Business Community > Routers > OpenVPN tunnel established but not passing traffic after WAN IP change
< Routers

OpenVPN tunnel established but not passing traffic after WAN IP change

12

OpenVPN tunnel established but not passing traffic after WAN IP change

OpenVPN tunnel established but not passing traffic after WAN IP change
OpenVPN tunnel established but not passing traffic after WAN IP change
a week ago - last edited Thursday
Tags: #OpenVPN #Routing
Model: ER7206 (TL-ER7206)  
Hardware Version: V1
Firmware Version: 1.3.0 Build 20230322 Rel.70951

I have a TP-Link ER7206 router, which was hosting an OpenVPN tunnel for my personal use and it was working fine over the years. Unfortunately, my ISP changed my public IP address. Of course, the new IP is already updated in the router (DHCP reneved it), I generated a new .ovpn profile (yes, it has the new address), and even recreated the entire tunnel from scratch. Still, the same issue persists: the tunnel establishes correctly, I receive an IP address on the client, and I can see the session on the server. However, there is no connectivity – I can't ping the LAN addresses from the client side, nor can I ping the client's assigned IP from the router.

The only thing I've managed to determine on my own is that the problem is likely related to routing on the server side. According to the configuration, the tunnel assigns IP addresses in the 10.5.8.0/24 range, and the client was assigned 10.5.8.6. However, in the router's routing table, I can see a static route: 10.5.8.2 255.255.255.255 0.0.0.0 tun_server2

As mentioned, the tunnel was working fine before. The only thing that changed is the WAN IP. Ports shouldn’t be an issue since the tunnel still establishes. So, what could have caused this to stop working?

 

here is the configuration of my tunnel:
 

 

here are my clients:

and mentioned part of routing table:

 

.ovpn profile (part, with blurred WAN IP)

 

 

  0      
 
  0      
 
#1
Options
1 Accepted Solution
Re:OpenVPN tunnel established but not passing traffic after WAN IP change-Solution
Thursday - last edited Thursday

For closure and for others with similar issues:
The problem was not related to CGNAT - and in fact, I don't have CGNAT at all (which is clearly visible in the tracert output I shared earlier). Still, reading up a bit on CGNAT was helpful and definitely better than panicking early.

Actually, my tunnel was establishing just fine - the only issue was with routing. The route to the tunnel interface was listed as going "to interface" instead of "to address", so it wasn't immediately obvious, but clearly something was wrong.

I removed all existing tunnels, reset the router (including doing the recommended firmware upgrade), created the tunnel again - and voilà, everything works now :)

Thanks for the help and the interesting discussion!

Recommended Solution
  1  
  1  
#12
Options
14 Reply
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
a week ago

  @JarekPrzybyl 

 

try upgrading your router, you have a very old version and a lot has been fixed

 

 

  0  
  0  
#2
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
a week ago
Ok, will try, but have a question: in the meantime I found that my ISP not only changed my public IP, they also put me behind CGNAT. I will try to argue, but what if there will be no way to have back pure public IP? - is OpenVPN able to work fine over CGNAT? - it seems my tunnel is establishing now, so can this CGNAT is a reason of issue described?
  0  
  0  
#3
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
a week ago

  @JarekPrzybyl 

yes of course, with cgnat you have to find other vpn solutions, Omada has no solution for that.

 

  1  
  1  
#4
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
a week ago - last edited a week ago

  @MR.S could you recommend something, from these available? I need a vpn client-site, working with windows and android.

  0  
  0  
#5
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
a week ago

  @JarekPrzybyl 

 

no I don't know anything, luckily I had a public IP, but google vpn cgnat then there are some suggestions for you

 

  0  
  0  
#6
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
Tuesday - last edited Tuesday

  @JarekPrzybyl 

 

Hi,

 

First of all edit your OVPN config file - delete "no" after "comp-lzo".

 

Another thing is, if you have Dynamic WAN IP, you could thing about setting up DynDNS service on Duckdns or FreeDNS Afraid. Then in config file you can stop using your IP but provide the URL from your DynDNS service ;) Therefore, anytime the IP changes, you don't have to rebuild your config file ;)

 

And yeah, you need to have a public IP from your ISP to make the VPN work on daily basis.

 

Best Regards

RR

  1  
  1  
#7
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
Tuesday

  @RaRu no, I haven't dynamic IP, it is fixed public address, but unfortunately currently behind CGNAT. 
I can try, but is there any chance that OpenVPN on Omada router will work through cgnat? According to other comments there is no way...

 

 

  0  
  0  
#8
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
Tuesday

  @JarekPrzybyl 

 

As far as I know you need a public IP assigned to your device (router). So if the public IP is used somewhere else and you just get private IP then no - it won't work with VPN server.

 

You need to ask your ISP to provide you the Public IP, dedicated just for you. It can be Static (then it easier to config) or Dynamic (then DynDNS may be useful).

 

Best Regards

RR

  0  
  0  
#9
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
Tuesday - last edited Tuesday

  @RaRu and this is the point. I have a static public IP, payimng for it and it was working fine for over 10 years. Few days ago my ISP changed my IP and it is still public, still static, but behind of CGNAT. And yes, I'm trying to argue with them.

10.1.1.1 is my router, position 3 is my public IP. 

  0  
  0  
#10
Options
Re:OpenVPN tunnel established but not passing traffic after WAN IP change
Tuesday

  @JarekPrzybyl 

 

With CGNAT i don't thin the VPN will work.

 

From my point of view, your "public" IP is still private - or more like behind the NAT. If that's behind the NAT, then you need to forward some ports. Which I believe will be impossible since that's something what should be done by ISP in that case...

 

IMO you need to work this out with your ISP. You are hosting your own web service (vpn server in that case), therefore you need public IP without NAT.

 

I believe you are polish speaker, so here for example is info from Netia (ISP) showing that hosting own services is impossible behind CGNAT:

 

OFC there are solutions (3rd party) to bypass CGNAT - VPS. But what would complicate your configuration and I don't think it is needed for simple VPN server.

 

You could also try to change the port used by your VPN server. I can see that you are using the default one, sometimes those are blocked by ISP. Try something higher than 50000, usually those are not blocked/occupied. But that's just for testing I guess.

 

Best Regards

RR

  1  
  1  
#11
Options
12

Information

Helpful: 0

Views: 155

Replies: 14

Tags

OpenVPN Routing
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.