Solved openvpn issue with 386.7_x

[joeejo]

I am having two issues with openvpn which I believe are connected. I am using an RT-AC86U router.

I have tried using version 386.7_0 and 386.7_5 with the same result. (factory reset before upgrades)

When VPN connects, I do not get the confirmation IP address, but rather it says “Public Unknown” (see attached image). The vpn still functions and checking the IP it is the correct ip for the vpn. Clicking refresh does nothing.

If everything is routed through the VPN then all devices work as expected.

The problem comes when I attempt to use VPN director. The devices I assign to the VPN in the director work as expected however all of the devices that are NOT in assigned to the VPN in director no longer can reach the internet.

I have tried listing the non vpn devices in director with WAN as the interface, however all non vpn devices still do not reach the internet. I have also tried enabling and disabling the kill switch which does not fix the problem.

Also when vpn is connected if I set the director setting to ‘no’ then no devices can reach the internet.

The reason I believe the two problems (PUBLIC UNKNOWN and no internet on non-vpn devices) are related is because when I was using version 386.5_2, the PUBLIC UNKNOWN is replaced with the VPN ip address and all of the non vpn devices work properly. It seems that if I see PUBLIC UNKNOWN instead of the actual ip address of the vpn, then any non-vpn devices will no longer work. I have never seen the actual VPN ip address in either of the 386.7_X versions.

To summarize, these are the results for each of the “Redirect Internet traffic through tunnel”:

“no” – no internet on any devices

“Yes (all) – internet access on ALL devices

“VPN Directory (policy rules)" –internet access only for devices assigned to vpn interface, all non-listed devices have no internet access.

I hope I explained this clearly. Please advise what additional information you need to help me diagnose this problem.

Thank you

 

[eibgrad]

Sounds like some kind of conflict in either the routing tables or firewall. Hard to be sure without just having a look.

Using the shell (ssh), post the output from the following commands (you can obscure your public IP, just do so consistently).

ifconfig
ip route show table main
ip route show table ovpnc1
ip rule
iptables -t nat -vnL --line-numbers
iptables -vnL --line-numbers

Might as well include the OpenVPN client config too.

cat /tmp/etc/openvpn/client1/config.ovpn

 

[joeejo]

Sounds like some kind of conflict in either the routing tables or firewall. Hard to be sure without just having a look.

Using the shell (ssh), post the output from the following commands (you can obscure your public IP, just do so consistently).

ifconfig
ip route show table main
ip route show table ovpnc1
ip rule
iptables -t nat -vnL --line-numbers
iptables -vnL --line-numbers

Might as well include the OpenVPN client config too.

cat /tmp/etc/openvpn/client1/config.ovpn

Thank you for your prompt and most helpful response.

As I began to follow your instructions I discovered several iptables entries that were put there a while ago to facilitate port forwarding on my vpn IP. I had forgotten about them. They are no longer needed and several of them conflicted with my existing setup.

Removing the unnecessary entries and cleaning up some other things I noticed seems to have resolved the issue.

Thank you again for directing me right to the source of the problem!! I appreciate your help and your knowledge.