Solved Asus RT-AC86U OpenVPN server behind ISP modem

[eibgrad]

Not sure how to do that


... y e s . . . because I haven't had any good reason to change it, but if MArlin would make my life easier, I wouldn't have any problem to try it out

I'm assuming the ASUS OEM/stock firmware doesn't support PBR. Once you install Merlin's firmware and configure the OpenVPN client, you can enable Policy Routing (it's an option) and specify the local IP network (e.g., 192.168.1.0/24) as a rule so it gets routed over the VPN. Anything else defaults to the WAN. The benefit is that the use of PBR takes the router off the VPN, so your OpenVPN server can be reached. Plus, you can implement a kill switch as a bonus (to prevent clients of the VPN from ever gaining access to the WAN, for example, if the VPN fails).

 

[L&LD]

@jorgemarmo, yes, it will make your life easier.

Download | Asuswrt-Merlin (asuswrt-merlin.net)

Best Practice Update/Setup Router/AiMesh Node(s) 2021

 

[jorgemarmo]

(e.g., 192.168.1.0/24)

newbie question, what does the "24" stands for?

@jorgemarmo, yes, it will make your life easier.

I will, not this weekend, but on Monday I'll do that... I'll get a Merlin without getting into a boat..... sorry is 2:42am here....

 

[L&LD]

The '24' refers to the subnet. It means subnet 255.255.255.0

CIDR and Subnetting | ITGeared.com

 

[jorgemarmo]

@L&LD @ColinTaylor @eibgrad
Thank you for your help.
I will move to Merlin on next week, and most likely I will post again to get some help adding the Policy routing and the kill switch.

 

[jorgemarmo]

for anyone else reading this thread, I found this: https://www.snbforums.com/threads/openvpn-server-and-client-connect-from-wan.70110/
which relates directly to what I'm trying to achieve

If I recall correctly, I think you should use "Policy Rules" iso "Policy Rules Strict" (if it works for you, credit goes to @Jack Yaz)

 

[jorgemarmo]

Just a follow-up:
- I installed Merlin 386.1: pretty straight forward
- I followed up this https://support.nordvpn.com/Connectivity/Router/1047410642/AsusWRT-Merlin-setup-with-NordVPN.htm to set up the VPN client (a bit different than for stock firmware)
- I added all Asus-wrt traffic under VPN, I expressly excluded the wrt itself (I guess kind of redundant, but I saw it on some other post that I cannot recall). I activated the KillSwitch

- I enabled the VPN Server and everything works like a charm!
- side note: on the laptop if I connected to NordVPN (for my internet traffic) OpenVPN was unable to connect, so I had to add it to the "Split tunneling" "Trusted apps" and again, working like a charm.

 

[eibgrad]

Just a follow-up:
- I installed Merlin 386.1: pretty straight forward
- I followed up this https://support.nordvpn.com/Connectivity/Router/1047410642/AsusWRT-Merlin-setup-with-NordVPN.htm to set up the VPN client (a bit different than for stock firmware)
- I added all Asus-wrt traffic under VPN, I expressly excluded the wrt itself (I guess kind of redundant, but I saw it on some other post that I cannot recall). I activated the KillSwitch

View attachment 30537​

- I enabled the VPN Server and everything works like a charm!
- side note: on the laptop if I connected to NordVPN (for my internet traffic) OpenVPN was unable to connect, so I had to add it to the "Split tunneling" "Trusted apps" and again, working like a charm.

Glad you got things working. But I just want to follow-up given what I now see are your PBR rules. For the following, I'm assuming 192.168.2.1 is the LAN ip of the router.

I *believe* the higher placed rules take precedence over the lower ones. Therefore, the second rule will never be executed given the first rule implicitly includes 192.168.2.1.

So let's say you switch the rules, making the first rule the second, and vice versa. A quirk of using PBR is that it takes the router itself OFF the VPN! IOW, all its internal processes that are directed upstream to the internet are bound to the WAN anyway, making (what is now) the first rule superfluous. But even if that wasn't the case, realize that specifying the router's *LAN* ip as a source in PBR is never going to work since its internal processes directed upstream to the internet are not bound to the LAN network interface anyway! They're bound to either the WAN or VPN network interfaces.

That's what makes it confusing and difficult for those new to PBR. You have to understand the consequences of using PBR, both wrt the clients behind the router, and the router itself. And the effect of how rules are ordered. And understand that the router's internal processes are usually bound to the WAN/VPN, not the LAN. All these factors come into play. And if you fail to appreciate them, you may get unexpected behavior/results.

Bottomline; you can eliminate the 192.168.2.1 rule. Now all devices in the 192.168.2.x network (except the router itself) will be bound to the VPN.

 

[ColinTaylor]

I *believe* the higher placed rules take precedence over the lower ones. Therefore, the second rule will never be executed given the first rule implicitly includes 192.168.2.1.

I've never tested it but according to the PBR wiki the WAN rules take precedence over the VPN rules. @jorgemarmo's rules are the same as the example shown at the bottom of the wiki page.

 

[eibgrad]

I've never tested it but according to the PBR wiki the WAN rules take precedence over the VPN rules. @jorgemarmo's rules are the same as the example shown at the bottom of the wiki page.

I've not tested it either. I was only considering the order, but if the network interface plays a role too, that's good to know. Thanks.