[slipry79]

I am hoping someone can help explain the behavior I am getting with a VPN and my WOL setup.

After quite a bit of trial and error, I think I have Cyberghost VPN working on my router. I have a Linksys WRT1900ACS V2 running DD-WRT v3.0-r33555 std (10/20/17). I followed the Cyberghost router guide with the following exceptions/additions:
- Used the Cyberghost DNS addresses (38.132.106.139 and 194.187.251.670) in the Network Address Server Settings (DHCP) section of Setup in the DD-WRT GUI.
- Used the username and password fields in the DD-WRT OpenVPN Client setup GUI and did not use the startup commands to create the temporary username/password file.
- Enabled NAT and Firewall Protection in the OpenVPN Client setup.
- Omitted the "explicit-exit-notify 2" line from the Additional Config commands in the OpenVPN Client setup.
- Did not use any Firewall startup commands.

Now to explain my WOL setup:
I have a DDNS through afraid.org. I also have port 9 forwarded to 192.168.1.254 in the router, and I have an arp startup command to broadcast the traffic that comes to 192.168.1.254. The DDNS has not updated yet, and the DDNS host name still resolves to my "true" IP address.

Here is the mystery... WOL works with all of the following addresses: the DDNS host name, my true IP address, and my new VPN IP address. I would not have expected it to work with either the host name prior to DDNS update or my true IP address. Does Port Forwarding and/or the arp command allow the incoming WOL packet to bypass the VPN? Have I defeated (or at least partially defeated) the security of the VPN this way?

Here is one other piece of info:
I enabled Anonymous WAN Requests (ping). From an external computer, pings to the DDNS host name and my true IP address fail. Pings to the new VPN IP address succeed. Is this because pings are handled differently than forwarded ports and are therefore successfully blocked by the VPN?

Any comments would be appreciated.

[slipry79]

Thanks very much for your response.

First, let me clarify which IP addresses I am referring to in case I caused any confusion. I will call the IP address my ISP assigns the "ISP address", and I will call the public IP address that the VPN assigns the "VPN address".

I read your prior post, and I confirmed that I cannot access my router GUI from a computer outside my LAN with either the VPN address or the ISP address.

I also confirmed with an outside computer that sending the WOL command to my numeric (dotted quad) ISP address still causes my computer to wake up with the VPN running. So even with the DDNS hostname out of the picture, the WOL packet still makes it to my computer when I use the numeric ISP address.

I do want to be able to continue to wake the computer from outside the LAN, but it still puzzles me that the ISP address would continue to work in addtion to the VPN address. I expected that I would have to start using the VPN address exclusively and get the DDNS to update to the VPN address to be able to use the hostname.

I will also note that the Cyberghost guide recommended the following firewall rules that I did not implement:

iptables -I FORWARD -i br0 -o tun1 -j ACCEPT
iptables -I FORWARD -i tun1 -o br0 -j ACCEPT
iptables -I INPUT -i tun1 -j REJECT
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE

I did not use these rules because it seemed like other posts said that they were not needed if NAT and Firewall Protection are enabled in the GUI. I see that you are skeptical of the rules that DD-WRT implements, so I looked at the rules you suggested in your other post, but it seems my needs are different. I will admit that the iptables rules are beyond my grasp without some more study.

I will try the Cyberghost rules next and see if that changes the behavior.

Any other comments or light you can shine on this would be appreciated.

[slipry79]

Thanks again. This info was very helpful for my understanding the functions and the sequence of what is going on with the VPN. I will do some more testing and report back.

I have also found that I am still not reliably connecting to the Cyberghost VPN server after reboot of the router, so I will keep working on that as well.

[slipry79]

After further testing, here is what I have found:

1) Connection issues
The Cyberghost setup guides and related info lead you to use vpn server names of the following form: "1-us.cg-dialup.net".

If you do a nslookup on that hostname it resolves to multiple ip addresses. This is supposedly a good feature so you always get a server that is available and has capacity. The individual servers have names like atlanta-s01-i01.cg-dialup.net, and those hostnames resolve to one unique ip address each.

What I believe is going on is that the individual servers behave differently. Here is a fragment of the syslog when the router successfully connects to a server: