OpenVPN Server behind ISP Router - can't connect

[michael4]

Hi,

Following on from my earlier post https://www.snbforums.com/threads/remote-vpn-access-to-my-home-vpn.77019/ (thanks a lot for all responses),
I've got the following set-up:
1. ISP router with a public IP
2. GL.iNet GL-AR300M16 (GL-AR300M Series / Shadow) router with an OpenVPN server setup and running

The ISP router is set-up as a bridge. With a router mode, the IP is private, and when connected to it directly or through the Shadow router (without OpenVPN), I can see it's private:

However with a bridge mode it changes to public:

The Shadow router is connected as a repeater:

When I configure and export OpenVPN file I get:

The IP in line 4 is what I see when googling my IP address.

I can start the server but I can't connect it. I've tried different ways:
- from Android phone and Windows laptop
- from the same WiFi (connecting to the Shadow router) and through another internet provider

In all cases I can't connect.

Do you have suggestions what I'm doing wrong?

Thanks a lot!

 

[ColinTaylor]

However with a bridge mode it changes to public:

That is not a public IP address. That is a CGNAT address. That is why it is different than the 89.x.x.x address. You will not be able to connect to your VPN server.

 

[michael4]

That is not a public IP address. That is a CGNAT address. That is why it is different than the 89.x.x.x address. You will not be able to connect to your VPN server.

Thanks for your reply!

Is this something that ISP provides or something that can be changed, for example, if I replace the ISP router with my own modem/router with a VPN server?

 

[ColinTaylor]

This is a consequence of how your ISP is providing your connection. There is nothing you can do at your end to change it.*** Sometimes if you speak to your ISP they can change you to a public IP address.

*** In certain circumstances where ISP's are running a mixed public/CGNAT infrastructure you might be able to change your WAN IP address by using a different MAC address. If you're very lucky this new IP address might not be CGNAT. But this is often just a temporary botch. You really need to talk to your ISP.