Troubleshooting VPN Client on Wi-Fi Router Is Not Working
Kevin_Z: Are you requesting the same feature as asked by tekniking in the following thread?
https://community.tp-link.com/en/home/forum/topic/544528
If yes, that is not supported at this moment.
Yes, some features like that. With OpenVPN TUN mode, it makes the things more complex because the VPN client is not at the same subnet of Home LAN. Even if it can do the routing between Home LAN and VPN client(s) with AX90 FW's OpenVPN service, in the remote OpenVPN client setting, it still needs to add additional routing setting to forward Home LAN device's IP packets to the VPN tunnel interface. So it is not as convenient as TAP mode, which works as L2 Ethernet bridge --- although it is with some security issues and broadcast packet overhead.
The alternate idea is to support the virtual server for AX90's VPN server gateway. It is more secure just to expose some Home LAN device's particular ports to VPN clients. But it might be more complex to support more than 1 Home LAN's SMB file sharing service.
With DD-WRT FW, the SSH + tunnel method by non-root user is my preferred one used for more than 10 years because it does not need very complex setup. It is also actually faster than OpenVPN's tunnel. It just needs to use PuTTY with enforced key authentication login method to create the tunnel to access VNC / RDP services in my Home LAN. Even the SSH user's login private key is exposed, this non-root user cannot modify any router setting or run any administration command.
Today I just tested AX90's USB storage's [Samba for Windows] file sharing service with Google's Chromecast TV + VLC player. It works fine with low bit rate audio streaming playback. But the VLC's playback is always stopped on playing the H.265 + DTS-HD/MA or TrueHD video files (15 ~ 20 Mbps) in few seconds. The files are put on a USB 3.0 SD Card reader + Samsung EVO+ 512GB MicroSD card formatted as ExFAT. It was previously put on my DD-WRT FW's 802.11ac router and the playback was always very stable with 1 second buffering setting in VLC player. So I am a little bit surprised it does not work well with this more powerful router HW. :p
WayneHu wrote
Kevin_Z wrote
Kevin_Z: Can I know what kind of VPN server are you using on the AX90? And what is the working mode of the AX90 when you mentioning TAP mode (i.e. Bridge-mode), does it refer to Access Point mode? Some advanced features are not available when the router is working in AP mode, I guess VPN server would be one of them. VPN server can only be configured on the gateway router.
Hi Kevin,
As it is mentioned, the current AX90 FW's OpenVPN server does not have this TAP option when AX90 is configured as router mode. But it works with the DD-WRT FW in my experience. With OpenVPN server's TAP mode, the VPN client's IP is assigned with the LAN subnet's. I used to run DD-WRT's OpenVPN server with this mode.
Kevin_Z: Are you requesting the same feature as asked by tekniking in the following thread?
https://community.tp-link.com/en/home/forum/topic/544528
If yes, that is not supported at this moment.
Any device not described in the [Access Control] [White List] does not even have any chance to establish the connection to AX90's Guest WiFi network. For security consideration, this option is useful in case to disallow some standalone devices to touch home LAN. But it is not really useful for occasionally visited guests case. Maybe an additional Guest Network SSID with the option to enable / disable the Access Control is more flexible. :p
Kevin_Z: Good idea, we would see how to improve this in the future.
Thank you for the reply!
Best Regards,
Wayne
Kevin_Z wrote
Kevin_Z: Can I know what kind of VPN server are you using on the AX90? And what is the working mode of the AX90 when you mentioning TAP mode (i.e. Bridge-mode), does it refer to Access Point mode? Some advanced features are not available when the router is working in AP mode, I guess VPN server would be one of them. VPN server can only be configured on the gateway router.
Hi Kevin,
As it is mentioned, the current AX90 FW's OpenVPN server does not have this TAP option when AX90 is configured as router mode. But it works with the DD-WRT FW in my experience. With OpenVPN server's TAP mode, the VPN client's IP is assigned with the LAN subnet's. I used to run DD-WRT's OpenVPN server with this mode.
Any device not described in the [Access Control] [White List] does not even have any chance to establish the connection to AX90's Guest WiFi network. For security consideration, this option is useful in case to disallow some standalone devices to touch home LAN. But it is not really useful for occasionally visited guests case. Maybe an additional Guest Network SSID with the option to enable / disable the Access Control is more flexible. :p
Thank you for the reply!
Best Regards,
Wayne
WayneHu wrote
Hi Kevin,
I need the OpenVPN server option operated with TAP mode (i.e. Bridge-mode) instead of TUN mode (i.e. Router-mode) provided by Archer AX90 FW. Can you help to ask if this option can be provided just like DD-WRT FW's OpenVPN server? Otherwise I don't know how to allow the remote VPN client to access the home LAN subnet's file sharing / RDP / VNC servers directly.
With the following AX90 FW version, the OpenVPN connection can be successfully established. But it is the same situation regarding Ronald's question.
Kevin_Z: Can I know what kind of VPN server are you using on the AX90? And what is the working mode of the AX90 when you mentioning TAP mode (i.e. Bridge-mode), does it refer to Access Point mode? Some advanced features are not available when the router is working in AP mode, I guess VPN server would be one of them. VPN server can only be configured on the gateway router.
Another curious design is about the "Access Control" on the "Guest network". I am surprised why it is also included. To me it makes more sense without any needing to set the MAC address in this table just for my different guests to use my WiFi network to access the internet while my home network is still only accessed with my home devices. It is the same for the company's office environment. It can be achieved with my another Buffalo AC1750DHP router running the DD-WRT FW.
Kevin_Z: Does it mean there is no internet access when connecting to the guest network and when Access Control is enabled? If yes, this has been brought up with the team and they will evaluate the feasibility to optimize the Access Control feature in the future.
Thank you for any help!
Best regards,
Wayne
Hi Kevin,
I need the OpenVPN server option operated with TAP mode (i.e. Bridge-mode) instead of TUN mode (i.e. Router-mode) provided by Archer AX90 FW. Can you help to ask if this option can be provided just like DD-WRT FW's OpenVPN server? Otherwise I don't know how to allow the remote VPN client to access the home LAN subnet's file sharing / RDP / VNC servers directly.
With the following AX90 FW version, the OpenVPN connection can be successfully established. But it is the same situation regarding Ronald's question.
Another curious design is about the "Access Control" on the "Guest network". I am surprised why it is also included. To me it makes more sense without any needing to set the MAC address in this table just for my different guests to use my WiFi network to access the internet while my home network is still only accessed with my home devices. It is the same for the company's office environment. It can be achieved with my another Buffalo AC1750DHP router running the DD-WRT FW.
Thank you for any help!
Best regards,
Wayne
