ZyXEL USG static route not working for Internet access

gork

I have OpenVPN set up to allow me to access the Internet through my network from the workplace (with permission fwiw). I have everything working fine through my ZyXEL ZyWALL 2WG but recently upgraded to the USG 20W and now can't access the Internet through the OpenVPN tunnel. I got everything up and running with help on the OpenVPN forums as well as instructions from the lockup site, including the original site those instructions were based on.

I have verified my problem is not with the firewall in the unit by disabling the firewall for testing purposes. I also disabled the software firewall on the OpenVPN server machine. I don't have a problem initiating the VPN, or with pinging devices on my home network after the tunnel is set up. (To include the OpenVPN server and the host computer it is on.) However, I am unable to access the Internet through the tunnel. (I have verfied it's not a DNS issue.) I used the same settings in the USG device as I used in the 2WG, and I can currently replace one with the other and have consistent results - the 2WG allows Internet access through the tunnel and the USG doesn't.

I tend to believe this is a routing issue, though I don't understand the reason for the issue. I route all traffic from the OpenVPN client to the OpenVPN host machine, as indicated by the guide I linked above, via a static route setting. I have tried using a policy route as well, but have to admit I can't quite wrap my brain around exactly how the routing should be set up, and why it works differently in these two routers.

My network (10.168.1.0/24):
OpenVPN server host (WinXP): 10.168.1.34
OpenVPN TAP adapter: 10.168.10.1
Client TAP adapter receives (via DHCP): 10.168.10.0/25 (ends up with 10.168.1.2)
Client computer connects via wifi, and is assigned IP via DHCP: 192.168.1.0/24
NAT on the USG forwards the appropriate port to the OpenVPN server host
Static route: 10.168.10.0/25, next hop: 10.168.1.34

I have a simple setup - cable modem goes to the USG, the USG goes to a switch and all devices on my network are attached to the switch.

Does anyone have any thoughts on this? I am more than happy to supply additonal information. As I mentioned above, I have tried to mess around with a policy route but have gotten nowhere, and the tunnel comes up fine and gives me access to my network just not the Internet through my network. Though it should seem obvious since I have things working properly over the old router, I'll mention anyway that I did change the registry on the OpenVPN server machine (WinXP) to allow the Internet packets to be routed as instructed on the site I linked above:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
IPEnableRouter = dword:00000001

Here are my config files:

# SERVER #
local 10.168.1.34
port 1194
proto udp
mssfix 1400
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
dev tap
ca "C:\\xxx.crt"  
cert "C:\\xxx.crt"
key "C:\\xxx.key"
dh "C:\\xxx.pem"
tls-auth xxx.key 0
server x.x.x.x 255.255.255.128
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
keepalive 10 20
cipher AES-128-CBC
comp-lzo
max-clients 4
persist-key
persist-tun
status openvpn-status.log
verb 1

client
dev tap
proto udp
remote remote.myurl.com 1194
route x.x.x.x 255.255.255.0 vpn_gateway 3
resolv-retry 5
nobind
persist-key
ca "xxx.crt"
cert "xxx.crt"
key "xxx.key"
tls-auth xxx.key 1
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 1

EDIT:
Sorry if this should have been in the Configuration sub-forum, I'm not sure and didn't see the sub-forum in time anyway. Mods, please move the post to that location if it'd be more appropriate.

Mimiko

Can you ping the router from the client?
I suppose that 2WG was setup to allow internet access to any IP from LAN, but USG is setup to allow internet access only from 10.168.1.0/24. The client does not have such an IP, and you even don't do any masquerading on OpenVPN server.

gork

Why no, no I can't ping the router from the OpenVPN client. I can't believe I didn't even think to try that! I'll bet you're spot on.

But why wouldn't the static route forward the packets to the server host which would then forward the info on from the correct subnet? I thought that's what the static route was supposed to do.

I so don't know anything about masquerading on the vpn server, and I don't know if there is a setting in the router that will "fix" this for me. But you've given me a direction here; let's see how far I can get with it.

gork

Bebop posted in the example forum how s/he accomplished this - though not through a USG router specifically. In addition to changing the that entry in the registry, Bebop also enabled a setting on the TAP interface to allow Internet connections through it. (S/he gave instructions to also enable "Routing and Remote Access Properties" on the server machine as well, but I didn't find that to be necessary.)

I found that when I followed these instructions I no longer needed a static or policy route defined in the router.

I feel a little let down, though, because I didn't really learn very much through all this. First, why did the 2WG allow access with a static route, as per the instructions on my initial post? Apparently this is the "norm" because those instructions were written for "routers in general," and not a specific model. And from a security point of view, have I done something "wrong?" And what if I had a more complicated network, with multiple connection to the Internet. This definitely WOULD be a problem in that case wouldn't it?

I guess I got this working, and I'm grateful for that (thank you Bebop), but I'd like to understand the situation a little better.

EDIT:
I guess one problem would be that if my network had more than one user and they were limited by router as to what/when they could connect to the Internet this would be a problem since they could access the Internet any time this PC could now... This makes me feel like doing it this way is "not right" and I'd really like to understand a better way of going about it.

Mimiko

Read this https://forums.openvpn.net/topic9465.html and see the methods on sharing and masquerading in windows.

gork

Thank you; I've read through the post you referenced a few times and will continue to work on trying to wrap my head around it. ;) It's very kind of you to take the time to share your knowledge.