jonathan.is

Success! Unrestricted, encrypted internet access from my laptop to a linksys wrt54g running openwrt. The OpenSSH documentation and irc channel bot were especially helpful - follow them for generating the keys, and use a configuration like the one below if you want all your internet traffic routed through a tunnel. The firewall.user I would not copy directly, since it is overly open. Since I have almost no clue to how IPTables works, any help on simplifying it would be appreciated.

client.conf:

client
dev tun
proto udp
pull # new for 2.1

remote fayth.ath.cx 1194
nobind

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/fayth.crt
key /etc/openvpn/keys/fayth.key
dh /etc/openvpn/keys/dh2048.pem

comp-lzo
verb 3

server.conf:

### connection
port 1194 
proto udp
dev tun
client-to-client

# security
user nobody
group nobody

### keys
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem

### routing
server 10.8.0.0 255.255.255.0
### make sure to include def1
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"

### logging
comp-lzo
keepalive 10 120
status /tmp/openvpn.status

/etc/firewall.user:

iptables -I FORWARD -j ACCEPT

### OpenVPN
iptables -A OUTPUT  -o tun+ -j ACCEPT
iptables -A INPUT   -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
iptables -I OUTPUT  -o tun+ -j ACCEPT
iptables -I INPUT   -i tun+ -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -I POSTROUTING -o tun+ -j MASQUERADE
back