Slate OpenVPN to tp-link router - no internet

Pseudonym1911 · 2022-05-11T03:32:59.380Z

Yes, I am able to access websites using the config file from my phone.
Here is the config file with keys/certificates/public ip removed:

client
dev tun
proto udp
float
nobind
cipher AES-128-CBC
comp-lzo adaptive
resolv-retry infinite
remote-cert-tls server
persist-key
persist-tun
remote public IP 1194

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----

wcs2228 · 2022-05-11T14:17:10.105Z

The OpenVPN config file looks pretty standard compared to other config files from my GL.iNet router, Asus router and NordVPN provider. The error in the System Log seems the most troubling right now that may require opening a ticket with GL.iNet Support.

I do not work for and I do not have formal association with GL.iNet

Pseudonym1911 · 2022-05-11T20:53:08.705Z

The closest relevant information I’ve found on the error is this: " This error doesn’t really mean much on its own. The exit code of 2 simply means the kernel rejected your route for some reason. It could be because you already have a route for that network, it could be because the gateway was not appropriate for the network/subnet, or many other things.

In any case bump up the verbosity you should be able to see more details about what specific route was failing.

Depending on the error you may need to fix your configuration, or just ignore the error. Sometimes the vpn server will offer routes, that your computer already has, or do not apply to your current connection."

This was relating to pfsense so I’m not sure if there is a way to get a more detailed log to see which route is failing.

simonli · 2022-05-13T03:48:41.582Z

I took a testing on Slate (firmware 3.212) with Home TP-Link OpenVPN server(Archer C3150). Works fine.
Make sure you selected Internet and Home Network

image871×722 21.3 KB

image640×510 14.4 KB

Leo · 2022-05-13T05:08:17.430Z

I just test it on TP-LINK Archer C1200 and Slate 3.212, it works.
Below is my setting.

916BC6A9-E860-41DB-BF1E-6521577987F11009×840 228 KB

test in on Slate.

C31250A7-CF4C-40C4-90E7-74F92335B70B651×510 98.6 KB

Pseudonym1911 · 2022-05-13T14:28:10.808Z

Unfortunately I don’t have that option as I’m using a TP-Link Omada router. I posted a picture of my options above.

elorimer · 2022-05-13T15:25:29.883Z

Ugh. It looks like the Omada is not well suited to your purpose. I don’t see that there is any alternative firmware for you (DD-wrt, openwrt, tomato), and I don’t see hooks for you to ssh into the router and monkey with stuff with scripts.

Plan A would be to get a different router, plan b would be to try within TP Link support to see what can be done.

What you want to do I’ve done with little difficulty with five different Asus routers over the last 12 years, but they each supported gobs of customization ala openwrt.

Mango 3.212 snapshot; Beryl 3.212 snapshot; Not affiliated with GL-iNet–just a user

wcs2228 · 2022-05-13T18:56:51.026Z

You can look into getting another TP-Link wifi travel router to replace the Slate as OpenVPN client to your TP Link Omada ER605. Confirm with TP-Link on which models are “guaranteed” to work.

I do not work for and I do not have formal association with GL.iNet

elorimer · 2022-05-13T21:12:16.972Z

wcs2228:

You can look into getting another TP-Link wifi travel router to replace the Slate as OpenVPN client to your TP Link Omada ER605.

You may be right, but I still think the problem is with the Omada. It doesn’t have the button that would otherwise do what he wants. I think he should be ditching the Omada for something else.

wcs2228 · 2022-05-13T21:43:46.056Z

I don’t think any of us knows what the problem is yet. It may not be about a “button” because ithe Omada router works using the same config on the Windows and Android client:

Slate OpenVPN to tp-link router - no internet Technical Support for Routers

There really aren’t a lot of options on the TP Link side, it’s really basic. I forgot to include it in the post but like Bpz1970, using the same config on the Windows and Android client and it’s working fine. Does that change your thoughts that it’s not a Slate client issue? If not, where should I start looking as it’s my first time trying to set this up.

I see other threads on this forum with users having problems with OpenVPN that may be due to configuration and/or software. Maybe TP-Link can provide a solution that just works with their own router or another brand … very easy to ask them.

I do not work for and I do not have formal association with GL.iNet

elorimer · 2022-05-14T01:57:46.163Z

wcs2228:

It may not be about a “button” because ithe Omada router works using the same config on the Windows and Android client

Yes, but that may because of split tunnelling–I don’t think we heard how the tracert came out, did we?

wcs2228 · 2022-05-14T02:29:07.026Z

That’s my point when I stated that I don’t think any of us knows what the problem is yet … only conjectures. I also stated “It may not be about a “button””.

Is it bad to ask TP-Link for information?

I do not work for and I do not have formal association with GL.iNet

Leo · 2022-05-14T10:02:35.638Z

Please try WireGuard.
Connect the WAN port of Slate to the LAN port of TP-LINK Omada, then set port forward on Omada. WireGaurd use port 51820 by default. Set Slate as WireGuard Server.
For your cell phone and PC, just use the official WireGuard app/client.

I think this is the best solution and don’t need to buy a new device.

Pseudonym1911 · 2022-05-18T15:21:31.004Z

I highly doubt it’s an issue with my router as it’s designed to do this and, as I have said, it works with both the android and Windows client, just not my Slate. I had listed the results of the tracert, traffic was going to my Slate gateway. I opened a ticket with GL.iNet so I’ll see what they say.

eric · 2022-05-18T16:43:17.242Z

On some of my Ubuntu based VPN servers I use the SoftEther VPN package which provides OpenVPN along with multiple other VPN protocols. I have had problems with some versions of GL iNet router firmware not being able to connect to the SoftEther OpenVPN servers, where Android, Windows 10, Macos, and Ubuntu OpenVPN clients work just fine with the SoftEther OpenVPN server.

I could never figure it out, so I also installed the native OpenVPN package on my Ubuntu servers using the angristan script on a different port, and it works fine with the GL iNet OpenVPN clients, and all other OpenVPN clients. I cannot tell you what it is, but I have definitely seen something similar to what you are experiencing, where the GL iNet OpenVPN client fails, but all other OpenVPN clients work.

elorimer · 2022-05-18T17:27:19.187Z

Pseudonym1911:

I had listed the results of the tracert, traffic was going to my Slate gateway.

Ok, I didn’t see this.

Pseudonym1911 · 2022-05-27T13:38:01.887Z

Okay, finally a conclusion for this saga. Thank you to everyone who has commented on this and GL.iNet support was very helpful. Buried deep on the internet and confirmed by TP-Link support, my routers OpenVPN implementation does not allow access to the internet and was indeed using split tunneling.

wcs2228 · 2022-05-27T21:04:52.919Z

Here you go:

community.tp-link.com

No client Internet access - OpenVPN client to site - Business Community

Good afternoon, We have an installation done with a router TL-R605, OC-200 Omada controller and switches/EAP all connected to Omada. I have created a VPN connection cliente to site with OpenVPN and it allows me to access to site netw

There is a comment:
In Omada menu there is no option of “Internet and home network Client Access” as it seems to appear in router menu when it is not addotped by Omada Controller.

elorimer · 2022-05-27T21:12:17.446Z

Did TP Link suggest that you could SSH in to their router and fool with stuff? You can redirect the gateway on the client side as step one.

Pseudonym1911 · 2022-05-27T21:24:19.187Z

Yeah, I had came across that exact forum which made me pretty sure that was the issue before I emailed their support. It was like the only mention of it not being a full tunnel, they should probably put it in some documentation somewhere, but that’s beside the point.