OpenVPN firewall

Software SW help
1

Hi, how to setup firewall to access LAN from VPN? I have set by the picture and i have no access.

image
image1150×366 39.2 KB

2

Hello, I am having the same issue. I am able to connect to my Turris OpenVPN server using an Android OpenVPN client app, but I’m not able to access LAN devices while connected.

Trying to ping and SSH into the router IP address with no success.

3

Packet forwarding between “lan” and “vpn_turris” is necessary but not enough. Routing must be also configured. There are two ways:

By LuCI

  1. Install the luci-app-openvpn package.
  2. Go to Services -> OpenVPN.
  3. Switch to the Advanced mode.
  4. Select the “VPN” configuration category.
  5. Add as many “push” rules as you need. Select “custom” here and write something like “route 192.168.1.0 255.255.255.0” to route all traffic to your LAN over the OpenVPN interface.

Manually

Edit /etc/config/openvpn and append “list ‘push route 192.168.1.0 255.255.255.0’” or similar commands at the end of the “config openvpn ‘server_turris’” configuration section.

1 Like
4

Hello,
The “push” rules are automatically added to the “server_turris” configuration by the Foris OpenVPN plugin, right? “list push route 192.168.1.0 255.255.255.0”
Regards

5

Yes, one rule for exactly 192.168.1.0 should be added automatically if you set up OpenVPN in Foris. If it is missing for some reason or if the LAN has another address range it has to be added manually.

6

Ok. If I understand correctly, the Omnia firewall and OpenVPN configurations should be set properly after using the Foris plugin to setup the OpenVPN server. After doing this, if a client successfully connects to the server, yet is unable to ping the LAN address, what could possibly cause this?

7

Could you provide your /etc/config/openvpn please? It’s strange if it doesn’t work…

8

I had to add the option “client-to-client” in order to allow access to LAN devices.

I’m currently away from my network. I can upload the configuration later today.

9

The option “client-to-client” is intended to interconnect clients (without participation of the kernel) and shouldn’t be necessary for access to the LAN.

10

Hey, I’m sorry for wasting your time with this issue.

I performed a factory reset on my omnia this afternoon. Now, the OpenVPN plugin works as it should. No need to include “client-to-client” to the config file.

Thanks for your responses.

1 Like
11

Weird I also had to set client-t-client to access lan devices.

I had forwarding set correctly vpn->lan,wan & lan->wan,vpn but it didnt work with that.

I tried stopping network and turris_server. Also tried prging the config and even uninstalling openvpn in foris & deleting CA. Still have to have client-to-client to access lan devices. Factory reset is no go for me.

12

FYI

Not only did I perform a factory reset, but I also upgraded my new mSATA memory.