Dual SSID + openVPN problem

Forum » Discussions / Tomato USB Modifications » Dual SSID + openVPN problem

Started by:

SteveBeaver
Date: 02 Feb 2012 20:48
Number of posts: 6

RSS: New posts

Summary:

Dual SSID no longer works when internet traffic redirected

Unfold All Fold All More Options

Fold

Dual SSID + openVPN problem

SteveBeaver 02 Feb 2012 20:48

Running 1.28 - Toastman 7495 built from source. I can create dual SSIDs and connect to either, and hence access the Internet. I can start an OpenVPN (client) tunnel to a remote server, and still everything works. When I check the "redirect internet traffic" box in the OpenVPN client, however, traffic from my first wireless SSID (br0) goes down the tunnel as it should, but traffic from the second network, br1, seems to go nowhere.

Part of the routing table:

192.168.254.32  *               255.255.255.224 U     0      0        0 vlan2
192.168.2.0     *               255.255.255.0   U     0      0        0 br0
192.168.8.0     *               255.255.255.0   U     0      0        0 br1
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         10.255.0.1      0.0.0.0         UG    0      0        0 tun11

My two wireless networks are using 192.168.2.1 and 8.1

Options

Unfold Dual SSID + openVPN problem by

SteveBeaver, 02 Feb 2012 20:48

Fold

Re: Dual SSID + openVPN problem

SteveBeaver 03 Feb 2012 22:32

Answering my own post:

I was able to cross-compile tcpdump for the WNR3500L, which revealed that traffic from the VLANS is not NATed when the "NAT on tunnel" box is checked, only the LAN (lan_ipaddr) is considered.

Adding some firewall rules to the firewall script fixed the problem:

iptables -t nat -I POSTROUTING -s 192.168.20.0/255.255.255.0
iptables -t nat -I POSTROUTING -s 192.168.30.0/255.255.255.0
iptables -t nat -I POSTROUTING -s 192.168.12.0/255.255.255.0

(My VLANs are 192.168.20, .30 and .12)

I'll modify router/rc/vpn.c at about line 410 to also take the VLANs into account for a permanent fix.

Options

Unfold Re: Dual SSID + openVPN problem by

SteveBeaver, 03 Feb 2012 22:32

Fold

Re: Dual SSID + openVPN problem

LanceThePants 03 Feb 2012 23:44

Awesome, with the introduction of vlan gui recently, there's a lot of work needed to make other services vlan aware. Now if OpenVPN were vlan aware….

Last edited on 03 Feb 2012 23:45 by LanceThePants Show more

Options

Unfold Re: Dual SSID + openVPN problem by

LanceThePants, 03 Feb 2012 23:44

Fold

Re: Dual SSID + openVPN problem

Teaman 04 Feb 2012 05:04

@SteveBeaver - sounds like fun - good catch!

Still, you might wanna have your code do some checking before adding/creating such iptables rules at runtime (i.e. if these LAN bridges/interface are actually configured and up, etc…).

Also, you might also want to take a look at two other pieces of code that might be either relevant and/or even possibly useful… (depending on how we look at this multiLAN thing as a whole):

www/advanced-access.asp (Advanced -> LAN Access page)
rc/firewall.c, inside function static void filter_forward(void) (search for lan_access)

I'm not suggesting you should actuallly use that or follow those things/ideas, but… at least… those pieces of code might be… interesting and/or possibly useful… ;)

Cheers!

Options

Unfold Re: Dual SSID + openVPN problem by

Teaman, 04 Feb 2012 05:04

Fold

Re: Dual SSID + openVPN problem

SteveBeaver 04 Feb 2012 14:14

Thanks for the pointers! I do check that the VLANs are properly configured before adding the FW rules, and I have added a way to allow the user to choose whether the VLANs are NATed to the tunnel or to the Internet.

I'll take a look at firewall.c too.

Steve

Options

Unfold Re: Dual SSID + openVPN problem by

SteveBeaver, 04 Feb 2012 14:14

Fold

Re: Dual SSID + openVPN problem

SteveBeaver 04 Feb 2012 18:29

This solved my immediate needs. - Sorry, I am not expert enough to do this via git yet :)

router/rc/vpn.c: ~ line 400

        if ( routeMode == NAT )
        {
            sscanf(nvram_safe_get("lan_ipaddr"), "%d.%d.%d.%d", &ip[0], &ip[1], &ip[2], &ip[3]);
            sscanf(nvram_safe_get("lan_netmask"), "%d.%d.%d.%d", &nm[0], &nm[1], &nm[2], &nm[3]);
            fprintf(fp, "iptables -t nat -I POSTROUTING -s %d.%d.%d.%d/%s -o %s -j MASQUERADE\n",
                    ip[0]&nm[0], ip[1]&nm[1], ip[2]&nm[2], ip[3]&nm[3], nvram_safe_get("lan_netmask"), &iface[0]);
+ #ifdef TCONFIG_VLAN
+             // If VLANs are in use, we must add routes for them too, or they will not be able to get anywhere
+             // Data may come from the VLANs defined as lan1_ipddr, lan2_opaddr & lan3_ipaddr
+             // SJB
+ 
+             char lanN_ifname[] = "lanX_ipaddr";
+             char lanN_netmask[] = "lanX_netmask";
+             char br;
+ 
+             for(br=1 ; br<=3 ; br++) {
+                 sprintf(lanN_ifname, "lan%d_ipaddr", br);
+                 sprintf(lanN_netmask, "lan%d_netmask", br);
+                 if(strlen(nvram_safe_get(lanN_ifname)) > 6) {
+                     sscanf(nvram_safe_get(lanN_ifname), "%d.%d.%d.%d", &ip[0], &ip[1], &ip[2], &ip[3]);
+                     sscanf(nvram_safe_get(lanN_netmask), "%d.%d.%d.%d", &nm[0], &nm[1], &nm[2], &nm[3]);
+                     fprintf(fp, "iptables -t nat -I POSTROUTING -s %d.%d.%d.%d/%s -o %s -j MASQUERADE\n",
+                             ip[0]&nm[0], ip[1]&nm[1], ip[2]&nm[2], ip[3]&nm[3], nvram_safe_get(lanN_netmask), &iface[0]);    
+                     }
+             }
+ #endif
        }
        fclose(fp);
        vpnlog(VPN_LOG_EXTRA,"Done creating firewall rules");

Options

Unfold Re: Dual SSID + openVPN problem by

SteveBeaver, 04 Feb 2012 18:29

New Post

TomatoUSB

Unleash your router