First time VPN Server (remote access for IPCAM) help

[Geo92]

Hello all,

After having an IPCAM installed (via ethernet, not Wifi) and temporarily blocked all access of internet from it, until I have a more secure way to remote access, via my ISP router (Fritzbox 7590). I wanted to achieve a secure remote access from anywhere on the world on my mobile.

What I have done thusfar and that is working is this:
-Bought and installed a ASUS RT-AC87U router, put it behind the Fritzbox 7590 (which was turned into a modem with the PPPoE passthrough). Everything works thusfar.
-Configured a DDNS, and configured OpenVPN server (LAN/Internet on both in the router settings of AC87U), and clientside on a mobile phone.

The problem:
It works fine while I am connected to the home network locally. VPN server and client is working fine. However, when I try on 4G connection, VPN fails to connect. At this point I feel like I might have missed something, I don't know what has to be done to form a remote connection via the internet to my VPN server and access my IPCAM?

It's the first time I am trying to set this up.

Also: At this point I have the IPCAM and NVR still connected via ethernet on the Fritzbox, as it is on an entirely different gateway and IPRange than the devices on the AC87U. I wasn't sure, but I figured as they are on seperate gateways, they wouldn't be able to communicate with the other network devices on the AC87U. As it is something I aim for, seperation between IPCAM/NVR and the rest. Unless I am mistaken, because the AC87U and fritzbox are still connected via WAN of course. It is not my area of expertise so I am not sure.

 

[ColinTaylor]

Open the .ovpn file that you created on your router and sent to your client with a text editor. Near the top should be a line that starts with "remote". Look at the name/address that follows it. If it's a name replace it with your router's WAN IP address. e.g.

remote 82.111.222.333 1194

 

[CaptainSTX]

Open the .ovpn file that you created on your router and sent to your client with a text editor. Near the top should be a line that starts with "remote". Look at the name/address that follows it. If it's a name replace it with your router's WAN IP address. e.g.

remote 82.111.222.333 1194

This will only work long term if you have a static public IP.

For long term connectivity you need to get your DDNS working and test that it will resolve to your router's public WAN IP.

remote xxxxxxxxx.asuscomm.com 1194 where the xxx represents the free DDNS offered by ASUS.

 

[Geo92]

Open the .ovpn file that you created on your router and sent to your client with a text editor. Near the top should be a line that starts with "remote". Look at the name/address that follows it. If it's a name replace it with your router's WAN IP address. e.g.

remote 82.111.222.333 1194

Looks like something is blocking it, I get "No route to host (code=113". Which means I haven't forwarded something. I know I need to forward the 1194 UDP port, but I am a bit lost at to the exact cause. Because I don't know if I need to forward it in my Fritzbox or in my AC87U router or both. Or if something between the two is wrong.

edit: yes I have a DDNS setup aswell.

 

[ColinTaylor]

Looks like something is blocking it, I get "No route to host (code=113". Which means I haven't forwarded something. I know I need to forward the 1194 UDP port, but I am a bit lost at to the exact cause. Because I don't know if I need to forward it in my Fritzbox or in my AC87U router or both. Or if something between the two is wrong.

edit: yes I have a DDNS setup aswell.

You previously said that your Fritzbox was acting only as a modem. If that's true then you don't need any port forwarding on the Fritzbox. In any case you definitely don't need port forwarding on the Asus.

As @CaptainSTX said, if you're using a DDNS name make sure it is resolving to your Asus' public IP address.

 

[Geo92]

You previously said that your Fritzbox was acting only as a modem. If that's true then you don't need any port forwarding on the Fritzbox. In any case you definitely don't need port forwarding on the Asus.

As @CaptainSTX said, if you're using a DDNS name make sure it is resolving to your Asus' public IP address.

Yes, apparently it isn't just acting as a modem. I assumed it did, because the instructions told me it would when I activated PPPoE. However, I just tried a port forward of that in the Fritzbox. And the error of "No route to host" is gone, however it seems to be stuck on UDP link local: (not bound) and then UDP link remote: with my IP. And it's stuck.

I feel I am getting closer to the cause of the problem, but I don't quite understand why the Fritzbox is still functioning as a router. So it seems it's a router behind a router/modem at this point.

 

[CaptainSTX]

On the network map page on your ASUS router what is your IP? Public or private?

Also underneath the IP it should show if your DDNS is connected and resolved. If you are seeing an orange teardrop then you are in a double NAT and port forwarding is going to be necessary from the first router to the ASUS router.

 

[Geo92]

On the network map page on your ASUS router what is your IP? Public or private?

Also underneath the IP it should show if your DDNS is connected and resolved. If you are seeing an orange teardrop then you are in a double NAT and port forwarding is going to be necessary from the first router to the ASUS router.

The WAN IP listed on the Asus router on that page displays a local/private IP (192.168.178.20), which was decided by the Fritzbox. Yes, the DDNS is fine. And I checked the DDNS, it does forward to my real public IP. No orange tear drop, though on the page.

EDIT: Ok guys, thanks. I fixed it. Had to open the ports on both sides. Now it allows me to connect from an outside Wifi/4G.