I am attempting to create a site to site VPN connection with my Netgear Nighthawk R7000 Router where the Netgear Router is the Server (192.168.1.1), and an OpenWRT router is a client (192.168.2.1). I am able to connect from the OpenWRT router into the Netgear server and remote/ping IP's within the 192.168.1.X subnet and also route all internet traffic. When attempting to communicate with machines on the 192.168.2.X Subnet, the only IP I can reach is the OPENWRT router, and only when using the 192.168.254.X ip that is assigned by the router. I have tried using Static Routes, as well as Activating the RIP Version = RIP 2B, but can not ping any machine sitting behind the 192.168.2.X subnet. I would really like to keep my Netgear router and not have to reconfigure all my settings on another OPENWRT router. Is there any method to activate bi-directional communication over the VPN Tunnel that I am missing? I am connecting via TUN. Thanks for any/all advice.

We do not support site to site OpenVPN configuration. The R7000 OpenVPN implementation is only for server to client configurations.

R7000 VPN Site to Site with OpenWRT Router

7 Replies

ElaineM
NETGEAR Employee Retired
Oct 13, 2016
Hi NYMetsFan

Welcome to the community!

Can you provide a network diagram of your network setup?

My understanding of Site-To-Site VPN is that there will be two VPN routers, one in each remote site.

R7000 is not considered a VPN router but a VPN passthrough router.
NYMetsFan
Aspirant
Oct 13, 2016
Client VPN router ---- clients 192.168.2.X
192.168.2.1
255.255.255.0
|||
||| internet
|||
Netgear R7000 --- clients 192.168.1.X
192.168.1.1
255.255.255.0

I am able to connect from the client router to the netgear router via VPN (192.168.254.X) and am able to get access to all locations on the 192.168.1.X network and internet but am unable to communicate with any machine or ip on the 192.168.2.X from behind the netgear router.

As a passthrough, should I have the ability to have bi-directional IP access? I have almost completed my goal, but need access to reach machines behind the 193.268.2.X network. Running traceroute I can't communicate outbound messages via the 192.168.254.X tunnel.

Thanks so much for looking into this. I'm really hoping for a positive outcome and not have to spend another 100 dollars on another openwrt router.
- ElaineM
  NETGEAR Employee Retired
  Oct 14, 2016
  Where's the 192.168.254.x client located? Which side?
  
  Are you saying that the client behind the 192.168.2.x network can access 192.168.1.x network perfectly but not a client from 192.168.1.x network to 192.168.2.x?
  
  What's the VPN client software that you're using?
  - NYMetsFan
    Aspirant
    Oct 14, 2016
    Client VPN router ---- clients 192.168.2.X
    192.168.2.1
    255.255.255.0
    |||
    ||| internet
    |||
    Netgear R7000 --- clients 192.168.1.X
    192.168.1.1
    255.255.255.0
    Open VPN --Netgear assigns 192.168.254.X VPN Address to each client which tunnels into the network
    
    Where's the 192.168.254.x client located? Which side?
    - Revised above. OpenVPN on the Netgear R7000 router using Firmware V1.0.7.2_1.1.93. The 192.168.254.X is the IP assigned in the VPN Client Devices section of the Attached devices. Do I have any other firmware options?
    
    Are you saying that the client behind the 192.168.2.x network can access 192.168.1.x network
    perfectly but not a client from 192.168.1.x network to 192.168.2.x?
    - That is correct. When on 2.x, I can access all LAN machines on 1.x. When trying to ping from the 1.x network to the 2.x network, I can't reach any machine. The only address I can ping is the 192.168.254.x address of the client router which has iniated the VPN Tunnel.
    
    What's the VPN client software that you're using?
    OpenVPN.
    
    Here is my 192.168.2.1 Client Configuration:
    config openvpn 'netgear'
    option client '1'
    option proto 'udp'
    option resolv_retry 'infinite'
    option nobind '1'
    option persist_key '1'
    option persist_tun '1'
    option comp_lzo 'yes'
    option verb '5'
    option cert '/etc/openvpn/client.crt'
    option key '/etc/openvpn/client.key'
    option ca '/etc/openvpn/ca.crt'
    option log '/tmp/log/openvpn.log'
    option cipher 'AES-128-CBC'
    option remote XXX 1193'
    option dev 'tun'
    option enabled '1'
    option redirect_gateway 'def1'
    
    Here is the Client conf:
    client
    dev tun
    proto udp
    remote XXX 1193
    resolv-retry infinite
    nobind
    persist-key
    persist-tun
    ca ca.crt
    cert client.crt
    key client.key
    cipher AES-128-CBC
    comp-lzo
    verb 5
    EOF

Forum Discussion

R7000 VPN Site to Site with OpenWRT Router