0

I'm trying to find the best (most secure) configuration for the firewall in OpenWRT.

I'm using LuCi to configure all the stuff. I have successfully created a VPN (OpenVPN). It is supposed the best way is create 3 zones (wan, lan and vpn) in the firewall and then configure it.

My problem is if I create 3 zones, I cannot establish a tunnel in OpenVPN from internet to my router running OpenWRT. Only works when I set 1 zone including the 3: wan, lan and vpn (see attached image).

Are you using a OpenVPN? how are you configuring the firewall for the VPN?

enter image description here

Improve this question
2

Check out these two guides for more info:

http://blog.ipredator.se/howto/openwrt/configuring-openvpn-on-openwrt.html http://tokyobreeze.wordpress.com/2015/01/15/install-openvpn-in-a-router-with-4mb-flash/

The basic idea is to create 3 separate zones, use zone forwarding from LAN to VPN, and turn on Masquerading and MSS clamping on the VPN zone. Be sure to leave Forward on "Reject" for all zones, Output "Accept" on all zones. Accept input on LAN but not VPN. For the WAN zone there are two possibilities (I'm not sure which is "correct" but both work for me and allow me to pass all tests on ipleak.net):

  1. Input=Reject, Output=Accept, Forward=Reject. Turn on Masquerading and MSS clamping enter image description here
  2. Input=Accept, Output=Accept, Forward=Reject. Turn off Masquerading and MSS clamping enter image description here

Lastly, if you're not already aware, make sure prevent DNS, ipv6, etc. leaks as described in the above guides. I've found ipleak.net to be a good place to test my setup each time.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.