maemo.org - Talk - OpenVPN routing problem on N900

maemo.org - Talk (https://talk.maemo.org/index.php)

- Applications (https://talk.maemo.org/forumdisplay.php?f=41)

- - OpenVPN routing problem on N900 (https://talk.maemo.org/showthread.php?t=38008)

gregc2009

2009-12-21 19:17

OpenVPN routing problem on N900

I have OpenVPN installed and working on tomato flashed router using a static key and tap. I'm using a win xp laptop successfully with this setup.

I wanted to try and get the N900 to work with it as well. It installed OpenVPN and the applet fine. When I run the test, it all looks good. When I connect, it looks good too except the routing through the vpn doesn't work. I am not familiar enough with this stuff to understand why though.

Here is the config:

Code:

   remote MY.STATIC.SERVER.IP

   port 1194

   dev tap

   secret static.key

   proto udp

   comp-lzo

   route-gateway 192.168.0.100

   redirect-gateway

Here is the test output:

Code:

Mon Dec 21 11:09:52 2009 OpenVPN 2.1_rc20 arm-unknown-linux-gnueabi [SSL] [LZO2] [EPOLL] [MH] [PF_INET6] built on Nov 29 2009

Mon Dec 21 11:09:52 2009 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables

Mon Dec 21 11:09:52 2009 /usr/sbin/openvpn-vulnkey -q static.key

Mon Dec 21 11:09:52 2009 ******* WARNING *******: 'static.key' cannot be verified as a non-vulnerable key. See 'man openvpn-vulnkey' for details.

Mon Dec 21 11:09:52 2009 Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key

Mon Dec 21 11:09:52 2009 Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon Dec 21 11:09:52 2009 Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key

Mon Dec 21 11:09:52 2009 Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon Dec 21 11:09:52 2009 LZO compression initialized

Mon Dec 21 11:09:52 2009 ROUTE: default_gateway=UNDEF

Mon Dec 21 11:09:52 2009 TUN/TAP device tap0 opened

Mon Dec 21 11:09:52 2009 TUN/TAP TX queue length set to 100

Mon Dec 21 11:09:52 2009 NOTE: unable to redirect default gateway -- Cannot read current default gateway from system

Mon Dec 21 11:09:52 2009 Data Channel MTU parms [ L:1577 D:1450 EF:45 EB:135 ET:32 EL:0 AF:3/1 ]

Mon Dec 21 11:09:52 2009 Local Options hash (VER=V4): '83c3b015'

Mon Dec 21 11:09:52 2009 Expected Remote Options hash (VER=V4): '83c3b015'

Mon Dec 21 11:09:52 2009 Socket Buffers: R=[65536->131072] S=[16384->131072]

Mon Dec 21 11:09:52 2009 UDPv4 link local (bound): [undef]

Mon Dec 21 11:09:52 2009 UDPv4 link remote: [AF_INET]MY.STATIC.SERVER.IP

Any help is greatly appreciated.

- Greg

mikkov

2009-12-21 19:25

Re: OpenVPN routing problem on N900

>Mon Dec 21 11:09:52 2009 NOTE: unable to redirect default gateway -- Cannot read current default gateway from system

redirect-gateway doesn't work when cellular (3g/gprs) connection is used. Reason is stated in above error message

gregc2009

2009-12-21 21:08

Re: OpenVPN routing problem on N900

Is this a software limitation? Any way around it? I'm posting this on my computer that is using the N900 as a modem on GSM through a VPN to our work without any issues.

mikkov

2009-12-21 21:20

Re: OpenVPN routing problem on N900

It is because how network interfaces are setup on N900, so you could say it's a software limitation.

There may be workaround for it, see http://talk.maemo.org/showthread.php...hlight=openvpn (actually these threads should be merged)

alphazo

2010-02-10 17:14

Re: OpenVPN routing problem on N900

Workaround (script) found here works just fine:
https://bugs.maemo.org/show_bug.cgi?id=7596#c9

- Copied the script to /etc/openvpn
- Added

Code:

script-security 2

ipchange /etc/openvpn/add_default_route.sh

to my openvpn config file and all traffic was tunneled (tested with Wireshark). BTW, there is one last thing I had to do in order to get DNS resolution, I had to add

Code:

nameserver 192.168.0.254

Where 192.168.0.254 is the address of my router at home to either /var/run/resolv.conf.gprs or /var/run/resolv.conf.wlan0 depending of the connection.

To automate that process I simply added the following to the workaround script found up there:

Code:

if [ -f /var/run/resolv.conf.gprs ];

then

  echo "nameserver 192.168.0.254" >> /var/run/resolv.conf.gprs

fi

if [ -f /var/run/resolv.conf.wlan0 ];

then

  echo "nameserver 192.168.0.254" >> /var/run/resolv.conf.wlan0

fi

As a side note here are the special options I have enabled in my openvpn config:

Code:

push "route 192.168.0.0 255.255.255.0"

push "redirect-gateway def1"

push "dhcp-option DNS 192.168.0.254"

:) I now have OpenVPN working on both Wifi and Gprs with full internet traffic routed through the tunnel... cool!

lbt	2010-02-22 15:51

Re: OpenVPN routing problem on N900

Just checking that you guys know what the "redirect-gateway" option does?

It replaces the default gateway on the client/device and makes *all* your network traffic from the client/device go via the (slow) VPN.

So if you are just using a VPN to allow access to machines on a private LAN then you probably don't want it.

alphazo

2010-02-22 16:52

Re: OpenVPN routing problem on N900

Yep.. that was the intended purpose especially when browsing the web from untrusted locations such as public WiFi hot spots.

As a side note, if you use password protected certificates you will have to add

Code:

askpass

to the OpenVPN config file in order to get prompted for your password by OpenVPN-gui applet (very convenient).

Alphazo

mr.zoom

2010-05-07 12:17

Re: OpenVPN routing problem on N900

I added to the openvpn client config file the following 3 lines:

script-security 2
up /etc/openvpn/maemo-update-resolvconf
down /etc/openvpn/maemo-update-resolvconf

The script maemo-update-resolvconf existed already.
This works for me very fine with wlan and gprs/umts.

Cheers

mr.zoom

Davey101

2010-05-18 11:53

Re: OpenVPN routing problem on N900

Quote:

Originally Posted by mr.zoom (Post 647952)

I added to the openvpn client config file the following 3 lines:

script-security 2
up /etc/openvpn/maemo-update-resolvconf
down /etc/openvpn/maemo-update-resolvconf

The script maemo-update-resolvconf existed already.
This works for me very fine with wlan and gprs/umts.

Cheers

mr.zoom

What does this addition do?

Thanks

mr.zoom

2010-05-27 14:14

Re: OpenVPN routing problem on N900

Hi Dave

script-security 2 # sets the security settings that you can run external scripts
up /etc/openvpn/maemo-update-resolvconf # runs the script maemo-update-resolvconf if your vpn connection is up
down /etc/openvpn/maemo-update-resolvconf # runs the script maemo-update-resolvconf if your vpn connection is down

The maemo-update-resolvconf script existed on my phone already after the installation of openvpn on my phone. The script takes the dns settings from your openvpn environment and writes it in your /etc/resolv.conf if the connection is up. If you disconnect it wirtes the orginal settings to the /etc/resolv.conf.

Cheers

mr.zoom

asasan

2010-06-05 10:44

Re: OpenVPN routing problem on N900

I have very little understanding of this stuff. Security is not my concern but just wanted to use OpevVPN to hide my IP when connected with t-mobile 3G by tunneling through my own network at home. ToR is way too slow (to Germany and back) and does not let me use DialCentral for Google voice. (httpS://www.google.com/voice/m not accessible)

So, I bought a newly released Cisco RV 120W to set up VPN on my home network and use OpenVPN or OpenSSH. Cisco documentation says it can work with OpenVPN but I have no clue on how to set up the whole thing, generating a self-signed certificate, get config. files, etc. I spent hours with Cisco tech support to no avail.

Am I in over my head? Should I just forget about the whole thing? Can anybody help?

Davey101

2010-06-05 11:23

Re: OpenVPN routing problem on N900

Check the documentantion and/or forums for your router.

I upgraded my Linksys to DD-WRT and found a really helpful how-to guide on OpenVPN in the DD-WRT wiki.

With the information in this thread, it wasn't too difficult to create a second configuration that routes all traffic through the VPN.

mail_e36

2010-06-10 20:12

Re: OpenVPN routing problem on N900

In June 2010 I downloaded the current version of OpenVPN for the N900 and it seems I have no trouble connecting to the VPN over both WiFi and EDGE... haven't tried 3G yet... it shouldn't make a difference though. This worked without making any of the above stated changes.

Did this issue somehow get fixed?

mail_e36

2010-06-11 13:59

Re: OpenVPN routing problem on N900

It appears my last message was not correct... it seems I ran into a fluke (random scenario) when it actually worked over EDGE without changes being made... I guess I'll have to actually look into the above instructions...

I see several different sets of instruction here for making OpevVPN work over EDGE/GPRS, can someone please indicate the best/most reliable method?

Thank you

Davey101

2010-06-11 19:16

Re: OpenVPN routing problem on N900

As far as I know, there are no special requirements for using openvpn over GPRS/Edge/3G. The hacks in this thread apply to routing all traffic over the vpn while using these types of connection.

Is that what you are trying to do? What else is in your configuration?

andrew_85

2010-06-24 01:59

Re: OpenVPN routing problem on N900

guys i installed and everything is finethen imported this hideipvpnuk and i m also connected but when i try to open facebook it doesn t work.

p s I m in china

nikul.padhya

2010-08-05 22:30

Re: OpenVPN routing problem on N900

How to generate the VPN file?

can I connect to my website storage. (on DreamHost)
using VPN?

Is it good to use VPN or SSH to map network drives on N900?

Thank you

Vinc	2010-12-08 21:37

Re: OpenVPN routing problem on N900

Quote:

Originally Posted by mr.zoom (Post 682874)

Hi Dave

script-security 2 # sets the security settings that you can run external scripts
up /etc/openvpn/maemo-update-resolvconf # runs the script maemo-update-resolvconf if your vpn connection is up
down /etc/openvpn/maemo-update-resolvconf # runs the script maemo-update-resolvconf if your vpn connection is down

This doesn't work for me.

I followed the guide on Evertdekker.com and I am able to establish a connection to my local network via the external gprs connection.

However I need traffic routing for my sip accounts used on n900. I added the three lins to the client config, but it didn't work. Are there any other changes needed?

gauzz

2011-08-19 18:08

Re: OpenVPN routing problem on N900

Thanks guys this thread was really useful, as I was struggling to connect to my office intra via openvpn client.
Also I noticed a slight problem - while being connected to the intra n/w via the ovpnclient my battery drained off and the phone got switched off. On restart the normal internet connection via 3g started to fail, though it shows connected there ws no data transfer. After much googling the culprit was the resolv.conf file to which the "nameserver 127.0.0.1 " was overwritten but was not restored as the phone got off abruptly.
Any workaround to prevent this? Also will such a situation affect any other service due to the above mentioned configurations.

I have enabled all the scripts mentioned in the thread.

Thanks again.

All times are GMT. The time now is 10:57.

vBulletin® Version 3.8.8