OpenVPN Client Connection through existing OpenVPN Router Connection causes DISCONNECT

[Viktor Jaep]

Wanted to please get your feedback to understand why I encounter this particular behavior:

Setup:
- Router is connected to OpenVPN provider, routing inbound/outbound internet traffic for entire household on the "Home LAN".
- Laptop (on the "Home LAN") is attempting to make another OpenVPN connection to a different OpenVPN provider, while from within the household network

Diagram:
Internet <--> VPN Provider <--> VPN tunnel/Internet <--> Router (OpenVPN) <--> Home LAN (all traffic routed through VPN) <--> Laptop w/ Separate OpenVPN Client

Problem:
If I initiate a separate OpenVPN connection (to a completely different VPN provider) from my laptop while on the Home LAN, which is already being tunneled through an existing OpenVPN connection established by the router, then the VPN connection on the router will frequently break and disconnect. I'd say it does this about 75% of the time. The other 25% of the time, the VPN tunnel established by the router will hold, while my laptop creates another OpenVPN tunnel through it, to a different VPN provider.

Question:
I'd love to understand (or get your opinion) as to why the VPN tunnel that was established by the router breaks when introducing another OpenVPN tunnel through it. Is there some sort of event or handshake that occurs that might be bleeding over to the main OpenVPN connection that causes it to think the connection was interrupted? If that's the case, then why is it that it can maintain a connection (at times), and am successfully running an OpenVPN tunnel through an existing OpenVPN tunnel that is being maintained by the router itself?

This is one of those things that has been nagging me for years... and would love to get some closure before 2025 starts.

 

[Justinh]

Okay, something is not right. I feel bad for you, Mr. Jaep. I understand people not responding to my posts, but they should respond to your posts!

 

[ZebMcKayhan]

Okay, something is not right. I feel bad for you, Mr. Jaep. I understand people not responding to my posts, but they should respond to your posts!

I don't think (or hope) it has anything to do with who is asking the question. I would guess simply no one has any more information.

I read through the post when it got posted, thougerly, yet I come up with nothing. It, somehow, seems unlikely to have anything to do with the router... yet still...

 

[Tech9]

I understand people not responding to my posts

The reason for no answer is the same. You @Justinh at least listen what is the right thing to do.

 

[Viktor Jaep]

Yeah, I figured I'm just an outlier when it came to this problem. Perhaps someone in a few years will stumble upon this thread themselves, and at least validate that they are seeing the same issue.

***BUT*** if this does turn out to be an actual Asus/Merlin bug, I want me a friggen MERLIN bug bounty shirt(tm)!

 

[Tech9]

Sensing CatnipVPN...

 

[Viktor Jaep]

Sensing CatnipVPN...

View attachment 63118

LOL!

 

[ZebMcKayhan]

I'd love to understand (or get your opinion) as to why the VPN tunnel that was established by the router breaks when introducing another OpenVPN tunnel through it. Is there some sort of event or handshake that occurs that might be bleeding over to the main OpenVPN connection that causes it to think the connection was interrupted?

Well, here is atleast some followup questions that may or may not lead somewhere

1. You say it's a different vpn provider but are you sure they don't share servers?
2. Have you tried different openvpn client software on your computer?
3. Have you tried disabling UPnP IGD & PCP/NAT-PMP on router? Longshot maybe but only thing I could think of that may affect router from lan.

 

[rung]

Is it possible that your VPN provider doesn't like you using the competition? Maybe you need to think of them as a country censor and look into attemping to obfuscate your inner vpn channel?

https://techrobot.com/vpn-obfuscated-servers/

 

[Viktor Jaep]

Well, here is atleast some followup questions that may or may not lead somewhere

1. You say it's a different vpn provider but are you sure they don't share servers?

Pretty sure they don't. One is NordVPN (router), the other is AirVPN (laptop).

2. Have you tried different openvpn client software on your computer?

I've only been using the official Windows client for AirVPN that I got off their site... I guess I could try to see if it would work with the standard OpenVPN Windows client. Good call - I'll give this a try next. The only downside is that I'd need to download configs for specific servers to connect to, instead of picking one from the list within the AirVPN client... but it's worth a try.

3. Have you tried disabling UPnP IGD & PCP/NAT-PMP on router? Longshot maybe but only thing I could think of that may affect router from lan.

These settings have been disabled forever ago.

Is it possible that your VPN provider doesn't like you using the competition? Maybe you need to think of them as a country censor and look into attemping to obfuscate your inner vpn channel?

https://techrobot.com/vpn-obfuscated-servers/

This thought had crossed my mind too... what if they detected it hitting a competitor's VPN server, and issue a kill on the connection. But you'd think they'd get it right every time, not just 75% of the time.

Thanks for the suggestions, @ZebMcKayhan & @rung

 

[dosborne]

Or it's the NSA shutting it down for bouncing through too many VPNs at once.
[Removing tinfoil hat]

 

[CaptainSTX]

Wanted to please get your feedback to understand why I encounter this particular behavior:

Setup:
- Router is connected to OpenVPN provider, routing inbound/outbound internet traffic for entire household on the "Home LAN".
- Laptop (on the "Home LAN") is attempting to make another OpenVPN connection to a different OpenVPN provider, while from within the household network

Diagram:
Internet <--> VPN Provider <--> VPN tunnel/Internet <--> Router (OpenVPN) <--> Home LAN (all traffic routed through VPN) <--> Laptop w/ Separate OpenVPN Client

Problem:
If I initiate a separate OpenVPN connection (to a completely different VPN provider) from my laptop while on the Home LAN, which is already being tunneled through an existing OpenVPN connection established by the router, then the VPN connection on the router will frequently break and disconnect. I'd say it does this about 75% of the time. The other 25% of the time, the VPN tunnel established by the router will hold, while my laptop creates another OpenVPN tunnel through it, to a different VPN provider.

Question:
I'd love to understand (or get your opinion) as to why the VPN tunnel that was established by the router breaks when introducing another OpenVPN tunnel through it. Is there some sort of event or handshake that occurs that might be bleeding over to the main OpenVPN connection that causes it to think the connection was interrupted? If that's the case, then why is it that it can maintain a connection (at times), and am successfully running an OpenVPN tunnel through an existing OpenVPN tunnel that is being maintained by the router itself?

This is one of those things that has been nagging me for years... and would love to get some closure before 2025 starts.

I have noticed the same issue. In my case I would reverse the percentages and say that 75% of the time it works but not always. Unfortunately haven't done a lot testing to isolate why it doesn't always work.

 

[Viktor Jaep]

I have noticed the same issue. In my case I would reverse the percentages and say that 75% of the time it works but not always. Unfortunately haven't done a lot testing to isolate why it doesn't always work.

Thanks for helping put a second set of eyes on this and confirming my hypothesis/problem statement! Perhaps an official MERLIN Bug Bounty Shirt(tm) will be coming your way as well!

 

[Tech9]

You have 4 days and few hours to solve the problem.

 

[Viktor Jaep]

You have 4 days and few hours to solve the problem.

Didn't realize this turned into an episode of "Mission Impossible". Lol

 

[CaptainSTX]

Thanks for helping put a second set of eyes on this and confirming my hypothesis/problem statement! Perhaps an official MERLIN Bug Bounty Shirt(tm) will be coming your way as well!

My unscientific opinion is that some VPN providers block a double VPN on their service. Currently I'm using Strong and I don't seem to have issues though I do try to avoid a double VPN connection.

 

[RMerlin]

Keep in mind that when encapsulating a packet within a packet, the max packet size of the inner one will have to be smaller. So, the inner tunnel might need to have a smaller MTU configured for it.

 

[Viktor Jaep]

Keep in mind that when encapsulating a packet within a packet, the max packet size of the inner one will have to be smaller. So, the inner tunnel might need to have a smaller MTU configured for it.

Checked into this... the VPN running on the router going to Nord is 1500. The AirVPN MTU is set to 1320 by default. So that seems to check out.

 

[RMerlin]

Checked into this... the VPN running on the router going to Nord is 1500. The AirVPN MTU is set to 1320 by default. So that seems to check out.

The Nord tunnel might be fragmented since your WAN MTU is also 1500. Try reducing that tunnel to 1420.

 

[ColinTaylor]

Checked into this... the VPN running on the router going to Nord is 1500. The AirVPN MTU is set to 1320 by default. So that seems to check out.

Regardless of what's happening with the laptop's AirVPN connection as far as the router is concerned it's just regular (UDP?) network traffic. It makes no difference that your laptop is using it for VPN, it could be being used for anything. So I can't see why (only) that would cause your router's VPN to break. The first step would be to examine the router's syslog to determine the reason why the VPN terminated.

P.S. Yes, MTU is the most obvious thing to look at (e.g. tun-mtu 1420). You could also try switching the VPN's to TCP instead of UDP. That should be more resilient albeit at the cost of performance.