Changed router. Now clients cannot access internet

dos286

I have had a VPN server up and running happily for some time. The server runs on a linux box behind a router. Client internet service is pushed through the VPN. The router died and I replaced it. Now VPN clients cannot access the internet. I tried to setup the new router the same as the old. I reset port forwarding and static routes. Clients can connect to the VPN just fine and can access LAN resources, but they cannot access the internet. I have gone through every page of the router settings and cannot find a setting that would cause this. It has to be something in the router because that is the only thing that changed. Any ideas what to look for and how to get internet for the VPN clients?

x230

Can the servers inside the VPN LAN access internet by themselves (without VPN, but of course, through the router)? That way, you know if it is router's fault.
My router has what the manufacture calls "IP filters". See if yours has some kind of filters that are blocking outgoing http/s.

dos286

I'm not exactly sure the topology you are asking about, but see if this helps:

VPN server: can access the internet
Other computers on the same LAN as the VPN server: can access the internet
Computers not normally on the LAN but joining the LAN via the VPN server: cannot access the internet while on the VPN, but can access the internet while not connected to the VPN.

Does that answer your question?

I'm not sure about IP filters. The new router is a Netgear Orbi. Here are some of the settings that I suspect may have something to do with it:

Under WAN setup (I'm including these just because they are under the WAN and the VPN clients can't access the WAN):
- Disable Port Scan and DoS Protection (not selected)
- Default DMZ Server (not selected)
- Respond to Ping on Internet Port (not selected)
- Disable IGMP Proxying (selected)
- MTU Size: 1492
- NAT Filtering: Secured
Under Security:
- Parental Controls: disabled
- Access Control: turned off (I suspect this is the equivalent to the IP Filtering you mentioned)
- Block Sites: never
- Block Services: never