Problem with TP-Link Router setting up static routing

LittleNoMuc

I have two sites connected using OpenVPN. Site A is the OpenVPN-Server (running on an Ubuntu machine behind a DSL router), site B is the OpenVPN-Client (running on a Raspberry Pi behind a router). I configured the service to make the whole other LAN available from each side. This configuration was running fine for more than a year. On site B there was a Huawei LTE router, where I configured in it's static routing table to route all traffic to site's-A IP-range to the Raspberry hosting the OVPN service. Now I switched the ISP to another one that is using DSL-technology and therefore I got a new router (TP-Link Archer VR600v). I put exactly the same setup (IP-ranges, static routing) to this new router but can't get everything working.

Here's the problem: Accessing any IP in LAN A from LAN B works. Accessing the OVPN-host in LAN B from LAN A works. But accessing any other IP in LAN B from LAN A does not work. A traceroute shows 30 hops but without any further explanation. So I guess the problem is the route back from LAN B to LAN A.

For testing I connected and configured with the same settings another DSL Router (AVM FritzBox), where everything again works fine.

I'm pretty sure the TP-Link device is handling something wrong. Of course it's firmware is up to date. I already contacted TP-Link support, but they don't care (didn't expect anything else from them).

Here are my questions:
1. Any ideas how to further troubleshoot this one?

2. Any other ideas how to workaround this malfunction of the TP-Link device. Even though I hate this china crap, I would like to get it working anyway because these units are much cheaper than better brands and I have some more sites where I wanna use the same scheme. Would save me some money getting the TP-Link units working.

LittleNoMuc

here is the server config:

port 1194

proto udp

dev tun0

ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key # This file should be kept secret

dh ./easy-rsa2/keys/dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp_hhsl.txt

push "route 192.168.3.0 255.255.255.0"
push "route 10.8.1.0 255.255.255.0"

client-config-dir ccd

client-config-dir ccd
route 192.168.20.0 255.255.255.0

client-to-client

keepalive 10 120

tls-auth ./easy-rsa2/keys/ta.key 0

cipher AES-256-CBC # AES

comp-lzo

user openvpn
group openvpn

persist-key
persist-tun

status openvpn-status_hhsl.log

verb 3

iroute 192.168.20.0 255.255.255.0

to make it clear
Site A = 192.168.3.0
Site B = 192.168.20.0

drfuna

i have the exactly same problem. The static route on my tplink archer6000 works for itself, but not for any other device on the local network. so after i added the route i can ping the router via vpn (and of course the vpn server) but no other device. It seems that the route is only valid for the router itself. For testing i added the same route on an ubuntu client in my local network and then it is accessible. Did you find any solution on your model?

300000

You need to do NAT and ip forward on raspberry so it will work . Before you ve done it on router but now do it on raspberry is the same.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

after that enable ip forward on system so it can routing in both side for you

Asprince

300000 wrote You need to do NAT and ip forward on raspberry so it will work . Before you ve done it on router but now do it on raspberry is the same.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

after that enable ip forward on system so it can routing in both side for you

The static route on my tplink archer6000 works for itself, but not for any other device on the local network. so after i added the route i can ping the router via vpn (and of course the vpn server) but no other device. It seems that the route is only valid for the router itself. For testing i added the same route on an ubuntu client in my local network and then it is accessible.