[Howto] Install and configure basic OpenVPN server for Oleg firmware

[wpte]

When I deactivated fastnat then connection became stable.

Well yes, it should be, otherwise openvpn won't work.

[oldgringo]

But up to version r5097 openvpn works also with fastnat set (no matter of value 1 or 2).

[wpte]

But up to version r5097 openvpn works also with fastnat set (no matter of value 1 or 2).

1 or 2?
you mean 0 = off and 1 = on?

According to lly, the proper way to turn it off is by doing:

nvram unset misc_fastnat_x

0 should turn it off though

[oldgringo]

No, I mean:

nvram set misc_fastnat_x=1
nvram commit

for activating of fastnat without url filter (fastest mode)

nvram set misc_fastnat_x=2
nvram commit

for activating of fastnat including url filter (slower, but still active).

By using

nvram unset misc_fastnat_x
nvram commit

fastnat is completely dectivated.

[theMIROn]

nvram set misc_fastnat_x=2
nvram commit

for activating of fastnat including url filter (slower, but still active).

not true nowadays, I've fixed fastnat & urlfiler coexistance to have almost no perfomance penalty and no control from userspace (values 1 or 2 or etc), it works automagically.

hmm... didn't know about the url-filterless option.
Anyway, with fastnat enabled openvpn shouldn't even work. At least, it doesn't for me.
Are you using TAP instead of TUN?

forget it about urlfilter since r5013,
fastnat control can be done via /proc/sys/net/netfilter/nf_conntrack_fastnat, 0 disabled, 1 enabled
fastnat state can be viewed via /proc/sys/net/netfilter/nf_conntrack_fastnat_http, 0 normal, 1 urlfiler-compatible mode
also, you can exclude any connection from being fastnated by iptables "-j MARK --set-mark" or "-j CONNMARK --set/and/or/xor-(x)mark"
issue you've faced with is new due recent tun driver kernel chages, and we need some time to handle it.

[oldgringo]

You're right, since r5099 I can't handle some connections on routers connected through openvpn. It seems that tun interface is somehow broken.