[Cerowrt-devel] vpn fw question

[Joel Wirāmu Pauling]

Most of the time, they just want to access a remote VPS/Torrent
Seedbox or $service from their local network.

On 3 October 2014 15:38, Joel Wirāmu Pauling <joel at aenertia.net> wrote:
> Yup - Routing is going to be better on performance. But is definately
> the more advanced/less common use case from my experience helping
> users do this.
>
> What I've got there tends to be what most users who ask this question
> are actually after.
>
>
>
> On 3 October 2014 15:36, Dave Taht <dave.taht at gmail.com> wrote:
>> On Thu, Oct 2, 2014 at 7:24 PM, Joel Wirāmu Pauling <joel at aenertia.net> wrote:
>>> I.e Your topology looks like this :
>>>
>>> [(Remote LAN) - VPN Client]---[INTERNET]---(Local LAN)[WAN][LAN][REMOTE-LAN])
>>>
>>> Your Local LAN knows nothing about Remote LAN and Vice versa. There is
>>> just a single Inteface/Client member that is a member of REMOTE-LAN.
>>> So to get traffic from Local LAN to Remote LAN all Local-LAN traffic
>>> needs to be masqueraded to that Single interface.
>>
>> I'm not sure this is actually the case. What I used to do (not using openvpn
>> currently, took it down during heartbleed)  was push out and pull in a
>> route or set of routes.
>>
>> 'course that requires a routing protocol on the other end...
>>
>>>
>>>
>>> -Joel
>>>
>>>
>>>
>>> On 3 October 2014 14:32, Eric S. Johansson <esj at eggo.org> wrote:
>>>> I was trying to setup my cerowrt box as an openvpn client. everything seems
>>>> to be working. The VPN link comes up, tun0 is created. I can access machines
>>>> on the far end of the link from the AP and vice versa. the openwrt
>>>> incantation for the vpn says to create an interface called vpn0
>>>>
>>>> network.vpn0=interface
>>>> network.vpn0.proto=none
>>>> network.vpn0.ifname=tun0
>>>>
>>>> ifconfig says  tun0 exists  but no vpn0. fw3 reload says:
>>>>
>>>> Warning: Section @zone[1] (lan) cannot resolve device of network 'lan'
>>>> Warning: Section @zone[2] (guest) cannot resolve device of network 'guest'
>>>>
>>>> sometimes it says: Warning: Section @zone[1] (lan) cannot resolve device of
>>>> network 'vpn0'
>>>>
>>>> tcpdump sees the ICMP request at se00 and tun0 but not at the remote target.
>>>> this leads me to believe that it's probably a firewall problem but I don't
>>>> know where the logs are.
>>>>
>>>> This brings me to one of the problem with had making changes in cerowrt,
>>>> namely, how the $##$& do you debug this thing? I've had to reflash this box
>>>> way too many times because I did something that effectively bricked it.
>>>> right now, I would settle for knowing where to find where logs are put.
>>>>
>>>> thanks
>>>> --- eric
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Cerowrt-devel mailing list
>>>> Cerowrt-devel at lists.bufferbloat.net
>>>> https://lists.bufferbloat.net/listinfo/cerowrt-devel
>>> _______________________________________________
>>> Cerowrt-devel mailing list
>>> Cerowrt-devel at lists.bufferbloat.net
>>> https://lists.bufferbloat.net/listinfo/cerowrt-devel
>>
>>
>>
>> --
>> Dave Täht
>>
>> https://www.bufferbloat.net/projects/make-wifi-fast