Can no longer get OpenVPN Server to work

[hvoorend]

Hi,

Can’t get my OpenVPN server to respond on my ASUS RT-AC68U. Hope someone can help me out.

I’m running Asuswrt-Merlin 386.14 (latest GA to my information).
My ISP’s fiber modem is a Nokia XS2426G-B (IP 192.168.1.254). The LAN running on the Nokia is 192.168.1.0/24.
DHCP range of the Nokia is 192.168.1.30 - 253.
My ASUS is (via a plain simple Gb-switch) wired connected to the Nokia via one of its 4 yellow switch-ports and has IP 192.168.1.2.
Its Operation mode is “Wireless router”.
Wireless radio is off (As I use the Nokia/TPLink mesh AP’s for wireless) and DHCP is also off in the Asus.
I forwarded port 1194 on my Nokia to 192.168.1.2 (my Asus, where the OpenVPN Server runs).
I have tested Port forwarding for 2 other ports to servers in my LAN (using a DDNS name or my external IP-address) and that works fine.

Whatever I tried, connecting to the VPN Server at port 1194 (from my iPhone) keeps timing out (its log tells time out, not other security related msgs).
So to me it looks like I don’t get to the VPN Server at all (or it is not able to respond). Not sure. Nothing in the Asus log.
Where do I go wrong ?

Thanks in advance for any help.

 

[eibgrad]

If the ASUS is in wireless router mode, then presumably it still has an active WAN (even if NOT connected) and thus has a default gateway that points to that same WAN. That would explain why there's no response to the OpenVPN client. If this was a LAN only device (i.e., AP mode), you would have had to configure the default gateway w/ the LAN ip of the Nokia, and it would be working. But if you configure the ASUS in AP mode, then it disables the OpenVPN server (and most other services).

That's why you're probably better off to have the ASUS bound to the Nokia's IP network over its WAN. It keeps the OpenVPN server available and the default gateway in order.

P.S. Configure the OpenVPN server for either Internet or Both. LAN only will limit access to the ASUS's own IP network, which is of no consequence here.

 

[hvoorend]

If the ASUS is in wireless router mode, then presumably it still has an active WAN (even if NOT connected) and thus has a default gateway that points to that same WAN. That would explain why there's no response to the OpenVPN client. If this was a LAN only device (i.e., AP mode), you would have had to configure the default gateway w/ the LAN ip of the Nokia, and it would be working. But if you configure the ASUS in AP mode, then it disables the OpenVPN server (and most other services).

That's why you're probably better off to have the ASUS bound to the Nokia's IP network over its WAN. It keeps the OpenVPN server available and the default gateway in order.

P.S. Configure the OpenVPN server for either Internet or Both. LAN only will limit access to the ASUS's own IP network, which is of no consequence here.

Thanks eibgrad. In the above config, the WAN port was disabled in the GUI but that seemingly had no effect. I will now explore the possibilities to connect my cable to the WAN port (and enable that port it in the GUI of course). Can you confirm that I need to use a different LAN subnet in the ASUS? (For instance 192.168.2.0/24) and for instance assign the Asus 192.168.2.1?. Because at the first try I assigned my Asus 192.168.1.11 and a GW of 192.168.1.254 (the Nokia) but then for the WAN connections it complains about an IP conflict (although 192.168.1.11 is not used by any other device).

 

[eibgrad]

Can you confirm that I need to use a different LAN subnet in the ASUS? (For instance 192.168.2.0/24) and for instance assign the Asus 192.168.2.1?

Yes. You're just daisy-chaining routers, WAN to LAN, and each must support unique, non-overlapping IP networks.

 

[hvoorend]

If the ASUS is in wireless router mode, then presumably it still has an active WAN (even if NOT connected) and thus has a default gateway that points to that same WAN. That would explain why there's no response to the OpenVPN client. If this was a LAN only device (i.e., AP mode), you would have had to configure the default gateway w/ the LAN ip of the Nokia, and it would be working. But if you configure the ASUS in AP mode, then it disables the OpenVPN server (and most other services).

That's why you're probably better off to have the ASUS bound to the Nokia's IP network over its WAN. It keeps the OpenVPN server available and the default gateway in order.

P.S. Configure the OpenVPN server for either Internet or Both. LAN only will limit access to the ASUS's own IP network, which is of no consequence here.

Yes. You're just daisy-chaining routers, WAN to LAN, and each must support unique, non-overlapping IP networks.

Thanks, I managed to get the WAN connection in the ASUS working and after updating my port forward in the Nokia AND generating and applying new OVPN certificates and keys for the ASUS OVPN, I’m finally able to VPN-connect to my network.
Thanks for putting me on the right track!
Regards, Henny