Questions about VLANs, VPNs, and Firewall Rules - Router with TomatoUSB

R

raiderj

Limp Gawd
Joined
Jun 21, 2011
Messages
340
I've spent the last several days configuring my router (ASUS AC68U) after flashing it with TomatoUSB. Overall I'm really impressed with the software, and have nearly everything configured as I'd like, with the exception of a few issues I'm having. Hoping someone can help out!

First off, I have a question about VLAN ordering. Below is a picture of how my VLANs are currently set up. I have my main wifi interfaces running on br0, and a single virtual wifi interface on br1. Right now, both work exactly as intended, and connecting to each interface also provides Internet access. However, originally it was ordered so the WAN bridge was VLAN 2, and br1 was VLAN 3. Why does this ordering matter?

vlan.jpg


My next question is to why I'm unable to get my OpenVPN to route to my second VLAN (br1 in the earlier picture). Both PPTP and OpenVPN route by default to br0. My goal is to have one OpenVPN server to br0, and a second to br1. I've attempted to add rules to the firewall to bridge between the second VLAN (br1) and the OpenVPN interface (tun21), but that didn't work. Anyone have suggestions?

vpn.jpg


These are the router firewall rules I added trying to get it to work:

Code: 
iptables -A FORWARD -i br1 -o tun21 -j ACCEPT
iptables -A FORWARD -i tun21 -o br1 -j ACCEPT

My routing table with the VPN active:
routing.jpg
 
Last edited:
Update: So I've figured out that my OpenVPN configuration above, for whatever reason, kills my br1 VLAN (192.168.10.0). I can successfully enable an OpenVPN connection on another subnet, say 192.168.11.0.

Anyone know how I can take OpenVPN clients and bridge them to my 192.168.10.0 VLAN? Maybe through an addition on my routing table? My goal is to have authenticated remote users able to access my br1 network.
 
Figured out the issue. In case anyone is interested, by default OpenVPN in Tomato defaults to using br0. You can manually set up OpenVPN by running a script that changes to br1 if you want. It's just the GUI that isn't set to allow for other bridges.
 
You must log in or register to reply here.
Back
Top