Port Forwarding mit OpenVPN und OpenWrt

rakuri · 18. August 2015

Hallo,

hoffe ihr könnt mir helfen .

hab ein eigenartiges Problem mit dem Port Forwarding.
Und zwar ist jeder Port geschlossen wenn OpenVPN gestartet ist und offen wenn OpenVPN gestoppt ist.

Mein Netz:
ich habe zwei Router. Einer für das Internet und ein zweiter mit OpenWRT+OpenVPN

Internet -> (Router 192.168.1.1) -> (OpenWRT wan 192.168.1.2) -> (OpenWRT lan 192.168.2.1) -> (OpenWRT VPN)

Port Weiterleitung ist auf Router eingestellt.

Was ich genau möchte ist:
Vernzugriff auf OpenWRT lan (Port 12345 wo auch oscam Web ist)
Mit meiner (nicht vpn) Online IP

ORT ist der Port nur offen wenn OpenVPN protokoll aus ist
OpenVPN Verbindung ansich funktioniert, alle netze im lan werden durch getunelt.

/etc/config/network

Code:

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix 'fd07:c655:478c::/48'

config interface 'lan'
    option ifname 'eth0.1'
    option force_link '1'
    option type 'bridge'
    option proto 'static'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option ipaddr '192.168.2.1'
    option gateway '192.168.1.2'
    option dns '208.67.222.222 208.67.222.220'

config interface 'wan'
    option ifname 'eth0.2'
    option _orig_ifname 'eth0.2'
    option _orig_bridge 'false'
    option proto 'static'
    option ipaddr '192.168.1.2'
    option gateway '192.168.1.1'
    option netmask '255.255.255.0'
    option dns '208.67.222.222 208.67.222.220'

config interface 'wan6'
    option ifname '@wan'
    option proto 'dhcpv6'

config switch
    option name 'switch0'
    option reset '1'
    option enable_vlan '1'

config switch_vlan
    option device 'switch0'
    option vlan '1'
    option ports '0t 2 3 4 5'

config switch_vlan
    option device 'switch0'
    option vlan '2'
    option ports '0t 1'

config interface 'VPN'
    option ifname 'tun255'
    option _orig_ifname 'tun255'
    option _orig_bridge 'false'
    option proto 'none'

/etc/config/firewall

Code:

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fe80::/10'
    option src_port '547'
    option dest_ip 'fe80::/10'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'

config zone
    option name 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'
    option network 'lan'

config zone
    option name 'wan'
    option network 'wan wan6'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'

config include
    option path '/etc/firewall.user'

config zone
    option input 'ACCEPT'
    option output 'ACCEPT'
    option name 'VPN'
    option network 'VPN'
    option masq '1'
    option mtu_fix '1'
    option forward 'ACCEPT'

config forwarding
    option dest 'VPN'
    option src 'lan'

route mit OpenVPN

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.20.32.1     128.0.0.0       UG    0      0        0 tun255
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0.2
81.171.56.22    192.168.1.1     255.255.255.255 UGH   0      0        0 eth0.2
128.0.0.0       172.20.32.1     128.0.0.0       UG    0      0        0 tun255
172.20.32.0     *               255.255.252.0   U     0      0        0 tun255
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0.2
192.168.2.0     *               255.255.255.0   U     0      0        0 br-lan

route ohne OpenVPN

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0.2
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0.2
192.168.2.0     *               255.255.255.0   U     0      0        0 br-lan

ifconfig -a mit OpenVPN

Code:

br-lan    Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fd07:c655:478c::1/60 Scope:Global
          inet6 addr: fe80::fa1a:67ff:fed8:df70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5879 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6393 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:554839 (541.8 KiB)  TX bytes:2712087 (2.5 MiB)

eth0      Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          inet6 addr: fe80::fa1a:67ff:fed8:df70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10558 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5456 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4561347 (4.3 MiB)  TX bytes:1051233 (1.0 MiB)
          Interrupt:4 

eth0.1    Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:738 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:65097 (63.5 KiB)

eth0.2    Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::fa1a:67ff:fed8:df70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10538 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4714 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4365184 (4.1 MiB)  TX bytes:963880 (941.2 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:4492 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4492 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:403671 (394.2 KiB)  TX bytes:403671 (394.2 KiB)

tun255    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.20.33.83  P-t-P:172.20.33.83  Mask:255.255.252.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:5 errors:0 dropped:0 overruns:0 frame:0
          TX packets:26 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:380 (380.0 B)  TX bytes:1640 (1.6 KiB)

wlan0     Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:71  
          inet6 addr: fe80::fa1a:67ff:fed8:df71/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6166 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6647 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:670106 (654.4 KiB)  TX bytes:2890130 (2.7 MiB)

wlan1     Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:72  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifconfig -a ohne OpenVPN

Code:

br-lan    Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fd07:c655:478c::1/60 Scope:Global
          inet6 addr: fe80::fa1a:67ff:fed8:df70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5877 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6344 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:554582 (541.5 KiB)  TX bytes:2708317 (2.5 MiB)

eth0      Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          inet6 addr: fe80::fa1a:67ff:fed8:df70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10211 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5280 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4490125 (4.2 MiB)  TX bytes:1029688 (1005.5 KiB)
          Interrupt:4 

eth0.1    Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:712 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:63460 (61.9 KiB)

eth0.2    Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:70  
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::fa1a:67ff:fed8:df70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10191 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4564 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4300208 (4.1 MiB)  TX bytes:944676 (922.5 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:4484 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4484 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:402659 (393.2 KiB)  TX bytes:402659 (393.2 KiB)

wlan0     Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:71  
          inet6 addr: fe80::fa1a:67ff:fed8:df71/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6164 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6619 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:669821 (654.1 KiB)  TX bytes:2887859 (2.7 MiB)

wlan1     Link encap:Ethernet  HWaddr F8:1A:67:D8:DF:72  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Suche

Suche

Port Forwarding mit OpenVPN und OpenWrt

rakuri

Newbie

Ähnliche Themen

Spenden Unterstützung