OpenVPN tunnel established but not passing traffic after WAN IP change
OpenVPN tunnel established but not passing traffic after WAN IP change

I have a TP-Link ER7206 router, which was hosting an OpenVPN tunnel for my personal use and it was working fine over the years. Unfortunately, my ISP changed my public IP address. Of course, the new IP is already updated in the router (DHCP reneved it), I generated a new .ovpn profile (yes, it has the new address), and even recreated the entire tunnel from scratch. Still, the same issue persists: the tunnel establishes correctly, I receive an IP address on the client, and I can see the session on the server. However, there is no connectivity – I can't ping the LAN addresses from the client side, nor can I ping the client's assigned IP from the router.
The only thing I've managed to determine on my own is that the problem is likely related to routing on the server side. According to the configuration, the tunnel assigns IP addresses in the 10.5.8.0/24 range, and the client was assigned 10.5.8.6. However, in the router's routing table, I can see a static route: 10.5.8.2 255.255.255.255 0.0.0.0 tun_server2
As mentioned, the tunnel was working fine before. The only thing that changed is the WAN IP. Ports shouldn’t be an issue since the tunnel still establishes. So, what could have caused this to stop working?
here is the configuration of my tunnel:
here are my clients:
and mentioned part of routing table:
.ovpn profile (part, with blurred WAN IP)
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
For closure and for others with similar issues:
The problem was not related to CGNAT - and in fact, I don't have CGNAT at all (which is clearly visible in the tracert output I shared earlier). Still, reading up a bit on CGNAT was helpful and definitely better than panicking early.
Actually, my tunnel was establishing just fine - the only issue was with routing. The route to the tunnel interface was listed as going "to interface" instead of "to address", so it wasn't immediately obvious, but clearly something was wrong.
I removed all existing tunnels, reset the router (including doing the recommended firmware upgrade), created the tunnel again - and voilà, everything works now :)
Thanks for the help and the interesting discussion!
- Copy Link
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
@RF_Dude my current, working profile (with sanitized WAN IP): client dev tun proto udp float nobind cipher AES-128-CBC comp-lzo no resolv-retry infinite remote-cert-tls server persist-key auth-user-pass explicit-exit-notify remote 80.x.x.x 1194 <ca>
a bit different, I believe difference is connected to upgrade of my ER done in between. As a result - currently works with actual openvpn client (before I had to use older version).
If your issue is also caused by change of WAN IP, try to use my method:
- remove all the tunnels created on the router (I think it can be important for removing "tunnel" interface used in the route table)
- reboot router, maybe upgrade the software
- create needed tunnel from the scratch.
- Copy Link
- Report Inappropriate Content
@JarekPrzybyl Your parameters, like others that I've tried, work and show VPN Active under Insight > VPN Status. I'm using Private Internet Access provider (PIA). Seems an address is assigned. This "remote local ip" changes once in a while.... curiously, the 2nd octet changes.
Important to note that the Default WAN remains without VPN for all traffic, and there is only WAN3 in use over DSL (dynamic public IP). I've created a new Interface for the VPN with a PVID 9 and exposed it on a spare LAN port. .
NO traffic flows. This seems like a common complaint of many looking for OpenVPN support. in the least, VPN handshaking should be accumulating bytes of traffic.
A local university has a /16 block of public IP's assigned to them. I'm testing the VPN by creating a STATIC ROUTE to 141.117.126.20 via VPN_Austria which is my VPN test case, sending the traffic overseas to make it obviously different than locally routed. Using Tools > Network Test > traceroute to ping via Gateway > Interface VPN_Austria to 141.117.126.20 I get 1 10.5.121.1 (10.5.121.1) 2997.976 ms !H 2998.364 ms !H 2999.680 ms !H Host is Unreachable. This could be due to it being a different VLAN, and perhaps I have to physically access the port it is untagged at to use it, not available via Tools? My router located 3 hours away, so I'll check this when I go there.
That is where I'm at and from what I understand from this forum... many others experiencing the same. Many seem to get the VPN status UP, but a route out is missing, meaning no data flow. Thanking anyone for their insight or potential solution vectors to try.
Omada Router is ER7212PC v1.0 / 1.3.1 / 5.14.34.4.
- Copy Link
- Report Inappropriate Content

Information
Helpful: 0
Views: 169
Replies: 14
Voters 0
No one has voted for it yet.