Asus AC-68U. Unable to setup VPN Server

[abrac365]

I'm unable to setup vpn SERVER on the router.
I enable openvpn and generate ovpn configuration file. I then feed this file to the openvpn executable on clients. The connection from the clients fails.
1. My wan ip is like 123.123.123.123--from ISP
2. My lan ip is 192.x.x.x --private
3. My vpn client ip visible on the internet is like 200.200.200.200--from my vpn provider
4. ovpn file has the REMOTE ip as 100.x.x.x --meaning different from either vpn providers or ISP!
In the setup above would the fact that vpn client is enabled affect the connectivity. Meaning my visible ip on the internet is different from my real ip provided by my ISP
the 100.x.x.x ip in the generated ovpn is different from either my 'fake' ip and also from my real ip. Is that correct?
I have also tried replacing 100.x.x.x with both 200.200.200.200 and also 123.123.123.123, but neither helped
I am getting message about port forwarding due to my private network being 192.168.1.x. I've enable port forwarding for vpn port ->192.168.1.1 which is my routers private LAN address but that also didn't help.

 

[Zonkd]

Keep the VPN server disabled until you're 100% sure you've done it correctly. If you know your ISP is allocating you a dynamic WAN IP address (ie. one that changes whenever you reboot the router) then you'll need to run the DDNS on your router so you've always got a domain name pointing to your current WAN IP. Then you'd export the client config file and modify it in a plain-text editor to include that domain name as your remote IP server, rather than the IP address. DNSOMATIC is a good service to use if you've purchased your own domain name from a registrar like Namecheap. Once the VPN server is actually running, use a client inside your LAN (ie, mobile phone via cellular) to test connection to your VPN server.

 

[abrac365]

so with vpn client ENABLED which ip should VPN server be configured with the IP thats assigned by my IPS or IP that's assigned by my VPN provider?
from ovpn doesn't seem like it's either but some third unknown ip address that in the ovpn file.

 

[ColinTaylor]

3. My vpn client ip visible on the internet is like 200.200.200.200--from my vpn provider

What? It sounds like you're using a VPN client through another VPN service? The client device should be running the OpenVPN client software. The client should be connected directly to the internet, not routed through an internet VPN service.

 

[abrac365]

What? It sounds like you're using a VPN client through another VPN service? The client device should be running the OpenVPN client software. The client should be connected directly to the internet, not routed through an internet VPN service.

no, i meant my router is already running vpn client.
https://www.asus.com/us/support/FAQ/1011232/
I ALSO want to configure VPN server in WebUI to be able to connect to my home network over internet.

 

[ColinTaylor]

4. ovpn file has the REMOTE ip as 100.x.x.x --meaning different from either vpn providers or ISP!

IP addresses between 100.64.0.1 and 100.127.255.254 are used for Carrier-grade NAT which means your router is not directly connected to the internet. Therefore you will not be able to connect to your VPN server.

EDIT: Do you see this 100.x.x.x address in the router's GUI as its WAN IP address?

 

[abrac365]

IP addresses between 100.64.0.1 and 100.127.255.254 are used for Carrier-grade NAT which means your router is not directly connected to the internet. Therefore you will not be able to connect to your VPN server.

EDIT: Do you see this 100.x.x.x address in the router's GUI as its WAN IP address?

yes my wan ip is listed as 100.x.x.x

 

[ColinTaylor]

yes my wan ip is listed as 100.x.x.x

Then, to put it bluntly , you're scr*wed. What sort of cable modem is your router connected to? Maybe you can put it in "bridge mode", or speak to your ISP and ask for a public IP address.

 

[abrac365]

Then, to put it bluntly , you're scr*wed. What sort of cable modem is your router connected to? Maybe you can put it in "bridge mode", or speak to your ISP and ask for a public IP address.

disappointing but not a big deal either. I just thought it was an interesting feature.

EDIT: And thank you kindly Colin for explaining this so patiently to me.