# GL-AX1800 / FW 4.2.1 / WAN access to Router / LAN devices with VPN-client/server enabled **URL:** \ **Category:** VPN, DNS, Leaks\ **Created:** [June 7, 2023, 7:57am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342 "2023-06-07T07:57:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 7, 2023, 7:57am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/1 "2023-06-07T07:57:01Z")
Hello! I would like to achive the following: Schematic: PC (ssh, port yyyyy) → WAN → GL-AX1800 (mapping port yyyyy to xxxxx, VPN-client enabled) → GL-AX1800 (ssh, port xxxxx) Access the router GL-AX1800 on ssh (port xxxxx) via WAN-putty (port yyyyy) with enabled VPN-client (global policy). Everything works well, wenn VPN-client is disabled. The port-forwarding rule for yyyyy to xxxxx is setup. As soon as I enable VPN-client the access doesn’t work anymore. Any ideas what I can do?? Thanks! ---
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 8, 2023, 5:57am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/2 "2023-06-08T05:57:53Z")
Nobody a hint what I can do to make this configuration work? ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 6:20am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/3 "2023-06-08T06:20:52Z")
In order to get accurate help from others please clarify your setup and what you are trying to achieve. ---
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 8, 2023, 7:16am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/4 "2023-06-08T07:16:55Z")
OK … obviously my description in the first post wasn’t accurate enough. I will try again. The setup: I have a GL-AX1800 with FW 4.2.1 running directly behind my modem from my ISP, before all the other network devices in my network (mainly fritz boxes in a MESH-network and a lot of other end-devices). VPN-client (NordVPN) is enabled VPN-server (Wireguard) is enabled The problem: When I try to access the GL-AX1800 by SSH from a computer outside my network (WAN) with enabled VPN-client directly with the IP-address from my ISP-provider (not via VPN) I can’t reach the router via SSH. If I disable the VPN-client everything works as it should. VPN-client uses global policy (as there are other issues when using e.g. MAC-based policy). So the question is why doesn’t access from WAN by SSH not work if VPN-client is enabled? And what can be done to make this work? Thanks! ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 9:16am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/5 "2023-06-08T09:16:47Z")
I am not sure if I understand you correctly: - the machine that does the ssh is also using the vpn connection? Or is it from another network ? Where is connected to ? - can you show screenshot for a successful ssh connection including the IPs source and destination ? Try this ![IMG_1356](https://forum-static.gl-inet.com/original/2X/c/c45b1972f17f76eb1af756d2a4a0cb78f71fde08.jpeg) ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 9:22am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/6 "2023-06-08T09:22:02Z")
> [@dieterlind](#): > > When I try to access the GL-AX1800 by SSH from a computer outside my network (WAN) with enabled VPN-client directly with the IP-address from my ISP-provider (not via VPN) I can’t reach the router via SSH. How can you access your gl ssh without port forwarding? Since your gl router is behind the isp you need to forward the ssh connection to it . ---
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 8, 2023, 9:59am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/7 "2023-06-08T09:59:30Z")
The machine accessing the router is not using the VPN (e.g. a computer in the office) There is a port forwarding rule from WAN-\>LAN in place: ![image](https://forum-static.gl-inet.com/original/2X/5/5f1f0f411a840627f0ae9df21136c8f355f145fc.png) I enabled the option “Allow Access WAN” but no difference with activated VPN-Client. Screenshot from protocol for successful connection (with deactivated VPN-client: ![image](https://forum-static.gl-inet.com/original/2X/4/43e78b682d6e353badb8482b4e0dbcb787a473f6.png) When I activate VPN-client I don’t see anything in protocol but receive from the connection computer: ![image](https://forum-static.gl-inet.com/original/2X/7/77a5fb3610317fbae6a287088690b89cbf29f2df.png) ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 10:16am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/8 "2023-06-08T10:16:33Z")
Now it is clear when you mentioned your office computer and port forwarding! Can you please share a screenshot of your firewall at: [https://router](https://router)’sIP/cgi-bin/luci/admin/network/firewall ---
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 8, 2023, 10:19am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/9 "2023-06-08T10:19:39Z")
here is the screenshot: ![image](https://forum-static.gl-inet.com/original/2X/a/aa577a7645069de5c8731aa5516252a465c37fdb.png) btw … nothing changed here from the default settings … ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 10:38am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/10 "2023-06-08T10:38:05Z")
Can you please disable the lan from Edit and then Save & Apply. ![1](https://forum-static.gl-inet.com/original/2X/2/29a52d5c11b7b94cc375015b15579ae9a06942bc.png) ![2](https://forum-static.gl-inet.com/original/2X/9/9cef255174156f0b5295bc4f7f9e1d26a5f79cbc.png) ---
**Author:** ![alphanumbers](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/a88e57/32.png) [@alphanumbers](https://forum.gl-inet.com/u/alphanumbers)\ **Post date:** [June 8, 2023, 10:50am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/11 "2023-06-08T10:50:27Z")
I can confirm that doing this on wgclient made no difference. Port forwarding works fine (before this change) but settings ports on the router doesnt work. ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 10:51am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/12 "2023-06-08T10:51:54Z")
> [@alphanumbers](#): > > I can confirm that doing this on wgclient made no difference. it should be on openvpn rule not **wgclient**! ---
**Author:** ![alphanumbers](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/a/a88e57/32.png) [@alphanumbers](https://forum.gl-inet.com/u/alphanumbers)\ **Post date:** [June 8, 2023, 10:52am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/13 "2023-06-08T10:52:26Z")
Yeah i know. Im not the OP. ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 10:53am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/14 "2023-06-08T10:53:00Z")
> [@alphanumbers](#): > > Port forwarding works fine (before this change) but settings ports on the router doesnt work. got it 🙂 ---
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 8, 2023, 10:58am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/15 "2023-06-08T10:58:07Z")
Unfortuantely no change after unticking lan / save / save&apply ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 11:43am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/16 "2023-06-08T11:43:47Z")
ok roll back and try to add a static route ![3](https://forum-static.gl-inet.com/original/2X/b/b67e5b9ef9955d85bea3bc62856488c965e7a709.png) When you connect using SSH (while the OPENVPN client is enabled) the the connection does get forwarded (by your ISP) to your GL modem. However when the modem try to talk to you back it goes through the VPN tunnel. There are many different ways to achieve a VPN bypass so that you SSH connections is entirely excluded form default VPN gateway. ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 11:56am UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/17 "2023-06-08T11:56:15Z")
There is another way to do it - but I did not test it! ![5](https://forum-static.gl-inet.com/original/2X/f/fc4386e0d459b14a02d56536d702ae37afddcd16.png) ![6](https://forum-static.gl-inet.com/original/2X/7/74df9837fa781753bb3515c78ca368e0c16b924e.png) ALWAYS disable/re-enable VPN connection after changes! ---
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 8, 2023, 12:06pm UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/18 "2023-06-08T12:06:42Z")
My routing screen looks somehow different: ![image](https://forum-static.gl-inet.com/original/2X/4/403735868392c4e93fccc1011933ca980e7245ec.png) What to set here? ---
**Author:** ![SpitzAX3000](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/spitzax3000/32/11018_2.png) [@SpitzAX3000](https://forum.gl-inet.com/u/SpitzAX3000)\ **Post date:** [June 8, 2023, 12:10pm UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/19 "2023-06-08T12:10:00Z")
Look above to my screenshot - it states your the IP for the directly connected ISP modem. So you flint and the ISP devices have IPs on the same network. Make sure you choose the **interface** that is connected also to your ISP modem! In my screenshot I used the **lan** and your setup it could be different! for example, ![9](https://forum-static.gl-inet.com/original/2X/f/f5fece6d767f0f3a79b0fac5ef6f47c1be69da95.png) ---
**Author:** ![dieterlind](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/d/a88e57/32.png) [@dieterlind](https://forum.gl-inet.com/u/dieterlind)\ **Post date:** [June 8, 2023, 12:19pm UTC](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342/20 "2023-06-08T12:19:49Z")
I got you … but what shall I set at “Route type”? ![image](https://forum-static.gl-inet.com/original/2X/8/8eb750737c0726462356dbf1b73a747ea84a9c76.png) and how to set the ip … it asks like 0.0.0.0/0? The other way with vpn-client excluding ip didn’t work. [Next page](https://forum.gl-inet.com/t/gl-ax1800-fw-4-2-1-wan-access-to-router-lan-devices-with-vpn-client-server-enabled/30342.md?page=2)