Changes

OpenVPN traffic split (view source)

Revision as of 10:31, 7 September 2021

3,605 bytes removed ,  10:31, 7 September 2021
no edit summary
Line 10: Line 10:     
'''Prerequisites''':
 
'''Prerequisites''':
−
 
+
* Working OpenVPN connection with OpenVPN server with zone allowing traffic to internet
−
*A single RUTxxx router (excluding [[RUT850]]) with an active internet connection that will act as the OpenVPN client
+
* At least one end device (PC, Laptop) to configure the routers and test the set up
−
*At least one end device (PC, Laptop) to configure the routers and test the set up
  −
 
   
----
 
----
−
'''Configuration scheme''':
+
'''Topology scheme''':
   −
[[File:Openvpn traffic split configuration scheme.jpg|1000px]]
+
[[File:OpenVpn schema.png|alt=|749x749px|border]]
   −
The figure above depicts the OpenVPN traffic split scheme. A RUTxxx router acts as an OpenVPN client (virtual IP: '''10.0.0.6'''; P-t-P: '''10.0.0.5''') that is connected to a remote OpenVPN server. The routers LAN IP addresses range from 192.168.1.1 to 192.168.1.254.
+
The figure above depicts the OpenVPN traffic split scheme. A RUTxxx router acts as an OpenVPN client (virtual IP: '''172.16.0.2''') that is connected to a remote OpenVPN server (virtual IP '''172.16.0.1'''). The routers LAN/WiFi LAN IP addresses range from 192.168.1x.1 to 192.168.1x.254.
   −
When the scheme is realized, Devices in the 192.168.1.1 to 192.168.1.127 IP range reach the Internet via the router's WAN and devices in the 192.168.1.128 to 192.168.1.254 IP range reach the Internet via the OpenVPN server effectively "adopting" the server's Public IP address.
+
When the scheme is realized, Devices in the LAN range reach the Internet via the router's WAN and devices in the WiFi LAN range reach the Internet via the OpenVPN server effectively "adopting" the server's Public IP address.
    
==Router configuration==
 
==Router configuration==
Line 27: Line 25:  
Most of the router's configuration will be done via a command line interface. You can find detailed instruction on all command line interfaces supported by RUTxxx routers '''[[Command line interfaces|here]]'''. Choose one that is available or most preferred by you and you will still be able to follow the guide step-by-step regardless of which method you chose as the commands used will remain identical.
 
Most of the router's configuration will be done via a command line interface. You can find detailed instruction on all command line interfaces supported by RUTxxx routers '''[[Command line interfaces|here]]'''. Choose one that is available or most preferred by you and you will still be able to follow the guide step-by-step regardless of which method you chose as the commands used will remain identical.
   −
===OpenVPN client===
+
=== OpenVPN client===
 
----
 
----
−
   
*First, you must create an OpenVPN client instance on your router. You can do this either via command line or from the router's WebUI, '''Services → VPN → OpenVPN''' section. We will not go into further detail on this because the client's configuration will depend on the OpenVPN server that you are connecting to. You can find detailed instructions on how to create and configure an OpenVPN client instance in our '''[[OpenVPN configuration examples]]''' article, which also contains information on how to configure an OpenVPN server on a RUTxxx router, if that is what you are using for this configuration.
 
*First, you must create an OpenVPN client instance on your router. You can do this either via command line or from the router's WebUI, '''Services → VPN → OpenVPN''' section. We will not go into further detail on this because the client's configuration will depend on the OpenVPN server that you are connecting to. You can find detailed instructions on how to create and configure an OpenVPN client instance in our '''[[OpenVPN configuration examples]]''' article, which also contains information on how to configure an OpenVPN server on a RUTxxx router, if that is what you are using for this configuration.
−
   
----
 
----
 +
*Once you have configured your OpenVPN client, you should probably test whether the OpenVPN connection is operational as this will make troubleshooting easier later on. The easiest way to do so is to login to the router's WebUI and check OpenVPN status in '''Status → Services:''':
   −
*Once you have configured your OpenVPN client, you should probably test whether the OpenVPN connection is operational as this will make troubleshooting easier later on. The easiest way to do so is to login to the router's WebUI and check OpenVPN status in '''Status → Network → OpenVPN''':
+
[[File:OpenVPN.png|alt=|859x859px]]
−
 
  −
[[File:How to check openvpn status.png]]
   
----
 
----
 +
*If the connection was successful, we can start the traffic split configuration. First, we'll need to Edit LAN network to use IP address 192.168.10.1. It can be done in section '''Network''' '''→ Interfaces → General settings:''' [[File:LAN.png]]
   −
*If the connection was successful, we can start the traffic split configuration. First, we'll need to add an additional routing table. This can be done by issuing the following command:
+
===Wireless LAN interface===
−
 
  −
echo "<span style="color:red">5 rt</span>" >> <span style="color:red">/etc/iproute2/rt_tables</span>
  −
 
  −
This adds a new routing table called ''rt''. ''/etc/iproute2/rt_tables'' is a file used by the ''iproute2'' utilities which translate user friendly names given on the command line into integer values used by the kernel. So the number ''5'' is just the way for the ''iproute2'' to identify the table.
   
----
 
----
 +
*Next, we'll need to create wireless interface to use a custom network (wifi_lan) and disable encryption for convenience. In order to do this, navigate '''Network''' '''→ Wireless''' and click '''edit:'''
 +
[[File:WIFI.png|884x884px]]
   −
*Next, we'll need to add some entries to the network configuration file ''/etc/config/network''. You can edit the file with the ''vi'' command. Type '''vi /etc/config/network''' and press the "I" button on your keyboard to begin editing. Add the following lines:
  −
  −
config interface 'vpnas'
  −
        option proto 'none'
  −
        option ifname '<span style="color:red">tun_c_MyClient</span>'
  −
  −
config route
  −
        option interface 'vpnas'
  −
        option target '0.0.0.0'
  −
        option netmask '0.0.0.0'
  −
        option table 'rt'
  −
        option gateway '<span style="color:red">10.0.0.5</span>'
  −
  −
config rule
  −
        option in 'lan'
  −
        option src '<span style="color:red">192.168.1.128/25</span>'
  −
        option lookup 'rt'
  −
        option priority '10'
  −
<ul>
  −
<li>
  −
When you're finished, press the "Esc" button and type ''':wq''' to save the changes and exit the editor (''Control + Z'' to exit without saving). The values highlighted in red are dependent on your configuration and will most likely need to be changed:
  −
</li>
   
<ul>
 
<ul>
 
<li>
 
<li>
−
option ifname '<span style="color:red">tun_c_MyClient</span>' - your OpenVPN interface's name. You can check it with this command: '''ifconfig | grep tun'''. The response should look something like this:
+
In section '''Network''' select '''Custom''' and add your preferred interface name. In this example we use WIFI_LAN:
−
<pre>
  −
tun_c_MyClient Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
  −
</pre>
  −
'''NOTE''': if the response is empty, your OpenVPN connection might be down.
   
</li>
 
</li>
−
<li> option gateway '<span style="color:red">10.0.0.5</span>' - your virtual remote endpoint (or ''P-t-P''). You can check it with this command: '''ifconfig tun_c_MyClient'''. Replace the ''MyClient'' part with your own OpenVPN interface name. The response should look something like this:
+
</ul>[[File:Wifi network.png|877x877px]]
−
<pre>
  −
tun_c_MyClient Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
  −
              inet addr:10.0.0.6  P-t-P:10.0.0.5  Mask:255.255.255.255
  −
              UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
  −
              RX packets:62249 errors:0 dropped:0 overruns:0 frame:0
  −
              TX packets:62698 errors:0 dropped:1 overruns:0 carrier:0
  −
              collisions:0 txqueuelen:100
  −
              RX bytes:53341014 (50.8 MiB)  TX bytes:11974147 (11.4 MiB)
  −
</pre>
  −
</li>
  −
<li>
  −
option src '<span style="color:red">192.168.1.128/25</span>' - devices from this IP range will use the OpenVPN server as the default gateway to the Internet.
  −
</li>
  −
</ul>
  −
</ul>
  −
----
     −
*Next, we'll need to create short custom script ''/etc/openvpn/up.sh'', that would add a route which makes the specified LAN range reach the Internet via the OpenVPN server:
+
*Disable wifi encryption in '''Wireless security''' section, by choosing encryption type '''No encryption.''' Once you're finished, press '''Save & Apply''' and interface configuration windows will appears.
 +
*In '''general settings''' edit wifi_lan interface to specify IPv4 address (e.g. 192.168.11.1). Press '''Save & Apply.'''
   −
echo -e '#!/bin/bash'"\n"'ip route add default via 10.0.0.5 table rt' > /etc/openvpn/up.sh
+
=== VPN interface===
 
----
 
----
 +
*Next, we'll need to create new interface ( e.g named VPN). In '''Physical settings''' add a tunnel interface name as custom. Tunnel interface name can be checked via ''ifconfig'' command via SSH/CLI. In this case it is named "tun_c_Testas". Don’t forget to save configuration.
 +
[[File:Testas.png|877x877px]]
   −
*Next, we'll need to grant executable permissions to newly created script:
     −
chmod +x /etc/openvpn/up.sh
   
----
 
----
 +
*When your done with the configuration run SSH client or CLI and connect to the router. Once connected execute these commands:
   −
*Finally, we'll need to edit router's OpenVPN script ''/etc/init.d/openvpn'', so that it would execute previously created ''/etc/openvpn/up.sh'' script each time OpenVPN tunnel is established. Type '''vi /etc/init.d/openvpn''' and press the "I" button on your keyboard to begin editing. Scroll down until you will find '''start_instance()''' function. Add the following lines, <span style="color:red">highlighted in red</span>, at the end of '''start_instance()''' function:
+
opkg update
   −
start_instance() {
+
*This command will update all opkg packages in router. Once update is finished install VPN policy routing using command:
−
        local s="$1"
  −
  −
        .....
  −
        .....
  −
        .....
  −
       
  −
        config_list_foreach "$s" "_extra" append_extended_params
  −
  −
        openvpn_add_instance "$s" "/var/etc" "openvpn-$s.conf" "/tmp/openvpn-$s.status"
  −
  −
        <span style="color:red">echo 'script-security 2' >> $OPENVPN_CONFIG</span>
  −
        <span style="color:red">echo 'up /etc/openvpn/up.sh' >> $OPENVPN_CONFIG</span>
  −
}
  −
When you're finished, press the "Esc" button and type ''':wq''' to save the changes and exit the editor (''Control + Z'' to exit without saving).
  −
----
     −
*When your done with the configuration, don't forget to restart the relevant services. You can do this by restarting the entire router ('''reboot''' command) or just restart the '''network''' and '''openvpn''' services:
+
opkg install vpn-policy-routing
   −
/etc/init.d/network restart
+
*After successful installation time to configure VPN traffic splitting. In order to do so '''one by one''' execute the following uci commands (be aware that your configuration may vary):
−
/etc/init.d/openvpn restart
     −
'''NOTE''': restarting the network service will cause a brief '''data connection loss'''.
+
uci set vpn-policy-routing.config.enabled="1"
 +
while uci -q delete vpn-policy-routing.@policy[0]; do :; done
 +
uci add vpn-policy-routing policy
 +
uci set vpn-policy-routing.@policy[-1].dest_addr="192.168.10.0/24 192.168.11.0/24"
 +
uci set vpn-policy-routing.@policy[-1].interface="ignore"
 +
uci add vpn-policy-routing policy
 +
uci set vpn-policy-routing.@policy[-1].src_addr="192.168.11.0/24"
 +
uci set vpn-policy-routing.@policy[-1].interface="VPN"
 +
uci commit
   −
==Testing the setup==
+
* When your done with the configuration, restart VPN policy routing service using:
   −
If you've followed the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly. In order to test this particular configuration, a few steps have to be taken:
+
  /etc/init.d/vpn-policy-routing restart
−
 
  −
*Check the newly created routing table with the '''ip route show table rt''' command (where ''rt'' is table's name). If everything is in order, the response should contain this line (values highlighted in red should be from your own configuration):
  −
 
  −
  default via <span style="color:red">10.0.0.5</span> dev <span style="color:red">tun_c_MyClient</span> proto static
  −
----
  −
 
  −
*Check whether the correct IP rule has been added. You can do this with the '''ip rule'''. The response should look something like this (the rule from our configuration is highlighted in red):
  −
 
  −
0: from all lookup local
  −
<span style="color:red">10: from 192.168.1.128/25 iif br-lan lookup rt</span>
  −
32766: from all lookup main
  −
32767: from all lookup default
   
----
 
----
 +
==Testing the setup==
   −
*Check whether devices with IPs from different ranges reach the Internet through the default gateway. If you only have one device at your disposal at the time, you can configure a static IP address (guide for Linux users '''[[Setting up a Static IP address on a Ubuntu 16.04 PC|here]]'''; for Windows '''[[Setting up a Static IP address on a Windows 10 PC|here]]''') for that device in one range and later in the other. According to our configuration, if a device's IP falls in the range of 192.168.1.1 - 192.168.1.127, its Public IP should be that of the router's; if the IP falls in the range of 192.168.1.128 - 192.168.1.254, its Public IP should be that of the OpenVPN server. You can check the Public IP address in '''[http://www.whatsmyip.org/ this website].'''
+
If you've followed the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly.  
    +
In order to test this particular configuration, check whether devices with IPs from different interfaces reach the Internet through the default gateway. According to our configuration, if a device are connected to WAN interface, its Public IP should be that of the router's or SIM; if the device connected to WiFi LAN, its Public IP should be that of the OpenVPN server. You can check the Public IP address in '''[http://www.whatsmyip.org/ this website].'''
 
----
 
----
 
If all of the above is in order, congratulations, your configuration works!
 
If all of the above is in order, congratulations, your configuration works!
   −
==See also==
+
== See also==
   −
*Other OpenVPN related articles from our wiki:
+
* Other OpenVPN related articles from our wiki:
 
**[[How to generate TLS certificates (Windows)?]] - a guide on generating TLS certificates for Windows users
 
**[[How to generate TLS certificates (Windows)?]] - a guide on generating TLS certificates for Windows users
 
**[[VPN#OpenVPN|OpenVPN Manual section]] - OpenVPN section of the router's manual
 
**[[VPN#OpenVPN|OpenVPN Manual section]] - OpenVPN section of the router's manual
Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/72693...84318"

Navigation menu