Quick question/Public WiFi-VPN

[Ro berto]

I'm connected to a public wifi and have internet, as soon as I connect to my router through the OpenVPN Server I lose internet connectivity but I can connect to my router through SSH.

Is it possible that a public WiFi blocks internet connection on a VPN connection?

 

[ColinTaylor]

If you can connect to your router via SSH though the VPN then there's no reason you shouldn't be able to access the internet also.

I suspect you have configured your VPN server incorrectly. Check the settings of "Direct clients to redirect Internet traffic" and "Advertise DNS to clients".

 

[Ro berto]

Check the settings of "Direct clients to redirect Internet traffic"

I don't have that option (I'm on merlin).

I changed to a different public WiFi and am able to use internet with the VPN.

Attached are my settings.

 

[ColinTaylor]

When you said "I can connect to my router through SSH" did you mean you were connecting through the VPN? Or have you enabled "SSH access from WAN" and were connecting directly to the router?

 

[ColinTaylor]

I don't have that option (I'm on merlin).

You have to switch from Advanced Settings to General.

I changed to a different public WiFi and am able to use internet with the VPN.

Some public hotspots only allow "web" traffic, i.e. ports 80 and 443, or explicitly block VPN (port 1194). That's why some people choose to run their VPN server on port 443 instead of 1194.

 

[Ro berto]

When you said "I can connect to my router through SSH" did you mean you were connecting through the VPN?

yes.

You have to switch from Advanced Settings to General.

ah yes, got you, yeah it's enabled (see pic).

yeah, maybe it was that they were blocking port 1194 (funny, because it's the wifi from flixbus (a transportation company), and with one bus it was blocked, and with the next one it's not blocked).

That's why some people choose to run their VPN server on port 443 instead of 1194.

is there any drawback with this?

thanks for your input Colin

 

[ColinTaylor]

yes.

Then I'm confused as well. The whole point of a VPN is to encrypt the traffic so that it's impossible for anyone else (like the hotspot provider) to examine the data. So there's no way they could distinguish SSH traffic from HTTP. Maybe some sort of temporary routing problem on your router?

ah yes, got you, yeah it's enabled (see pic).

yeah, maybe it was that they were blocking port 1194 (funny, because it's the wifi from flixbus (a transportation company), and with one bus it was blocked, and with the next one it's not blocked).

Seems unlikely (see previous answer). If they had blocked your VPN access on port 1194 your SSH connection wouldn't have worked either.

is there any drawback with this?

Running a VPN server (or anything else) on a common port like 443 will mean that you will see endless connection attempts from port scanners.

 

[Ro berto]

Maybe some sort of temporary routing problem on your router?

yeah most likely, since it makes sense what you say about being impossible to see encrypted data.

 

[Ro berto]

do you think it was related to the following?

I ran the following command on the SSH:

iptables -I POSTROUTING -t nat -s $(nvram get vpn_server1_sn)/24 -o tun12 -j MASQUERADE

and had some problems, so I rebooted the router (I guess with the reboot this command was no longer valid).

(I ran this command so I could use the vpn client when away from home and using the openvpn sever, still trying to figure out how to make a script in openvpn-event so it runs automatically in up and down events)

 

[ColinTaylor]

do you think it was related to the following?

I ran the following command on the SSH:

iptables -I POSTROUTING -t nat -s $(nvram get vpn_server1_sn)/24 -o tun12 -j MASQUERADE

Quite possibly, although without knowing all the other rules and routing tables it's impossible to know for sure. It looks like you're trying to allow VPN server clients access to VPN Client #2.

and had some problems, so I rebooted the router (I guess with the reboot this command was no longer valid).

Yes, rebooting would have removed that rule.