VPN server was working, now isn't.... ideas?

[webreaper]

Hi all,

I have an OpenVPN server configured on my AC-RT68U, mainly so I can access a couple of things from my phone while out and about (Sonarr, Radarr, etc). It was working fine for a couple of months, but recently I can no longer access my home LAN via the VPN server. I'm not really sure where to look or how to debug what's going on.

Things I've tried:
- I'm running the latest firmware (380.66_6) and OpenVPN software on my phone
- I've tried pinging my Synology NAS and other devices from the phone via the VPN, but nothing. Traceroute shows the first hop fails.

I also tried upgrading TunnelBlick on my Mac, but it can't seem to read the latest .ovpn file from Asus-Merlin - I presume that's because Merlin is using a newer version of OpenVPN with options that TunnelBlick can't figure out?!

Really stuck on this, so wondering if anyone's written a guide to configuring this simply. It shouldn't be rocket science, but I'm flailing (and it's even more frustrating that at some point earlier this year it was working!!).

Thanks!

 

[martinr]

Firstly, which smartphone are you using? Secondly, are you trying to connect via 3/4G or via a remote wireless network (or both)?

Can you post the connection log - if there is one - on your phone, even if it's just a screengrab; it might give a clue about what's causing the failure?

As for things like upgrading Tunnelblick on your Max etc, maybe it's best to avoid changing too many things in the hope one of them will fix things, because you're likely to then end up with a series of glitches and then you'll be up Sh*t Creek without a paddle.

 

[webreaper]

Thanks for your help and reply.

I figured it out in the end. I have an outgoing VPN client (which uses policy-based routing to direct traffic for certain devices), and the incoming VPN server, and it looks like the traffic was coming in over the WAN, but then being routed back out over the VPN, so getting lost.

I added a new route to the VPN client: 192.168.0.0/24 => 10.8.0.0/24 => WAN, and now it seems to work.

 

[martinr]

Excellent. Many thanks for reporting back; someone in the future will, I'm sure, find it helpful.