# Fix for site-to-site OpenVPN on ubiquiti unifi routers

# Background
I found that ubiquiti unifi routers break site-to-site by always using the [nathack](https://community.openvpn.net/Pages/NatHack) on the client side network. I got my hands on one and made a workaround which I am documenting here.

# The problem
All traffic from the lan to a target over the VPN gets nat’ed to the IP of the vpn client on the router. Even after I fixed that it was also not forwarding traffic from the VPN to the LAN.

# The fix
I was able to find the rule that causes the NAT and I was able to find where to insert a rule to allow forwarding from VPN to lan. The harder part was persistence. iptables rules do not persist a reboot, or even an openvpn reconnection. I found a directory named /data/ that can persist my scripts. I found that crontab works but does not persist reboots. I found that if I manually add a service it DOES persist reboots. By chaining this information together I was able to build a persistent fix for this router.

# How to fix

On the router enable sshd and log in as root to the router over sshd.

run:

```
mkdir /data/openvpn`
vi /data/openvpn/undo_nathack.sh
```

type i to enter insert mode and paste this:

```
#!/bin/bash
if /usr/sbin/iptables-save | /bin/grep tunovpn | /bin/grep -q MASQUERADE ;then
 /usr/sbin/iptables-save | /bin/grep tunovpn | /bin/grep MASQUERADE | /bin/sed -e "s,-A,-D," | /usr/bin/awk '{system("/usr/sbin/iptables -t nat "$0)}'
fi
! /usr/sbin/iptables-save | /bin/grep -q 'FORWARD -i tunovpnc' && /usr/sbin/iptables -I FORWARD -i tunovpnc+ -j ACCEPT
```

hit ESCAPE then type :x to save and exit vi

run:

`vi /data/openvpn/install_cron.sh`

type i to enter insert mode and paste this:

```
#!/bin/sh
CRON_COMMAND="/bin/sh /data/openvpn/undo_nathack.sh"
(crontab -l 2>/dev/null | grep -v "$CRON_COMMAND"; echo "* * * * * $CRON_COMMAND > /dev/null 2>&1") | crontab -
```

hit ESCAPE then type :x to save and exit vi

run:

`vi /etc/systemd/system/fix-vpn.service`

type i to enter insert mode and paste this:

```
[Unit]
Description=Fix unifi site-to-site VPN
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
User=root
ExecStart=/bin/sh /data/openvpn/install_cron.sh

[Install]
WantedBy=multi-user.target
```

hit ESCAPE then type :x to save and exit vi

run:

```systemctl daemon-reload
chmod +x /data/openvpn/install_cron.sh
chmod +x /data/openvpn/undo_nathack.sh
systemctl enable fix-vpn.service
systemctl start custom-vpn-nat.service
```

Now you may turn off ssh in the router if you wish.