R7000 VPN Site to Site with OpenWRT Router

[NYMetsFan]

I am attempting to create a site to site VPN connection with my Netgear Nighthawk R7000 Router where the Netgear Router is the Server (192.168.1.1), and an OpenWRT router is a client (192.168.2.1).  I am able to connect from the OpenWRT router into the Netgear server and remote/ping IP's within the 192.168.1.X subnet and also route all internet traffic.  When attempting to communicate with machines on the 192.168.2.X Subnet, the only IP I can reach is the OPENWRT router, and only when using the 192.168.254.X ip that is assigned by the router.  I have tried using Static Routes, as well as Activating the RIP Version = RIP 2B, but can not ping any machine sitting behind the 192.168.2.X subnet. 

I would really like to keep my Netgear router and not have to reconfigure all my settings on another OPENWRT router.  Is there any method to activate bi-directional communication over the VPN Tunnel that I am missing?  I am connecting via TUN.  Thanks for any/all advice.

[ElaineM · Accepted solution]

We do not support site to site OpenVPN configuration. The R7000 OpenVPN implementation is only for server to client configurations.

[ElaineM]

Hi @NYMetsFan

Welcome to the community!

Can you provide a network diagram of your network setup?

My understanding of Site-To-Site VPN is that there will be two VPN routers, one in each remote site. 

R7000 is not considered a VPN router but a VPN passthrough router. 

[NYMetsFan]

Client VPN router ---- clients 192.168.2.X
192.168.2.1
255.255.255.0
|||
||| internet
|||
Netgear R7000 --- clients 192.168.1.X
192.168.1.1
255.255.255.0

I am able to connect from the client router to the netgear router via VPN (192.168.254.X) and am able to get access to all locations on the 192.168.1.X network and internet but am unable to communicate with any machine or ip on the 192.168.2.X from behind the netgear router.

As a passthrough, should I have the ability to have bi-directional IP access? I have almost completed my goal, but need access to reach machines behind the 193.268.2.X network. Running traceroute I can't communicate outbound messages via the 192.168.254.X tunnel.

Thanks so much for looking into this. I'm really hoping for a positive outcome and not have to spend another 100 dollars on another openwrt router.

[ElaineM]

Where's the 192.168.254.x client located? Which side? 

Are you saying that the client behind the 192.168.2.x network can access 192.168.1.x network perfectly but not a client from 192.168.1.x network to 192.168.2.x?

What's the VPN client software that you're using? 

[NYMetsFan]

Client VPN router ---- clients 192.168.2.X
192.168.2.1
255.255.255.0
|||
||| internet
|||
Netgear R7000 --- clients 192.168.1.X
192.168.1.1
255.255.255.0

Open VPN --Netgear assigns 192.168.254.X VPN Address to each client which tunnels into the network

Where's the 192.168.254.x client located? Which side? 

 - Revised above.  OpenVPN on the Netgear R7000 router using Firmware V1.0.7.2_1.1.93. The 192.168.254.X is the IP assigned in the VPN Client Devices section of the Attached devices.  Do I have any other firmware options?

Are you saying that the client behind the 192.168.2.x network can access 192.168.1.x network

perfectly but not a client from 192.168.1.x network to 192.168.2.x?

- That is correct.  When on 2.x, I can access all LAN machines on 1.x.  When trying to ping from the 1.x network to the 2.x network, I can't reach any machine.  The only address I can ping is the 192.168.254.x address of the client router which has iniated the VPN Tunnel.

What's the VPN client software that you're using? 

OpenVPN. 

Here is my 192.168.2.1 Client Configuration:

config openvpn 'netgear'

option client '1'

option proto 'udp'

option resolv_retry 'infinite'

option nobind '1'

option persist_key '1'

option persist_tun '1'

option comp_lzo 'yes'

option verb '5'

option cert '/etc/openvpn/client.crt'

option key '/etc/openvpn/client.key'

option ca '/etc/openvpn/ca.crt'

option log '/tmp/log/openvpn.log'

option cipher 'AES-128-CBC'

option remote XXX 1193'

option dev 'tun'

option enabled '1'

option redirect_gateway 'def1'

Here is the Client conf:

client

dev tun

proto udp

remote XXX 1193

resolv-retry infinite

nobind

persist-key

persist-tun

ca ca.crt

cert client.crt

key client.key

cipher AES-128-CBC

comp-lzo

verb 5

EOF

[ElaineM]

Technically the OpenVPN works as Box to client connection. 

What's the configuration of your OpenWRT? 

I'm thinking that the configuration you seek may work if you use a VPN router which will be a site-to-site VPN connection. 

[NYMetsFan]

What I provided above is my OPENWRT CLIENT configuration.  I can't see the Server details (on the Netgear Router) because the server config file is not made available by Netgear.

[ElaineM · Accepted solution]

We do not support site to site OpenVPN configuration. The R7000 OpenVPN implementation is only for server to client configurations.