ER605 OpenVPN - unable to access remote Windows resources with recommended configuration - SOLVED

ER605 OpenVPN - unable to access remote Windows resources with recommended configuration - SOLVED

ER605 OpenVPN - unable to access remote Windows resources with recommended configuration - SOLVED
ER605 OpenVPN - unable to access remote Windows resources with recommended configuration - SOLVED
20 hours ago
Model: ER605 (TL-R605)  
Hardware Version: V1
Firmware Version: 1.3.2 Build 20251030 Rel.16640

After configuring OpenVPN on an ER605 router and connecting from a client (android phone or Windows PC) via the VPN, I was not able to access most resources of remote Windows machines on the remote (ER605) network.  Pings or file sharing requests to remote Windows machines through the VPN would fail but remote desktop, pings to the ER605 gateway, and internet access would work.

 

The TP-link configuration posting I followed is here:
https://www.tp-link.com/us/support/faq/3632/

 

and I had already implemented the "comp-lzo adaptive" recommendation here:
https://community.tp-link.com/en/business/forum/topic/653224

 

SOLUTION THAT WORKED FOR ME
In the IP pool section of the OpenVPN server setup, instead of using a different local /24 subnet (e.g. 192.168.2.0/24 as recommended in the configuration posting above) , I used a portion of the same local subnet for my IP pool as follows:
IP Pool: 192.168.0.232/29


Note that /29 is the smallest subnet that the ER605 seems to allow - it supports 8 addresses and 6 hosts, though each OpenVPN server instance will only support one connection at a time.

 

This IP pool is on the same /24 local subnet as the gateway, so IP addresses will be assigned from the range of 192.168.0.233 though 192.168.0.238 (I think).

With this change, I was able to access on my VPN client all resources of the Windows machines on the remote network of the ER605 VPN server.

 

FURTHER DETAIL 

It turns out the problem was that the configuration recommended by TP-Link when setting up OpenVPN, places the local IP pool for the VPN client on a different local /24 subnet than the main local network.  For many windows services, such as file sharing and ping requests, Windows Firewall is by default configured to block incoming connections except those on the local /24 networks.  With the TP-link recommended configuration, any Windows machine on the remote (VPN server side) of the network will see the incoming requests as not coming from the local network and Windows firewall will block them.

 

The problem is detailed here:
https://serverfault.com/questions/651973/windows-firewall-blocking-network-shares-through-vpn-server


But the solution in the above post is to modify the firewall rules on the remote Windows machine resources - not something I want to do for every Windows machine on my network.  Instead, I just carved out a small /29 subnet of the 192.168.0.0/24 local network to be used for the IP pool so that Windows machines see the requests as coming from the local /24 network.

  0      
  0      
#1
Options

Information

Helpful: 0

Views: 23

Replies: 0