Slate OpenVPN to tp-link router - no internet

elorimer · 2022-05-10T16:47:15.679Z

Pseudonym1911:

There really aren’t a lot of options on the TP Link side, it’s really basic. I forgot to include it in the post but like Bpz1970, using the same config on the Windows and Android client and it’s working fine. Does that change your thoughts that it’s not a Slate client issue? If not, where should I start looking as it’s my first time trying to set this up.

If you look at this tutorial: How to Setup OpenVPN on TP-Link Routers (Windows) be sure that in Step 5 you select “Internet and home network”. That should handle the iptables stuff, add the change to the default gateway, and push the route to your home network. I can see that it is somewhat limited, because it doesn’t actually suggest that it is pushing (“advertising”) the TP Link DNS server. If you select “home network” then, duh, you don’t get any of that except the route to your home network. Your internet traffic will go out of the client’s own default gateway and not over the tunnel. (That is called split tunneling and is often very useful. You can do that on the fly on the client side if you select the internet and home network option.)

Now, you can’t necessarily tell from your client PC or phone when it is connected as a VPN Client whether it is split tunneling or not. Windows can be using its own routing tables. In a terminal, try a tracert command and see if you are going out of the TPLink default gateway or the Slate default gateway. If it is working right, then it could be the slate.

You would need to get into the Slate’s openvpn log and see if the default gateway is changing and the route is being added.

Full disclosure–I’ve never used openvpn with a TP Link. I’m more familiar with OpenVPN on Asus routers, particularly the Merlin fork.

Pseudonym1911 · 2022-05-11T00:20:13.630Z

Trying to access https://1.1.1.1/ fails and changing the DNS to 8.8.8.8 fails as well.

Pseudonym1911 · 2022-05-11T00:38:14.037Z

Omada VPN setup642×680 13 KB

So my VPN options are a bit different than those in that tutorial, I don’t have the “Internet and home network” options. But I do have to bind it to WAN and LAN ports which I think may be similar. Doing a tracert it is going out of my Slate’s default gateway (192.168.8.1). Which brings me to the logs, which I have attached with my public IP redacted. Notable thing to me is the “Linux route add command failed” near the bottom.

Inkedslate log766×741 255 KB

wcs2228 · 2022-05-11T02:57:29.163Z

Since https://1.1.1.1/ fails, the immediate problem is not with DNS, although DNS may still be an issue afterwards. The System Log contains an error that likely affects connectivity.

Can you install OpenVPN app on your phone and run test with the same config file?

I do not work for and I do not have formal association with GL.iNet

Pseudonym1911 · 2022-05-11T03:20:20.864Z

What all do you want me to try from my phone? Going to https://1.1.1.1 is successful with the same config file.

wcs2228 · 2022-05-11T03:28:35.754Z

Can you access Internet websites in general (google.com, microsoft.com, facebook.com, etc.) with your phone using the same OpenVPN config fike? If so, then DNS is also working well.

Can you post the config file with the key and certificates removed?

I do not work for and I do not have formal association with GL.iNet

Pseudonym1911 · 2022-05-11T03:32:59.380Z

Yes, I am able to access websites using the config file from my phone.
Here is the config file with keys/certificates/public ip removed:

client
dev tun
proto udp
float
nobind
cipher AES-128-CBC
comp-lzo adaptive
resolv-retry infinite
remote-cert-tls server
persist-key
persist-tun
remote public IP 1194

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----

wcs2228 · 2022-05-11T14:17:10.105Z

The OpenVPN config file looks pretty standard compared to other config files from my GL.iNet router, Asus router and NordVPN provider. The error in the System Log seems the most troubling right now that may require opening a ticket with GL.iNet Support.

I do not work for and I do not have formal association with GL.iNet

Pseudonym1911 · 2022-05-11T20:53:08.705Z

The closest relevant information I’ve found on the error is this: " This error doesn’t really mean much on its own. The exit code of 2 simply means the kernel rejected your route for some reason. It could be because you already have a route for that network, it could be because the gateway was not appropriate for the network/subnet, or many other things.

In any case bump up the verbosity you should be able to see more details about what specific route was failing.

Depending on the error you may need to fix your configuration, or just ignore the error. Sometimes the vpn server will offer routes, that your computer already has, or do not apply to your current connection."

This was relating to pfsense so I’m not sure if there is a way to get a more detailed log to see which route is failing.

simonli · 2022-05-13T03:48:41.582Z

I took a testing on Slate (firmware 3.212) with Home TP-Link OpenVPN server(Archer C3150). Works fine.
Make sure you selected Internet and Home Network

image871×722 21.3 KB

image640×510 14.4 KB

Leo · 2022-05-13T05:08:17.430Z

I just test it on TP-LINK Archer C1200 and Slate 3.212, it works.
Below is my setting.

916BC6A9-E860-41DB-BF1E-6521577987F11009×840 228 KB

test in on Slate.

C31250A7-CF4C-40C4-90E7-74F92335B70B651×510 98.6 KB

Pseudonym1911 · 2022-05-13T14:28:10.808Z

Unfortunately I don’t have that option as I’m using a TP-Link Omada router. I posted a picture of my options above.

elorimer · 2022-05-13T15:25:29.883Z

Ugh. It looks like the Omada is not well suited to your purpose. I don’t see that there is any alternative firmware for you (DD-wrt, openwrt, tomato), and I don’t see hooks for you to ssh into the router and monkey with stuff with scripts.

Plan A would be to get a different router, plan b would be to try within TP Link support to see what can be done.

What you want to do I’ve done with little difficulty with five different Asus routers over the last 12 years, but they each supported gobs of customization ala openwrt.

Mango 3.212 snapshot; Beryl 3.212 snapshot; Not affiliated with GL-iNet–just a user

wcs2228 · 2022-05-13T18:56:51.026Z

You can look into getting another TP-Link wifi travel router to replace the Slate as OpenVPN client to your TP Link Omada ER605. Confirm with TP-Link on which models are “guaranteed” to work.

I do not work for and I do not have formal association with GL.iNet

elorimer · 2022-05-13T21:12:16.972Z

wcs2228:

You can look into getting another TP-Link wifi travel router to replace the Slate as OpenVPN client to your TP Link Omada ER605.

You may be right, but I still think the problem is with the Omada. It doesn’t have the button that would otherwise do what he wants. I think he should be ditching the Omada for something else.

wcs2228 · 2022-05-13T21:43:46.056Z

I don’t think any of us knows what the problem is yet. It may not be about a “button” because ithe Omada router works using the same config on the Windows and Android client:

Slate OpenVPN to tp-link router - no internet Technical Support for Routers

There really aren’t a lot of options on the TP Link side, it’s really basic. I forgot to include it in the post but like Bpz1970, using the same config on the Windows and Android client and it’s working fine. Does that change your thoughts that it’s not a Slate client issue? If not, where should I start looking as it’s my first time trying to set this up.

I see other threads on this forum with users having problems with OpenVPN that may be due to configuration and/or software. Maybe TP-Link can provide a solution that just works with their own router or another brand … very easy to ask them.

I do not work for and I do not have formal association with GL.iNet

elorimer · 2022-05-14T01:57:46.163Z

wcs2228:

It may not be about a “button” because ithe Omada router works using the same config on the Windows and Android client

Yes, but that may because of split tunnelling–I don’t think we heard how the tracert came out, did we?

wcs2228 · 2022-05-14T02:29:07.026Z

That’s my point when I stated that I don’t think any of us knows what the problem is yet … only conjectures. I also stated “It may not be about a “button””.

Is it bad to ask TP-Link for information?

I do not work for and I do not have formal association with GL.iNet

Leo · 2022-05-14T10:02:35.638Z

Please try WireGuard.
Connect the WAN port of Slate to the LAN port of TP-LINK Omada, then set port forward on Omada. WireGaurd use port 51820 by default. Set Slate as WireGuard Server.
For your cell phone and PC, just use the official WireGuard app/client.

I think this is the best solution and don’t need to buy a new device.

Pseudonym1911 · 2022-05-18T15:21:31.004Z

I highly doubt it’s an issue with my router as it’s designed to do this and, as I have said, it works with both the android and Windows client, just not my Slate. I had listed the results of the tracert, traffic was going to my Slate gateway. I opened a ticket with GL.iNet so I’ll see what they say.