Help UDP TomatoUSB VPN working great, TCP...not so much

burntoc

Sorry for the length of this message, but I was hoping someone could help me understand what's going on here.

I have a AC68u running AdvancedTomato/Shibby v137 (b/c/ v138 had a known, unrelated bug that affects me that v137 doesn't). Anyway, I'm trying to set up OpenVPN as I have several times before, with TUN UDP via 1194 on Server 1 and TUN TCP 8443 on Server 2. UDP works great -it connects, I can tunnel through to the internet, and I can access the router via it's internal IP as desired. However, virtually the same exact configuration fails on TCP. I did run into this behavior a couple of years ago when copying a working config to a new router and I eventually gave up, but I really want to solve this. Here are the parts I think you care about:

DHCP/DNS
User internal DNS - checked
DHCP Client (WAN) - reduce packet size - checked
...other entries unchecked/default

VPN Server (UDP)
Basic has Start with WAN enabled, TUN, UDP, 1194, Firewall auto, TLS auth, extra HMAC disabled, and 10.7.1.x/24 subnet.

Advanced has:
Poll interval 0
Push LAN to clients - unchecked
Direct clients to redirect internet traffic - unchecked
Respond to DNS - checked
Advertise DNS to clients - checked
Encryption cipher - default
Compression - adaptive
TLS renegotiation time -1
Mange Client-Specic Options - checked
Allow CLient-client - checked

Custom config has one line:
push "redirect-gateway def1"

My client config looks like this:

client
dev tun
proto udp
remote myhouse.no-ip.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert mykey.crt
key mykey.key
ns-cert-type server
comp-lzo
verb 3
redirect-gateway

Again, this works GREAT for me. TCP, I just change UDP to TCP and the port in the server and the client config. I can connect, but I can't get to the internet or pull up the router. Here's the kicker. As I was experimenting yesterday to get UDP and TCP to work I didn't have the gateway redirect in custom config at times, but I did sometimes push DNS servers from there, and TCP DID work - but UDP didn't. I could NEVER get them both working, at least not where they would work after a reboot (my final test step to ensure something that works continues to work).

Can anyone see why this would possibly be failing? Again, it seems like a bug to me as I'd apply certain changes in VPN and test and it would work, and then changing the other VPN server would seemingly break it. Short of a bug, I'm at a loss to understand the issue now and I appreciate any help.

Mark

SomeGuy

The "is it plugged in" kind of questions:
* When you try to support "TCP" and "UDP" at the same time, are there separate configs for each on the server with separate OpenVPN Server instances? If not, that is likely your problem. You can start a single OpenVPN Server that supports TCP, and then start a second OpenVPN Server that support UDP. If you have a shell on the device, see if there is more than one openvpn process running and see if each running copy of openvpn is referencing a different config file.
* When you change from UDP to TCP, you change both the client and the server from UDP to TCP?
* After you make a change to the server, do you bounce the server(s) and verify they really restarted and loaded the new config?

Once you have more than one server with one running on TCP and the other running on UDP, you can alter part of your client config from:

proto udp
remote myhouse.no-ip.org 1194

To:

remote myhouse.no-ip.org 1194 udp
remote myhouse.no-ip.org 8443 tcp

But this only works so long as your client does not use other options that are protocol-specific.

It allows your client to try one, and if that fails or disconnects, then try the next one.