Jtdylktuy

I'm trying to access the OpenVPN server at my workplace from home. If I connect my home laptop to the wifi hotspot on my Huawei P20 Pro, it works fine. However, when I try the same on my home wifi, the connection times out. In fact, I can't even ping the VPN server. As my job doesn't know anything about either my phone or my home LAN this can't reasonably have anything to do with settings on the server but rather with settings on the router, an Asus RT-N56U, or its built-in firewall. I was under the impression that OpenVPN did not need NAT passthrough but I might very well be missing something else, probably even something much more obvious.

I am pretty much a novice when it comes to anything network related and my Google-Fu only gets me instructions about how to set up an OpenVPN server behind a firewall, but in this case it's the client which is behind a firewall and I'm not an administrator for the server anyhow (which is a good thing). My knowledge about networking isn't at a level where I can translate between these two situations.

Placing my laptop in a DMZ or activating port forwarding for port 1194 did not solve the problem so I'm guessing it's a routing rather than a firewall problem (I guess that would also explain why I can't even ping the server). Though I honestly have no idea what the default settings for a DMZ on on the RT N56U are so I might be wrong.

This is the (slightly anonymized) ovpn-file for the connection. Note that my laptop (running Ubuntu MATE 16.04) can establish this connection, just not from inside my home LAN.

dev tun

persist-tun

persist-key

cipher AES-128-CBC

auth SHA1

tls-client

client

resolv-retry infinite

remote XXX.XXX.XXX.XXX 1194 tcp-client

lport 0

verify-x509-name "office.myemployer.org" name

auth-user-pass

pkcs12 account.p12

tls-auth account-tls.key 1

ns-cert-type server

comp-lzo

This is the result when using my mobile hotspot, i.e. when it is working:

$ sudo openvpn --config vpn/account.ovpn --pkcs12 vpn/account.p12 --tls-auth vpn/account-tls.key --auth-user-pass vpn/up

Mon Feb 18 18:04:29 2019 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017

Mon Feb 18 18:04:29 2019 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08

Mon Feb 18 18:04:29 2019 WARNING: file 'vpn/account.p12' is group or others accessible

Mon Feb 18 18:04:29 2019 WARNING: file 'vpn/account-tls.key' is group or others accessible

Mon Feb 18 18:04:29 2019 Control Channel Authentication: using 'vpn/account-tls.key' as a OpenVPN static key file

Mon Feb 18 18:04:29 2019 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XXX:1194 [nonblock]

Mon Feb 18 18:11:49 2019 TCP connection established with [AF_INET]XXX.XXX.XXX.XXX:1194

Mon Feb 18 18:11:49 2019 TCPv4_CLIENT link local (bound): [undef]

Mon Feb 18 18:11:49 2019 TCPv4_CLIENT link remote: [AF_INET]XXX.XXX.XXX.XXX:1194

Mon Feb 18 18:11:49 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

Mon Feb 18 18:11:51 2019 [office.myemployer.org] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194

Mon Feb 18 18:11:53 2019 TUN/TAP device tun0 opened

Mon Feb 18 18:11:53 2019 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0

Mon Feb 18 18:11:53 2019 /sbin/ip link set dev tun0 up mtu 1500

Mon Feb 18 18:11:53 2019 /sbin/ip addr add dev tun0 local 10.10.8.118 peer 10.10.8.117

Mon Feb 18 18:11:53 2019 Initialization Sequence Completed

While this is the result when using my home LAN wifi, i.e. when it is not working:

$ sudo openvpn --config vpn/account.ovpn --pkcs12 vpn/account.p12 --tls-auth vpn/account-tls.key --auth-user-pass vpn/up

Mon Feb 18 18:04:29 2019 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017

Mon Feb 18 18:04:29 2019 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08

Mon Feb 18 18:04:29 2019 WARNING: file 'vpn/account.p12' is group or others accessible

Mon Feb 18 18:04:29 2019 WARNING: file 'vpn/account-tls.key' is group or others accessible

Mon Feb 18 18:04:29 2019 Control Channel Authentication: using 'vpn/account-tls.key' as a OpenVPN static key file

Mon Feb 18 18:04:29 2019 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XXX:1194 [nonblock]

Mon Feb 18 18:04:39 2019 TCP: connect to [AF_INET]XXX.XXX.XXX.XXX:1194 failed, will try again in 5 seconds: Connection timed out

Mon Feb 18 18:04:54 2019 TCP: connect to [AF_INET]XXX.XXX.XXX.XXX:1194 failed, will try again in 5 seconds: Connection timed out

.

.

.

etc.

Does anyone have any pointers about which settings on the router could be the issue?