RBR750P - No IP address for VPN Connection

[RichardLS]

I have configured OpenVPN as per Netgear's instructions and it believes it connects from a laptop running Windows, but I cannot access anything on the LAN (e.g., RDP or router via browser).  Also, when I point to the icon for the connection in the system tray, while it says it is connected, the IP address for the connection is blank.

The following is the even log and config information from OpenVPN:

Event log for connection:

2024-06-18 09:47:41 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

2024-06-18 09:47:41 DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.

2024-06-18 09:47:41 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.

Config file:

client

dev tap

proto udp

dev-node NETGEAR-VPN

remote  xxx.xxx.xxx.xxx 12974 (note: IP address is correct, but changed to xxx for privacy/security)

resolv-retry infinite

nobind

persist-key

persist-tun

ca ca.crt

cert client.crt

key client.key

cipher AES-128-CBC

comp-lzo

verb 0

sndbuf 393216

rcvbuf 393216

Any assistance in resolving this issue is appreciated.

Thanks!

[CrimpOn]

Which version of OpenVPN is installed on the Windows laptop?

Are you able to open the router web admin page using a device connected to the Orbi LAN and open the Attached Devices page?  When I do that, the device connected over VPN appears (usually at the bottom of the list) and shows as connection type "VPN"

[RichardLS]

OpenVPN vv2.6.10

I can view the connected devices, but there are no devices listed as connected to VPN.

[CrimpOn]

Thanks.  I just connected a Windows 11 PC to an RBR750 running OpenVPN server.  Here's how my Attached Devices screen appears on a computer connected to the RBR750 at IP 10.0.0.5 (sorry for the device name. I was confirming how many characters long a device name can be.)

 Notice the VPN device appears with local IP 10.0.0.6.  To confirm this, I opened a command window on the VPN computer and displayed ipconfig /all

This confirms that the remote computer connected via a TAP adapter (the goofy default for Windows connections) and was assigned 10.0.0.6.  Opened a web browser to 10.0.0.1 (the RBR750 LAN IP) and it shows the same situation.

[CrimpOn]

This is the version of OpenVPN running on the remote computer:

[RichardLS]

Here are the images from the remote laptop:

On the interface for the router from within the LAN (not via VPN), the laptop connected via VPN does not appear.  There is no VPN section listed like there is on the image you provided.  None of the devices have the 1.18 IP address assigned either.

[CrimpOn]

(Sorry. I did not see this response and have been wondering what is going on.  Probably erased the notification by accident.  "my bad".)

This appears to be evidence that the VPN connection has succeeded.

• The default IP subnet for Orbi routers is 192.168.1.x, and a device connected with the Windows Open VPN TAP protocol will receive an IP address on the Orbi LAN.  (192.168.1.18 is such an IP address.
  When I connect to my test RBR750, the LAN IP is 10.0.0.x and this is why my VPN connection receives the IP assignment that it does.

What is not expected is that the Orbi router Attached Devices does not identify this device.

Would it be possible to attempt a VPN connection with another device?  perhaps a smartphone or tablet?

[RichardLS]

I don't see how.  It is pointing at the static IP address where the router is.  As I indicated in the OP, the IP address in the configuration folder is correct, which makes sense since it's generated by the router when it generated the configuration files.

[CrimpOn]

---

@RichardLS wrote:

 it's generated by the router when it generated the configuration files.

---

Yes, the configuration file has the static IP address of the router (or would have the DDNS name if the router did not have a static IP address).  What is not in the configuration file is the 192.168.1.18 LAN IP address.  The only place this could come from is the Orbi router that is running OpenVPN host.

I am stumped here.  The only obvious difference is my RBR750 is on firmware v7.2.6.31 and your RBR750P is probably on firmware v6.3.8.5.  Checking the product data sheets, these are clearly different models of Orbi router.

Even though the VPN device does not appear on the Attached Devices display, is it possible to do anything when connected over VPN?  (i.e. connect a web browser to 192.168.1.1?  Run a network scanner against network 192.168.1.x?)

Before connecting with VPN, what LAN subnet is the laptop on?  (i.e. not 192.168.1.x, correct?)

[RichardLS]

No, I cannot connect to network resources (e.g., browser to 192.168.1.1, RDP to local computer).

[CrimpOn]

My situation remains the same (RBR750, v7.2.6.31).  I downloaded the smartphone ovpn file and installed it on a Samsung tablet (Android) using OpenVPN Connect v3.2.0 (8367).  Opened a VPN connection to the Orbi with this result:

The significant difference between OpenVPN Windows and Apple/smartphone is that:

• Windows defaults to a tap connection (short for "line tap"?) which puts the VPN device on the same IP subnet as other devices on the VPN server, whereas
• Apple/smartphone uses a tun connection (short for "tunnel").  This is also one of the major differences between OpenVPN version 2 and version 3.  Version 3 no longer supports tap connections, which is why posts appear on the forum from users who are unable to get OpenVPN version 3 to work with the default client profile.  Apple and smartphone have never supported tap connections.

So, this tablet has been given the IP address 192.168.254.2 because the default for Orbi AX routers is to put VPN tap connections in the 192.168.254.x IP subnet.  I believe Netgear engineers chose this because they had already decided to use 192.168.2.x subnet for Guest devices.

Using the tablet, I opened a browser connection to 192.168.2.1 (the 750 router) which shows the same information as the screen shot above.

Although this seems like beating a dead horse, all I can suggest is installing OpenVPN Connect on some non-Windows computer/laptop/smartphone/tablet, importing the *.ovpn file designed for smartphone from the RBR750P and see if it will connect and be assigned an IP address.

I would install that version 6 firmware on my RBR750 except that Netgear never released that version of firmware for the 750 (non 'P') product.

If VPN access into the Orbi LAN is a serious requirement, it may be necessary to install a separate VPN server on the LAN.  For example, the GL-Net Brume 2 can be installed on the Orbi LAN and can perform two functions:

• Bundle client devices on the LAN into a VPN pipe to an internet VPN host (which the Orbi router cannot), and
• Act as either an OpenVPN Host or a Wireguard Host for connections from the internet to the LAN.

https://www.gl-inet.com/products/gl-mt2500/ 

I have also set up Wireguard host on a Raspberry Pi to accept connections from the internet. (a bit more technical than plugging a Brume 2.)

[RichardLS]

I tried via android phone and was able to connect and access RDP services and router interface on LAN via VPN.  Was assigned a 192.168.3.x local IP address according to the app.  But, connection was not listed in connected devices.

Any way to get it functioning on Windows PC laptop with the VPN built into the RBR750P, instead of adding another one?

FYI, seems open VPN did release a new version yesterday (with some bug fixes), but it didn't resolve my issue.

[RichardLS]

I think I found a solution.  I downloaded the OpenVPN Connect v3 for Windows and used the android config file.  Then, I was able to connect and get an IP.  I was able to connect with the router webpage as if I was on the LAN as well.  Was able to RDP to one computer, but not another (but I think that's another issued).

I don't know why Netgrear doesn't just point to the newer Connect v3, as it is much simpler to setup and works.

[CrimpOn]

Glad that OpenVPN 3 worked for you with the tun configuration.  (Internet discussions of tap vs. tun seem to lean towards tun connections being a better balance of capability and performance than tap connections.)

Netgear does not release information about  internal decisions, so customers are left to wonder and speculate.  One aspect might be a cost/benefit analysis of which projects have a greater potential return on investment.  Will the company get more from investment in new products and new features or making changes to existing products?  There appear to be a number of ways to remotely connect to a computer on the LAN that were not commonly available 10-15 years ago.  Maybe the number of customers who want a classic VPN into the LAN is not as significant as it once was?

The original Orbi router included a USB port with the intention of supporting network storage and network printing.  Those capabilities never materialized and newer Orbi products no longer include the USB port at all.

[RichardLS]

I hear you, but the capability is there.  They could use the same method/software/config files for both mobile and PC.  All they need to do is tell people to download the newer OpenVPN software.  Not much research/time there.  Just include the update instructions in the next firmware update.  Can even leave the code in place for people who have it working on v 2.