Solved How to find out what blocks AdGuard VPN?

[XIII]

When my mobile devices are on the WiFi network of my ASUS router (which is in the DMZ of the router of my ISP) AdGuard VPN can't load servers or connect to the VPN. If I connect those devices directly to the ISP's router or I put them on cellular, AdGuard VPN works fine. So clearly something I run on the ASUS router is blocking AdGuard, but what?

I run NextDNS and SkyNet on that ASUS router, but their log files show no blocked requests when I try to enable AdGuard VPN on my mobile devices.

How can I discover what on the ASUS router is blocking AdGuard VPN?

 

[dave14305]

Can you confirm that “Block Bypass Methods” is disabled in your NextDNS console page?

 

[XIII]

Yes, Block Bypass Methods is disabled.

Also should have mentioned that other VPN's do work.

 

[eibgrad]

I know nothing about AdGuard VPN, but based on a quick peak of their website, it appears they're using IPSec.

AdGuard VPN for routers | How to set up a VPN on a router

Learn how to set up a VPN on a router and protect your entire network with AdGuard VPN

adguard-vpn.com

Do you have IPSec passthrough enabled? (WAN->NAT Passthrough).

 

[XIII]

Yes, IPSec Passthrough is enabled.

 

[eibgrad]

If you have IPSec Passthrough still enabled on the ISP router, try disabling it. Protocols like IPSec, PPTP, L2TP, etc., are known to have issues w/ NAT, so a double NAT situation doesn't help matters. I'm just wondering if the ISP router is seeing the IPSec traffic and messing w/ it when you want it to simply be handled by your own router. Just speculating at this point.

 

[XIII]

Enabled or Disabled for that setting does not seem to make any difference; problem occurs with either setting.

 

[XIII]

I need to perform some more tests, but I might have found the culprit after a lot of testing today:

NextDNS was blocking the ".live" TLD in the security settings and apparently AdGuard VPN needs to connect to rawdifficulty.live...

(I think ".live" got added when I set up NextDNS and added the Spamhaus top 10 most abused TLDs?)

 

[XIII]

No more issue today, so it was indeed NextDNS blocking that single domain...