+RQRCO5cX5w" >> /tmp/ebt_ip.o.gz.u64
echo "yMGHHpAQcr32Eq9wHMveIFAPNSkHDq7wIb1H5R+p0gpx7J8QtaH8EBfuSGbm" >> /tmp/ebt_ip.o.gz.u64
echo "vbdh8whEHelp9ps3883Mm/ecPFhZXzUMA7EYsPEPAv5Ikc1BdUGgIt7CWSQl" >> /tmp/ebt_ip.o.gz.u64
echo "i5ejFJY8B2VntjrAecIFPByyLUM2B4cjA43RGDveN6g4HJMD7CxeH9nvo5KT" >> /tmp/ebt_ip.o.gz.u64
echo "XK9HNva9KsUxPo/fiKvyyMZ7N5hrmrgmVUxHcV0hrmm8OrK3FBfbJmC6FnyK" >> /tmp/ebt_ip.o.gz.u64
echo "M92P4At7AUuPBsRZwHMPWBq+TXUOHBN5DJzZsg8T5uM8DnfHqHi4ZMHMmpjL" >> /tmp/ebt_ip.o.gz.u64
echo "+7hWaCKNQW62CFzCy91rTgUW1VSg2gykXdZpwgae3FpDWeRap9oc6qeCPYH5" >> /tmp/ebt_ip.o.gz.u64
echo "+6LqDZQnd0qeCyqPqWI4D5+vQzXHua6rXBvqTIsqlzzffS9LfiZpORc+y8Oh" >> /tmp/ebt_ip.o.gz.u64
echo "oWYD/Dycgj90nWXqaUXkuE887B/bc1gRfGzL8YwdiBmniIf5TMU1hV+GjohZ" >> /tmp/ebt_ip.o.gz.u64
echo "QwbLgsvGgcX+sd1K2A2aCe/xtzybH76fIdsNmtPv47Rr49muTfh9NbcU9kXd" >> /tmp/ebt_ip.o.gz.u64
echo "V1W/WboLT8lvjIee6wR0ZtLOtbnOipgN4x8pBfN58L0zYl47Xh73HLbpdyR7" >> /tmp/ebt_ip.o.gz.u64
echo "dEd21N1l31e78bwpXtTmqP14RjnyUXMS+2yXve9x5beBi7Q+vGKjQL1+655s" >> /tmp/ebt_ip.o.gz.u64
echo "Oy5hF6fKx+a/bX9l8ARvIO/SuvwfXMn9gvX/+wun7LfDRtDpB4tr1XV8EfQ6" >> /tmp/ebt_ip.o.gz.u64
echo "Qbv2ZdDrh1udxZulhdK8x86l/tebUd0nHfWkbsVfvaBdioKvIvnVrEd1lPx+" >> /tmp/ebt_ip.o.gz.u64
echo "n+FG2Pl8S9q7zR5Km83A394o1f1w/iahrabYfwO5LN4aMKFwmVY10Z96wHiH" >> /tmp/ebt_ip.o.gz.u64
echo "1mQi7hMb4LFNqfiUuOvAVYVjipElOXW+OY3vJwrOKz4rwfeB0jHfC+3sY74F" >> /tmp/ebt_ip.o.gz.u64
echo "2UPXTPjlE37Mx/iOqi+WX8lvoPmxLGr1Hdj8VmR9mUR9qxpfK3W8vnjvrvo2" >> /tmp/ebt_ip.o.gz.u64
echo "E37uCXmnE72y0B8XfHYCX5KLZYaKOiB9TtWdUmczqfHRm8GnJ/DpYhyr7c9x" >> /tmp/ebt_ip.o.gz.u64
echo "cs/SoixYGk5reFLDZzQ8oeGM8OB3mBO/fwb99sh3F+M57Q7Ma3hVvyOBH9XC" >> /tmp/ebt_ip.o.gz.u64
echo "bqmBsBNGNXop2+0AjXZQ72x3Y1irRa2wHyOO4BfXj4JebbMeNVrCtN3RjOLu" >> /tmp/ebt_ip.o.gz.u64
echo "pUx5j1jPGFJ/p/QLpfdMqelHGGm6SEXSE1OyzzQtjzGtW4xpkLcZn5N98/6y" >> /tmp/ebt_ip.o.gz.u64
echo "2i/y7InnutKc31T/qjAuKF1W+p7SfwMbOFhxAAkAAA==" >> /tmp/ebt_ip.o.gz.u64
echo "====" >> /tmp/ebt_ip.o.gz.u64
uudecode /tmp/ebt_ip.o.gz.u64 | gunzip -cd > /tmp/ebt_ip.o

sleep 15 ; insmod ebtables ; insmod ebtable_filter ; insmod /tmp/ebt_ip.o &
sleep 25 ; ebtables -I INPUT -i tap0 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP &
sleep 5 ; ebtables -I OUTPUT -o tap0 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP &

sleep 25 ; ebtables -I INPUT -i tun1 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP &
sleep 5 ; ebtables -I OUTPUT -o tun1 -p IPv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP &



===END STARTUP COMMANDS===



===BEGIN FIREWALL COMMANDS===
/usr/sbin/iptables -I INPUT -p udp --dport 1194 -j ACCEPT
/usr/sbin/iptables -I INPUT -p udp --dport 21194 -j ACCEPT

/usr/sbin/iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
/usr/sbin/iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
/usr/sbin/iptables -I FORWARD -i br1 -o br0 -m state --state NEW -j DROP

/usr/sbin/iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
/usr/sbin/iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
===END FIREWALL COMMANDS===
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum