Small disclaimer: I’d much rather ask this question in forums.openvpn.net but it appears that the registration page is busted…
I’m trying to set up my home router (an Asus RT-AX55) to act as a VPN server, offering me secure internet access if I’m using, say, a public Wifi at a hotel or something.
Initially I had some issues with the certificates that came pre-installed by the router (too old and, apparently, too short, causing most OpenVPN clients to complain of lax security). I’ve managed to resolve that and now I’m able to establish a connection just fine.
However, I’ve found that while I am able to establish a connection and access resources on my home LAN (like accessing the router’s configuration page or connecting over SSH to the router itself) I cannot actually browse the internet. I’ve verified this both from a laptop hooked up to another network as well as my Android phone (I’m using OpenVPN for Android).
As such I’m fairly certain the problem is likely server-side. Here’s the config.ovpn contents taken from the router via SSH:
# Automatically generated configuration
# Tunnel options
proto udp4
multihome
port 1194
dev tun21
sndbuf 0
rcvbuf 0
keepalive 10 30
up '/etc/openvpn/ovpn-up'
down '/etc/openvpn/ovpn-down'
setenv ovpn_type 0
setenv unit 1
script-security 2
daemon vpnserver1
verb 3
status-version 2
status status 10
compress lzo
plugin /usr/lib/openvpn-plugin-auth-pam.so openvpn
# Server Mode
server 10.8.0.0 255.255.255.0
duplicate-cn
push "route 192.168.50.0 255.255.255.0 vpn_gateway 500"
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.50.200"
# Data Channel Encryption Options
auth SHA1
cipher AES-128-CBC
# TLS Mode Options
ca ca.crt
dh dh.pem
cert server.crt
key server.key
# Custom Configuration
Yes – the first line clearly states the configuration is automatically generated (likely via the router configuration page), so editing the file probably won’t work long-term. However, I can’t see any major faults of this configuration that would pop up at me that would explain the lack of internet connectivity.
Is there anything this configuration is missing that should be added so that I could use the home router as a gateway for accessing the internet? If I know what setting is missing I can either add it using the Custom configuration section (GUI has a text-field for this) or just play around with the GUI settings with the hope that one of the settings is what I’m looking for…
EDIT:
I was thinking this could be something to do with the routing on the router itself. Here’s the routing table, but it also looks OK to me…
Destination Gateway Genmask Flags Metric Ref Use Type Iface
default <WAN GW> 0.0.0.0 UG 0 0 0 WAN0 eth0
1.0.0.1 <WAN GW> 255.255.255.255 UGH 1 0 0 WAN0 eth0
1.1.1.1 <WAN GW> 255.255.255.255 UGH 1 0 0 WAN0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun21
<WAN broadcast> * 255.255.255.252 U 0 0 0 WAN0 eth0
<WAN GW> * 255.255.255.255 UH 0 0 0 WAN0 eth0
192.168.50.0 * 255.255.255.0 U 0 0 0 LAN br0
EDIT 2:
More strangeness when I try to ping stuff from my laptop when the OpenVPN connection is active. I can ping and receive responses fine. I can ping known IP addresses such as 1.1.1.1 or 8.8.8.8, and it seems DNS resolution is also working fine (nslookup returns sensible results). However, attempting to open a web page in any browser will fail (PowerShell Invoke-WebRequest will fail as well).
tracert also seems to show sensible results, with the OpenVPN IP range being the first hop (10.8.0.1) and continuing through my ISPs devices (at least judging by the resolved names that contain the ISP name).
For the record, I do not think it’s my ISP blocking anything. I was able to set up an IPSec VPN from the router and that works without any issues (it’s more annoying to set up, however, both on Windows and Android, so I’d still rather get OpenVPN working).
I’ve also double checked the WiFi settings on both the phone and the laptop – everything’s standard with DHCP-assigned IPs and DNS servers. But it’s worth noting that the issues on the Android phone occur even when using a mobile data plan (rather than a public WiFi) which very strongly points to a configuration issue on the server / router.
