OpenVPN and firewall configuration in LuCI

Question

I'm trying to find the best (most secure) configuration for the firewall in OpenWRT.

I'm using LuCi to configure all the stuff. I have successfully created a VPN (OpenVPN). It is supposed the best way is create 3 zones (wan, lan and vpn) in the firewall and then configure it.

My problem is if I create 3 zones, I cannot establish a tunnel in OpenVPN from internet to my router running OpenWRT. Only works when I set 1 zone including the 3: wan, lan and vpn (see attached image).

Are you using a OpenVPN? how are you configuring the firewall for the VPN?

Answer 1

Check out these two guides for more info:

http://blog.ipredator.se/howto/openwrt/configuring-openvpn-on-openwrt.html http://tokyobreeze.wordpress.com/2015/01/15/install-openvpn-in-a-router-with-4mb-flash/

The basic idea is to create 3 separate zones, use zone forwarding from LAN to VPN, and turn on Masquerading and MSS clamping on the VPN zone. Be sure to leave Forward on "Reject" for all zones, Output "Accept" on all zones. Accept input on LAN but not VPN. For the WAN zone there are two possibilities (I'm not sure which is "correct" but both work for me and allow me to pass all tests on ipleak.net):

1. Input=Reject, Output=Accept, Forward=Reject. Turn on Masquerading and MSS clamping
2. Input=Accept, Output=Accept, Forward=Reject. Turn off Masquerading and MSS clamping

Lastly, if you're not already aware, make sure prevent DNS, ipv6, etc. leaks as described in the above guides. I've found ipleak.net to be a good place to test my setup each time.