DD-WRT OpenVPN Daemon Settings

http://pantestmb.blogspot.ro/2013/04/dd-wrt-openvpn-router-to-router.html
http://pantestmb.blogspot.ro/2013/04/setup-openvpn-client-to-connect-to-dd.html

Services
VPN
OpenVPN Daemon
OpenVPN Config : 

# Servers LAN route 
## Push route to server subnet onto all clients
push "route 192.168.61.0 255.255.255.0"
#
## Clients LAN route 
route 192.168.101.0 255.255.255.0 172.16.0.2
route 192.168.33.0 255.255.255.0 172.16.0.2
route 192.168.62.0 255.255.255.0 172.16.0.2
route 192.168.15.0 255.255.255.0 172.16.0.2
#
## Bug workaround, this is fixed in r17685
client-config-dir /tmp/openvpn/ccd
#
server 172.16.0.0 255.255.0.0
dev tun0
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001

Administration
Commands
Startup

mkdir -p /tmp/openvpn/ccd
echo "iroute 192.168.15.0 255.255.255.0" > /tmp/openvpn/ccd/bac15cli4res
echo "iroute 192.168.33.0 255.255.255.0" > /tmp/openvpn/ccd/dev03cli4res
echo "iroute 192.168.62.0 255.255.255.0" > /tmp/openvpn/ccd/buc06cli4res

Firewall

iptables -I INPUT -p tcp --dport 1194 -j ACCEPT
iptables -I INPUT -p tcp --source 192.168.61.0/24 -j ACCEPT
iptables -I INPUT -p tcp --source 192.168.101.0/24 -j ACCEPT
iptables -I INPUT -p tcp --source 172.16.0.0/16 -j ACCEPT
iptables -I INPUT -i tun0 -p icmp -j ACCEPT
iptables -I FORWARD --source 172.16.0.0/16 -p icmp -j ACCEPT
iptables -I FORWARD --source 192.168.15.0/24 -p icmp -j ACCEPT
iptables -I FORWARD --source 192.168.61.0/24 -p icmp -j ACCEPT
iptables -I FORWARD --source 192.168.62.0/24 -p icmp -j ACCEPT
iptables -I FORWARD --source 192.168.101.0/24 -p icmp -j ACCEPT
iptables -I FORWARD -p tcp --source 172.16.0.0/16 -j ACCEPT
iptables -I FORWARD -p tcp --source 192.168.101.0/24 -j ACCEPT
iptables -I FORWARD -p tcp --source 192.168.61.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

If there is a gateway server - a routing command can be used :
route add -net 192.168.15.0 netmask 255.255.255.0 gw 192.168.16.49

Setup OpenVPN Client to connect to DD-WRT OpenVPN Service

We consider that we have an ASUS RT-N16 wireless router with the following firmware installed :
" DD-WRT v24-sp2 (08/07/10) vpn "

( some day  I will write an article about how I've installed DD-WRT firmware and configured OpenVPN service in ASUS RT-N16 ) 

First of all , we must choose to install a stable OpenVPN version : 2.1.4 ;
Can be downloaded from : 

http://openvpn.net/index.php/open-source/downloads/471-old-releases.html

http://swupdate.openvpn.org/community/releases/openvpn-2.1.4-install.exe
After installation , OpenVPN-GUI can be run as administrator if there are problems ; 

Setting up OpenVPN Client to connect to DD-WRT OpenVPN Service we have to create or to already have : 

1) a configuration file ("ita2cli4resita2asus.ovpn")
2) a router certificate  ("ca_resita2asus.crt")
3) a openvpn client certificate ("ita02cli4res.crt")
4) a client key file = ("ita02cli4res.key")

We can follow the steps from : howtogeek.com

The problem in that article is that after you create some keys and certificates and if after 

a while you want to create for one more user , you have to recreate all the keys and certificates for all client users ... 

So , lets see the steps to create config , key and certificate for one client user ; 

Then close the command window , restart Windows and after that try to create just one more : 

Let's assume that we are using Windows 7 - 64 bit edition ;

Under Accessories there is "Command Prompt" ;
Right click on it and click Run as administrator.

DO RUN : "cd c:\Program Files (x86)\OpenVPN\easy-rsa"

( open-vpn client 32 bit edition on a Windows 7 64 bit ) 

for the last client , created after a Windows restart

do not run : "init-config"

do not edit vars.bat file   

do not run : "clean-all"

DO RUN : "build-key ita02cli4res"

Just be sure to enter ita02cli4res as the Common Name when prompted. 

We don't have to recreate the server key : 

do not run : build-key-server server

do not run :  build-dh