TomatoUSB

Has anyone tried this tutorial and successfully got it working on a N16?

[http://tomatousb.org/tut:configuring-a-pptp-vpn]

Sadly, it did not work for me. I can got my iphone connected to the router via VPN, but it does not have any internet connection. Safari cannot open any URL. I tried to use a Windows machine as client from my office, and got the same problem.

Just wondering whether anyone has the same issue. My router is Asus N16 with the latest firmware (build 54).

Here is part of the log file. You can see the iphone did get a new ip from the router.

Thanks.

May  3 23:32:20 N16 daemon.debug pppd[3924]: rcvd [IPCP TermAck id=0x1]
May  3 23:32:20 N16 daemon.debug pppd[3924]: rcvd [CCP ConfReq id=0x2 <mppe +H -M +S -L -D -C>]
May  3 23:32:20 N16 daemon.debug pppd[3924]: sent [CCP ConfAck id=0x2 <mppe +H -M +S -L -D -C>]
May  3 23:32:20 N16 daemon.debug pppd[3924]: rcvd [CCP ConfAck id=0x2 <mppe +H -M +S -L -D -C>]
May  3 23:32:20 N16 daemon.notice pppd[3924]: MPPE 128-bit stateless compression enabled
May  3 23:32:20 N16 daemon.debug pppd[3924]: rcvd [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
May  3 23:32:20 N16 daemon.debug pppd[3924]: sent [IPCP ConfNak id=0x1 <addr 192.168.1.146> <ms-dns1 8.8.8.8> <ms-dns2 8.8.8.8>]
May  3 23:32:20 N16 daemon.debug pppd[3924]: rcvd [IPV6CP ConfReq id=0x1 <addr fe80::xxxx:xxxx:xxxx:xxxx>]
May  3 23:32:20 N16 daemon.warn pppd[3924]: Unsupported protocol 'IPv6 Control Protocol' (0x8057) received
May  3 23:32:20 N16 daemon.debug pppd[3924]: sent [LCP ProtRej id=0x2 80                                               ]
May  3 23:32:20 N16 daemon.debug pppd[3924]: rcvd [IPCP ConfReq id=0x2 <addr 192.168.1.146> <ms-dns1 8.8.8.8> <ms-dns2 8.8.8.8>]
May  3 23:32:20 N16 daemon.debug pppd[3924]: sent [IPCP ConfAck id=0x2 <addr 192.168.1.146> <ms-dns1 8.8.8.8> <ms-dns2 8.8.8.8>]
May  3 23:32:23 N16 daemon.debug pppd[3924]: sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 192.168.1.1>]
May  3 23:32:23 N16 daemon.debug pppd[3924]: rcvd [IPCP ConfRej id=0x1 <compress VJ 0f 01>]
May  3 23:32:23 N16 daemon.debug pppd[3924]: sent [IPCP ConfReq id=0x2 <addr 192.168.1.1>]
May  3 23:32:23 N16 daemon.debug pppd[3924]: rcvd [IPCP ConfReq id=0x2 <addr 192.168.1.146> <ms-dns1 8.8.8.8> <ms-dns2 8.8.8.8>]
May  3 23:32:23 N16 daemon.debug pppd[3924]: sent [IPCP ConfAck id=0x2 <addr 192.168.1.146> <ms-dns1 8.8.8.8> <ms-dns2 8.8.8.8>]
May  3 23:32:24 N16 daemon.debug pppd[3924]: rcvd [IPCP ConfAck id=0x2 <addr 192.168.1.1>]
May  3 23:32:24 N16 daemon.notice pppd[3924]: local  IP address 192.168.1.1
May  3 23:32:24 N16 daemon.notice pppd[3924]: remote IP address 192.168.1.146
May  3 23:32:24 N16 daemon.info bcrelay[3856]: Active interface set changed to: br0(0/23/6) ppp0(1/24/7) ppp1(2/27/8)

You might be having the same problem I am having… firewall not working correctly.

try telnet/ssh to the router and give it…

iptables -A INPUT -i ppp0 -j ACCEPT
iptables -A FORWARD -i ppp0 -j ACCEPT
iptables -A INPUT -i ppp1 -j ACCEPT
iptables -A FORWARD -i ppp1 -j ACCEPT
iptables -A INPUT -i ppp2 -j ACCEPT
iptables -A FORWARD -i ppp2 -j ACCEPT
iptables -A INPUT -i ppp3 -j ACCEPT
iptables -A FORWARD -i ppp3 -j ACCEPT
iptables -A INPUT -i ppp4 -j ACCEPT
iptables -A FORWARD -i ppp4 -j ACCEPT

and try the connection again…

That got me up and running (kinda) but i'm still looking why the vpn.fire script isn't working correctly… something about line 11 seq … something…

root@unknown:/opt/etc/config# vpn.fire
vpn.fire: line 11: seq: not found

but its not adding the correct entries…

root@unknown:/opt/etc/config# cat vpn.fire
#!/bin/sh
MAX_VPN_CLIENTS=8

iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -p tcp —dport 1723 -j ACCEPT

for i in $(seq 0 $(($MAX_VPN_CLIENTS-1))); do
IF=ppp$i
iptables -A INPUT -i $IF -j ACCEPT
iptables -A FORWARD -i $IF -j ACCEPT
done

looks like its not working in its current form.

Anyone have any help?

Its been like 8 years since I been pokin' around iptables and shell scripts.

???

The script uses seq to generate a sequence of integers from 0 to $MAX_VPN_CLIENTS-1 but seq is not defined. Write a function within the script to define it.

Yes, the seq is not support in the sh of the tomato. I re-wrote the script as below:

#!/bin/sh
MAX_VPN_CLIENTS=5

iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -p tcp —dport 1723 -j ACCEPT

i=0
while [ $i != $MAX_VPN_CLIENTS ]; do
IF=ppp$i
logger -s -t vpn.fire $IF " interface adding to firewall rules"
iptables -A INPUT -i $IF -j ACCEPT
iptables -A FORWARD -i $IF -j ACCEPT
i=`expr $i + 1`
done

However, I have another problem. I can only connect from the LAN side (which is useless, just for a test). I cannot connect from the WAN side. The error message as below:

daemon.err pptpd[4906]: GRE: read(fd=6,buffer=418564,len=8260) from network failed: status = -1 error = Protocol not available
daemon.err pptpd[4906]: CTRL: GRE-tunnel has collapsed (GRE read or PTY write failed (gre,pty)=(6,5))
daemon.debug pptpd[4906]: CTRL: Reaping child PPP[4907]

It seems that is is a firewall problem. Any hints?

try connecting from 3g see if it gives you the same error… … I 'might' have an idea depending on what happens with a connection in from the 3g network.

I tried to connect thru 3G, it has no response!

I just tired again. It is ok over 3G, either directly using my iphone or using computer via iphone as 3G modem.

I will try to test it on another ISP's Wifi network tomorrow.

Besides, I found that "brelay" is using a lot of CPU when I am copying files on the local LAN (not on VPN). It significantly lowered the speed of copying files to the HD connected on my Asus RT-N16. Any ideas?