Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense to DD-wrt Open vpn

    Scheduled Pinned Locked Moved OpenVPN
    23 Posts 6 Posters 11.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Cry HavokC Offline
      Cry Havok
      last edited by

      Maybe if you said what you were actually trying to achieve and what your problems were?

      I take it you've read the OpenVPN documentation, and the article on the DD-WRT wiki about creating a site-to-site VPN with DD-WRT and OpenVPN?

      1 Reply Last reply Reply Quote 0
      • C Offline
        chazers18
        last edited by

        heres what i can do

        pfsense = server
        ddwrt = client
        address pool for the vpn is 172.168.1.0/24

        pfsense has a ca based certs with i can get the ddwrt hook up to the pfsense and i can ping from the client side to the server side. and browse file shares on the server side.
        when i am on the server side i can not ping or touch the client side.

        also i know that i can set a rule in the lan side for network 172.168.1.0/24.
        what i need is a route from the server side to the client side so i can get the VOIP working.

        i have read all the DDWrt Ovpn and it is all worthless. i have gotten it all to work when i use the pfsense based vpn stuff and ti works great.

        thank you for all your help.

        Chase

        1 Reply Last reply Reply Quote 0
        • GruensFroeschliG Offline
          GruensFroeschli
          last edited by

          Did you create on the pfSense a route to the subnet behind the client?
          You should to take a look at the route and iroute commands.
          http://openvpn.net/index.php/documentation/manuals/openvpn-20x-manpage.html

          Also if you're doing it with a PKI you should add this to the client-specific options.
          So that if the client connects with a different IP than usual the route changes accordingly.

          We do what we must, because we can.

          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

          1 Reply Last reply Reply Quote 0
          • C Offline
            chazers18
            last edited by

            ok this is a little greek but at least this helps. do i plug the new commands in to the "custom options" area on the pfsense server?

            thank you

            1 Reply Last reply Reply Quote 0
            • GruensFroeschliG Offline
              GruensFroeschli
              last edited by

              For a site-to-site connection i would not do it with a PKI.
              In a shared key setup you have defined IP's on both sides of the tunnel.
              If you do it with a PKI the client becomes dynamically an IP assigned. –> you need client specific route commands.

              While setting up a shared key setup you have a config field "remote subnet" which automatically adds the route to the remote subnet.

              We do what we must, because we can.

              Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

              1 Reply Last reply Reply Quote 0
              • C Offline
                chazers18
                last edited by

                yea i wish that i could do a Static key assignment on the ddwrt. as far as i can tell if you want to do that it is a royal pain in the rear. i currently have jsut the one ddwrt on the PKI with plans in the future for no other expandment. on that channel.

                or if you know how to do the Static key on ddwrt to make the thing a client i am all ears for it. but all i could find was a how to on making it the server.

                1 Reply Last reply Reply Quote 0
                • GruensFroeschliG Offline
                  GruensFroeschli
                  last edited by

                  What keeps you from using the DD-WRT as SKI server?
                  Anyway. If you dont plan on using more that the DD-WRT as client you could as well make the route entries static.

                  Do you still need help with getting the right command to add the routes?
                  Or where you able to get it running?

                  We do what we must, because we can.

                  Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                  1 Reply Last reply Reply Quote 0
                  • jahonixJ Offline
                    jahonix
                    last edited by

                    What version of DD-WRT are you using?
                    I tried to understand your problem and looked into my DD-WRT v23 SPx implementation on a WRT54GL but couldn't find it at all. Are you using the x86 package on regular PC hardware or am I missing something?
                    I kinda stripped down my WRT54 to be an access point rather than a router, so things might not show up in the GUI.

                    1 Reply Last reply Reply Quote 0
                    • C Offline
                      chazers18
                      last edited by

                      the ddwrt hardware version is a 2.0
                      the software version is dd-wrt.v23_vpn_wrt54g

                      i would LOVE to make the DDwrt a client using a static key. what my problem is i dont know what commands i need to use to make it act as a client. i have read most of the documents on DDWRT's site and they are mostly set up for ddwrt to be the server.

                      So if any one has a link, on how to make the ddwrt a client using static keys PLEASE let me know.
                      Thank you Very much

                      Chase

                      1 Reply Last reply Reply Quote 0
                      • jahonixJ Offline
                        jahonix
                        last edited by

                        OK, I am running the generic/standard/whatever firmware, not the VPN version.
                        Makes sense… Thanks for the info!

                        1 Reply Last reply Reply Quote 0
                        • Cry HavokC Offline
                          Cry Havok
                          last edited by

                          @chazers18:

                          So if any one has a link, on how to make the ddwrt a client using static keys PLEASE let me know.

                          I'd suggest you ask on the DD-WRT forums, where you're far more likely to reach people who know DD-WRT ;)

                          On the other hand, both DD-WRT and pfSense work under VMWare etc, so if I find the time over the next couple of weeks I'll see if I can work out if DD-WRT needs anything special beyond the instructions in the OpenVPN documentation.

                          1 Reply Last reply Reply Quote 0
                          • C Offline
                            chazers18
                            last edited by

                            Thank you Guys you are all great.

                            i will work with some of the scripting that i know how to do and post the results also.

                            Again THANK YOU!! :)

                            1 Reply Last reply Reply Quote 0
                            • C Offline
                              chazers18
                              last edited by

                              @chazers18:

                              Thank you Guys you are all great.

                              i will work with some of the scripting that i know how to do and post the results also.

                              Again THANK YOU!! :)

                              now from a window pc couldnt i just create a static key and with winscp ssh in to the ddwrt thing and place the static key in there under one of the permanet files. and then just run this command?

                              echo "dev tap
                              link-mtu 1492
                              remote public IP
                              resolv-retry infinite

                              ifconfig 192.168.1.0 255.255.255.252
                              client
                              –---BEGIN OpenVPN Static key V1-----
                                ...INSERT YOUR OWN CONTENT HERE...
                                -----END OpenVPN Static key V1-----
                              " > /tmp/static.key

                              #ca /tmp/openvpn/ca.crt
                              #cert /tmp/openvpn/client.crt
                              #key /tmp/openvpn/client.key
                              #comp-lzo
                              persist-tun
                              persist-key
                              verb 3
                              cipher AES-256-CBC" > /tmp/openvpn/openvpn.conf

                              killall openvpn
                              openvpn --config /tmp/openvpn/openvpn.conf

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.