Commit a8ec6f
2025-11-13 19:06:56 Krzee: sharing workaround for the world| /dev/null .. Fix for site-to-site OpenVPN on ubiquiti unifi routers.md | |
| @@ 0,0 1,66 @@ | |
| + | # Fix for site-to-site OpenVPN on ubiquiti unifi routers |
| + | |
| + | # Background: |
| + | I found that ubiquiti unifi routers break site-to-site by always using the [nathack](https://community.openvpn.net/Pages/NatHack) on the client side network. I got my hands on one and made a workaround which I am documenting here. |
| + | |
| + | # The problem: |
| + | All traffic from the lan to a target over the VPN gets nat’ed to the IP of the vpn client on the router. Even after I fixed that it was also not forwarding traffic from the VPN to the LAN. |
| + | |
| + | # The fix: |
| + | I was able to find the rule that causes the NAT and I was able to find where to insert a rule to allow forwarding from VPN to lan. The harder part was persistence. iptables rules do not persist a reboot, or even an openvpn reconnection. I found a directory named /data/ that can persist my scripts. I found that crontab works but does not persist reboots. I found that if I manually add a service it DOES persist reboots. By chaining this information together I was able to build a persistent fix for this router. |
| + | |
| + | # How to fix: |
| + | |
| + | On the router enable sshd and log in as root to the router over sshd. |
| + | run: |
| + | `mkdir /data/openvpn |
| + | vi /data/openvpn/undo_nathack.sh |
| + | ` |
| + | type i to enter insert mode and paste this: |
| + | |
| + | `#!/bin/bash |
| + | if /usr/sbin/iptables-save | /bin/grep tunovpn | /bin/grep -q MASQUERADE ;then |
| + | /usr/sbin/iptables-save | /bin/grep tunovpn | /bin/grep MASQUERADE | /bin/sed -e "s,-A,-D," | /usr/bin/awk '{system("/usr/sbin/iptables -t nat "$0)}' |
| + | fi |
| + | ! /usr/sbin/iptables-save | /bin/grep -q 'FORWARD -i tunovpnc' && /usr/sbin/iptables -I FORWARD -i tunovpnc+ -j ACCEPT |
| + | ` |
| + | hit ESCAPE then type :x to save and exit vi |
| + | run: |
| + | `vi /data/openvpn/install_cron.sh |
| + | ` |
| + | type i to enter insert mode and paste this: |
| + | |
| + | `#!/bin/sh |
| + | CRON_COMMAND="/bin/sh /data/openvpn/undo_nathack.sh" |
| + | (crontab -l 2>/dev/null | grep -v "$CRON_COMMAND"; echo "* * * * * $CRON_COMMAND > /dev/null 2>&1") | crontab - |
| + | ` |
| + | hit ESCAPE then type :x to save and exit vi |
| + | run: |
| + | `vi /etc/systemd/system/fix-vpn.service |
| + | ` |
| + | type i to enter insert mode and paste this: |
| + | |
| + | `[Unit] |
| + | Description=Fix unifi site-to-site VPN |
| + | Wants=network-online.target |
| + | After=network-online.target |
| + | |
| + | [Service] |
| + | Type=oneshot |
| + | # Run as root user |
| + | User=root |
| + | # Run the installer script |
| + | ExecStart=/bin/sh /data/openvpn/install_cron.sh |
| + | |
| + | [Install] |
| + | WantedBy=multi-user.target |
| + | ` |
| + | hit ESCAPE then type :x to save and exit vi |
| + | run: |
| + | `systemctl daemon-reload |
| + | chmod +x /data/openvpn/install_cron.sh |
| + | chmod +x /data/openvpn/undo_nathack.sh |
| + | systemctl enable fix-vpn.service |
| + | systemctl start custom-vpn-nat.service |
| + | ` |
| + | Now you may turn off ssh in the router if you wish. |