Problem with VPN on Android

[Ferrarista]

I have an Asus AX88U with the latest Merlin firmware (388.4, but I had the same issue with the previous firmware) and I have configured an OpenVPN server on it using a dynamic DNS. When I connect to the VPN server from my laptop (of course from outside the home network) it works like a charm. On the other hand I have configured the OpenVPN client on my phone (Google Pixel 7a with Android 13) using the OpenVPN Connect app. It connects to the server (it even exchanges few bytes) but I have no connection.

 

[Ripshod]

Don't use the openvpn connect app. It's incompatible with the version of the server on your router.
I found "VPN Client Pro" to be more compatible with most openvpn configurations.

 

[Ferrarista]

But it used to work fine on my old phone (Xiaomi Mi9T Pro) that I gave away 1 month ago.

 

[ColinTaylor]

I can't say I've ever had a problem using the OpenVPN Connect app. Look in the app's log file for clues.

 

[Ripshod]

What version of android was on the old phone? That dictates which version of the openvpn actually downloads from Google.
To be honest I'm not sure now. I got so frustrated by it I ended up installing openvpn access server on my home server. What does the client log say (on your phone)?

 

[Ferrarista]

This is the log of my client

[ago 31, 2023, 15:17:25] OpenVPN core 3.git::081bfebe:RelWithDebInfo android arm64 64-bit PT_PROXY

[ago 31, 2023, 15:17:25] ----- OpenVPN Start -----

[ago 31, 2023, 15:17:25] EVENT: CORE_THREAD_ACTIVE

[ago 31, 2023, 15:17:25] Frame=512/2048/512 mssfix-ctrl=1250

[ago 31, 2023, 15:17:25] UNUSED OPTIONS
4 [resolv-retry] [infinite]
5 [nobind]
7 [ncp-ciphers] [AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC]

[ago 31, 2023, 15:17:25] EVENT: RESOLVE

[ago 31, 2023, 15:17:25] Contacting xx.xx.xx.xx:2000 via UDP

[ago 31, 2023, 15:17:25] Connecting to [xxx.ddns.net]:2000 (xx.xx.xx.xx) via UDPv4

[ago 31, 2023, 15:17:25] EVENT: WAIT

[ago 31, 2023, 15:17:25] EVENT: CONNECTING

[ago 31, 2023, 15:17:25] Tunnel Options:V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client

[ago 31, 2023, 15:17:25] Creds: Username/Password

[ago 31, 2023, 15:17:25] Peer Info:
IV_VER=3.git::081bfebe:RelWithDebInfo
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=30
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:BF-CBC
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_GUI_VER=net.openvpn.connect.android_3.3.4-9290
IV_SSO=webauth,openurl,crtext
IV_BS64DL=1


[ago 31, 2023, 15:17:25] VERIFY OK: depth=1, /C=TW/ST=TW/L=Taipei/O=ASUS/OU=Home/Office/CN=RT-AX88U/emailAddress=me@asusrouter.lan, signature: RSA-SHA256

[ago 31, 2023, 15:17:25] VERIFY OK: depth=0, /C=TW/ST=TW/L=Taipei/O=ASUS/OU=Home/Office/CN=RT-AX88U/emailAddress=me@asusrouter.lan, signature: RSA-SHA256

[ago 31, 2023, 15:17:25] SSL Handshake: peer certificate: CN=RT-AX88U, 1024 bit RSA, cipher: TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD


[ago 31, 2023, 15:17:25] Session is ACTIVE

[ago 31, 2023, 15:17:25] Sending PUSH_REQUEST to server...

[ago 31, 2023, 15:17:25] EVENT: GET_CONFIG

[ago 31, 2023, 15:17:26] OPTIONS:
0 [route] [192.168.2.0] [255.255.255.0] [vpn_gateway] [500]
1 [dhcp-option] [DNS] [192.168.2.1]
2 [redirect-gateway] [def1]
3 [route-gateway] [10.8.0.1]
4 [topology] [subnet]
5 [ping] [15]
6 [ping-restart] [60]
7 [ifconfig] [10.8.0.3] [255.255.255.0]
8 [peer-id] [1]
9 [cipher] [AES-256-GCM]
10 [key-derivation] [tls-ekm]


[ago 31, 2023, 15:17:26] PROTOCOL OPTIONS:
  cipher: AES-256-GCM
  digest: NONE
  key-derivation: TLS Keying Material Exporter [RFC5705]
  compress: COMP_STUB
  peer ID: 1

[ago 31, 2023, 15:17:26] EVENT: ASSIGN_IP

[ago 31, 2023, 15:17:26] Connected via tun

[ago 31, 2023, 15:17:26] LZO-ASYM init swap=0 asym=1

[ago 31, 2023, 15:17:26] Comp-stub init swap=1

[ago 31, 2023, 15:17:26] EVENT: CONNECTED info='user@xxxx.ddns.net:2000 (xx.xx.xx.xx) via /UDPv4 on tun/10.8.0.3/ gw=[10.8.0.1/]'

 

[n2ubp]

It it possible that the remote location that you are attempting to connect to your VPN from has blocked VPN traffic? I've seen that in a few large stores in my area. I'm using Open VPN connect on a Motorola g stylus 2022 running Android 12. Seems to be working okay with Merlin Firmware in my Asus RT-AX88U

 

[Ferrarista]

As I said, it works like a charm when I use the Open VPN client from my Windows laptop (Open VPN GUI 11.26)

 

[ColinTaylor]

I compared your VPN client log with mine and they're almost identical. Everything indicates that the connection is successful. The only difference is I have Compression disabled on the server whereas you don't.

Maybe this isn't a VPN issue at all but something else on your phone causing the problem. You say you have "no connection", how are you testing that? Can you ping the tunnel endpoint or your router's IP address?

 

[Ferrarista]

How can I do the ping test on Android?

 

[zer0bitz]

How can I do the ping test on Android?

I use app called PingTools.

PingTools Network Utilities - Apps on Google Play

PingTools - a simple but powerful set of network utilities.

play.google.com

 

[Ferrarista]

I use app called PingTools.

PingTools Network Utilities - Apps on Google Play

PingTools - a simple but powerful set of network utilities.

play.google.com

Ok thanks. What IP or url should I set for the ping test?

 

[ColinTaylor]

Ok thanks. What IP or url should I set for the ping test?

Ping the IP address of your router's LAN interface, 192.168.2.1. Then try pinging Google's DNS, 8.8.8.8.

 

[Ferrarista]

For both addresses, the ping test fails (all packages lost)

 

[ColinTaylor]

Can you ping 10.8.0.1 (while the VPN client is active)?

 

[Ferrarista]

No reply also in this case.

 

[ColinTaylor]

I'm running out of ideas.

When you start the OpenVPN app it shows you "your private IP". From the log you previously posted it was 10.8.0.3 but it may be something like 10.8.0.2. Whatever it is can you ping that address?

 

[Ferrarista]

Ok 10.8.0.3 seems to be the one. If I ping to that address, I get a positive result.

 

[pingu]

Ok 10.8.0.3 seems to be the one. If I ping to that address, I get a positive result.

ColinTaylor spotted that you have compression turned on, did you turn it off (on the server). I had very similar problems with the OpenVPN client app until I turned it off.

 

[Zastoff]

Do you have private DNS enabled/automatic on your android?
I have noticed that i can not get vpn server to work when i have that enabled.

/Zastoff