ExpressVPN on GL-AR300M

alzhao · 2017-05-12T13:53:16.000Z

@lstevens, In china you may use shadowsockets but this is not yet support.

lstevens · 2017-05-12T18:54:23.000Z

Hi: For the benefit of those who are in/or travelling in China, some clarification on VPN usage in general, that may also help you with your use of your GLI Router there. By way of introduction, my business is computer security, and I have employees who travel to China regularly.

@alzhao, you are correct that OpenVPN is generally blocked in China. Standard OpenVPN will get blocked by algorithmic filters in Great Firewall. However, some VPN Providers (ExpressVPN being one of them), use different kinds of packet obfuscation to avoid detection. I have several employees in different parts of China right now using ExpressVPN with OpenVPN successfully. They are not currently using a GLI Router, but I hope to be recommending them to purchase one in the future after I have completed my testing. If I can assist others with any information regarding VPN use in China (in general), and which providers are currently working there, I am glad to help. -Leon

alzhao · 2017-05-13T12:43:43.000Z

@lstevens,

These vpn service providers uses modify openvpn protocol. The protocol need to be supported in both client and server. They don’t release source code so there is no way to get this supported in router without their help.

AnyConnect and Shadow sockets also uses packet obfuscation so they should be able to work in China.

But these vpn protocols works without good performance. The GFW wall just tries to drop packets and throttling your traffic. It works, but slow.

A better solution is this: www.knowroaming.com, buy a SIM card from then and use it in your smartphone or using our MiFi, your life in China will be different. The traffic doesn’t goes through GFW at all. Verified!

lstevens · 2017-05-14T00:29:06.000Z

alzhao - there is an update here…some (few) providers, have figured out how to operate in China without modifying the client. ExpressVPN IS one of them. I have verified (today) with my field people in China and they are running ExpressVPN on PC, MAC, Android, and IOS…ALL with unmodified OpenVPN (they are using the native/standard OpenVPN on their platform, NOT OpenVPN from ExpressVPN). It is working in China very well/fast. So, unless GL Router has some anomaly, if ExpressVPN runs/connects, it should run in China. It would be good if someone in China with this router and an ExpressVPN account could test. For anyone willing to test, ExpressVPN gives a 30 day evaluation period, with no questions asked refund policy.

alzhao · 2017-05-15T14:09:09.000Z

I have tested for some times. Let’s say that there are some times you can connect, but very rare. The GFW doesn’t block the protocol completely. There is a chance you can use for a short time but unreliable.

I have my own openvpn server and the chance of successfully connecting is 50%.

It also depends on what hotels. In some 5 start hotels their network is not filtered by GFW at all so you can connect VPN. Maybe you even don’t need a VPN client to visit google.

lstevens · 2017-05-15T23:17:23.000Z

Alzhao - Are you saying that you have specifically tested ExpressVPN with OpenVPN protocol and found it inconsistent? If so, did you only test it on the GLI Router? The reason I am asking is that my Field People in China are using ExpressVPN with Standard OpenVPN Protocol (NOT the ExpressVPN App), and they are getting consistent and fast connections. They usually connect to ExpressVPNs Hong Kong 4 Server.While they don’t (yet) have the GLI Routers (I am still testing, but I am in the US), they run standard OpenVPN on the ExpressVPN Service in China with no problem. I don’t understand the reason you are seeing different results. Maybe someone else in China who sees this can test, or you can try it again.

I want to deploy GLI Routers to my field people, but want to make sure there is not something specific in the GLI router that would preclude OpenVPN/ExpressVPN useage.

alzhao · 2017-05-16T10:53:38.000Z

I didn’t use ExpressVPN. I have vpn from other providers.

I will have a try when I go to China.

lstevens · 2017-05-16T12:31:30.000Z

OK. They have “special sauce” in China, and it works on OpenVPN (standard). If you don’t have an account before you go next time, get one. They REALLY honor their 30 day no questions asked guarantee. All you need to do is live chat them from their website during the first 30 days, and they will refund you right away.

khaberz · 2017-05-17T17:29:01.000Z

@lstevens I am in China currently and can confirm that ExpressVPN with the GL-AR300M works in general. Anything specific you’d like to see tested?

lstevens · 2017-05-17T21:09:58.000Z

khaberz: Thank you VERY much! This helps me and will help countless others who are in or travelling to China!

A few operational questions, just to clarify:

My field people who use ExpressVPN in China (without the GL-AR300M) find that OpenVPNs connections are consistent and have reasonable/useable speeds. Are you finding the same while using it with GL-AR300M?

Which method of loading the VPN into the GLAR300M do you use? Are you simply loading the .ovpn file that is normally supplied by them for Android?
What about DNS? Do you need to put it in manually, or does your config file set it for you?
Any other changes/adjustments you need to/like to make to the configuration to make things work?
Any other pointers and overall operational observations that might help are appreciated.

Thanks for all your help. You are helping many!

Regards, Leon

khaberz · 2017-05-17T22:55:30.000Z

@lstevens:

My field people who use ExpressVPN in China (without the GL-AR300M) find that OpenVPNs connections are consistent and have reasonable/useable speeds. Are you finding the same while using it with GL-AR300M?

>>> Yes, with 2 caveats:

a) there is no .ovpn file (I tried through their support too) for the best location (HK4 as you mentioned), so if you - like me - can not set this up another way or put together your own ,oven, you are stuck with e.g. HK2 or the Taiwan ones. Works, but not as fast or reliable as HK4 when using their client.

b) The general speed limitations of OVPN on the GL-AR300M do apply of course

Which method of loading the VPN into the GLAR300M do you use? Are you simply loading the .ovpn file that is normally supplied by them for Android?

>>> Just the supplied .ovpn

What about DNS? Do you need to put it in manually, or does your config file set it for you?

>>> The config file sets it. (I assume. It “just works”)

Any other changes/adjustments you need to/like to make to the configuration to make things work?

>>> Nope.

Any other pointers and overall operational observations that might help are appreciated.

>>> Nothing really beyond my answer on 1).

Even with ExpressVPN, it’s never as stable on Mainland China as it is elsewhere, as your colleagues will know. It has been working fine for the past week. On a previous trip, it worked well for a few days and suddenly became very erratic and I had to use US access points for it to work again.

lstevens · 2017-05-17T23:30:29.000Z

Great info! Thanks!

Just to clarify: you said 'On a previous trip, it worked well for a few days and suddenly became very erratic and I had to use US access points for it to work again". Do you mean that the access points that you normally use (HK2 and Taiwan) were erratic, but that the US Access Points (STILL using ExpressVPN ) were ok. Just trying to ascertain that it was the access points (but not ExpressVPN in general) that got “fussy”.

khaberz · 2017-05-18T07:02:27.000Z

Correct, yes. I still got usable connections with other access points from ExpressVPN. However, be prepared for surprises at all times. The authorities are constantly trying to limit or slow down VPN connections; this could at any time also affect whatever ExpressVPN are doing to make it work rather well currently.

lstevens · 2017-05-18T20:10:16.000Z

Thanks for helping. Yes, China GFW always a challenge. My guys there have used ExpressVPN for many years with great results. While it is always a cat/mouse as you say, ExpressVPN seems to be the most consistent and acts quickly to adjust when China specific/GFW connection issues occur. They are also the most responsive VPN Service I have ever used (I am in the Security Software field). They are the only VPN provider that I know of who has 24x7 online chat that actually answers and is helpful. I highly recommend them for anyone (and now, thanks to you, for GLI users), who need VPN in China. (Their performance in other parts of the world are similar; if a VPN can perform in China, it can perform anywhere. If anyone has other questions about VPN use in China (either with or without GLI) feel free to ask. I can also respond to questions re: other VPN providers in China, as my field people there have tested most of the major ones. (and thanks again to khaberz for your great input and ongoing participation).

khaberz · 2017-05-18T20:23:49.000Z

lstevens: If you can find out how to get or create an .ovpn for Honkong4, that would be great Their support just told me they don’t have one and I need to try the other access points. A real pity, as HK4 is by far the fastest and most reliable one…

lstevens · 2017-05-18T22:15:31.000Z

I spoke w/my tech contact there…apparently the issue isn’t the lack of the .ovpn file. The reason HK4 is more reliable/faster is because of the proprietary methods are is baked into their proprietary software (and interface with software on HK4). Without that software, HK4 is no different from their other servers. So, that’s why they just reserve that server for users of their proprietary software. Even if they supplied a .ovpn file for HK4, it wouldn’t make a difference. There IS a solution (but not for GLI routers): You can buy one (or if you already have one) of the model routers that will run their proprietary router software (listed on their website). If you do that, than all servers (including HK4) are available, since the router software they provide has the proper encryption/hooks for the special servers.

khaberz · 2017-05-18T23:19:00.000Z

Ah, Got it. That does make sense. Thanks a lot for the information, lstevens!

lstevens · 2017-05-19T09:26:53.000Z

Anyway, they don’t allow Netflix from HK4 even from desktop. I think they want to reserve it for “mission critical” applications.

For others reading this thread, ExpressVPN is one of a dwindling number of VPNs that supports BOTH BBC Iplayer and Netflix. Like the GFC, both BBC and Netflix are constantly adjusting their systems to identify and block VPNs.

alzhao · 2017-05-19T14:09:47.000Z

I used my office router as VPN server and it works in China most of the time.

But sometimes it just cannot connect for bad luck.

uniquename · 2019-03-14T17:02:10.130Z

Several weeks ago I configured ExpressVPN on AR300M. I failed to do it with .ovpn file they provided on their site, just uploading it to GL-inet web interface didn’t work. So I disabled all vpn services that gl-inet has (vpn-service and startvpn) and enabled pure openvpn service instead. After that uploaded to router .crt, key files, auth file with username and password. Via command ssh line added vpn interface:
uci set network.vpn0=interface
uci set network.vpn0.ifname=tun0
uci set network.vpn0.proto=none
uci set network.vpn0.auto=1
Then added firewall zone for vpn:
uci set firewall.vpn=zone
uci set firewall.vpn.name=vpn
uci set firewall.vpn.network=vpn0
uci set firewall.vpn.input=REJECT
uci set firewall.vpn.output=REJECT
uci set firewall.vpn.forward=ACCEPT
uci set firewall.vpn.masq=1
Then applied modifications:
uci commit network
/etc/init.d/network reload
uci commit firewall
/etc/init.d/firewall reload

Then modified /etc/config/openvpn file this way:

config openvpn ‘myvpn’
option enabled ‘1’
option dev ‘tun’
option proto ‘udp’
option verb ‘3’
option log ‘/var/log/openvpn.log’
option pull ‘1’
option port ‘1195’
option client ‘1’
option nobind ‘1’
option persist_tun ‘1’
option persist_key ‘1’
option comp_lzo ‘no’
option tun_mtu ‘1500’
option mssfix ‘1450’
option fragment ‘1300’
option keepalive ‘10 60’
option resolv_retry ‘infinite’
option reneg_sec ‘0’
option mute_replay_warnings ‘1’
option auth ‘SHA512’
option cipher ‘AES-256-CBC’
option auth_user_pass ‘/etc/openvpn/expressvpn/auth’
option fast_io ‘1’
option sndbuf ‘524288’
option rcvbuf ‘524288’
option ns_cert_type ‘server’
option keysize ‘256’
option ca ‘/etc/openvpn/expressvpn/ca2.crt’
option cert ‘/etc/openvpn/expressvpn/client.crt’
option key ‘/etc/openvpn/expressvpn/client.key’
option tls_client ‘1’
option tls_auth ‘/etc/openvpn/expressvpn/ta.key 1’
option key_direction ‘1’
option remote ‘belgium-ca-version-2.expressnetw.com 1195’
option remote ‘switzerland-2-ca-version-2.expressnetw.com 1195’
option remote_random ‘1’
(option remote_random feature for some reason not working and I connect always via last line remote server)
Then changed in luci web interface firewall settings - removed lan - wan forwardings, instead added lan - vpn forwardings. Rebooted router.

The only strange thing with GL-inet routers that I also need to execute restarting firewall command, without it - it do not work , so I also added command to rc.local:
/etc/init.d/firewall restart
It is not specific to vpn service, with my own vpn server, I also need to restart firewall for some reason. If I use another OpenWRT router without gl-inet web interface - it work without firewall restart.
The connection seems relatively reliable, about 7-8 Mbps, but once in several days it happen that internet connection breaks and I need to ssh to router and execute /etc/init.d/firewall restart (or just reboot it)
If someone knows why this happening (firewall feature) that would be great if you let me know. Maybe because there are some custom gl inet firewall rules, but I really like configuring vpn via direct config file modification instead of uploading ovpn, so has to disable all their vpn services.