OpenVPN behind ISP router

Hi all,

 I have bought a mikrotik (rb951ui-2hnd) router a few days ago and stuck with the OpenVPN configuration. 

ISP router is only used to provide internet connection so the DHCP is disabled and 1194 port is forwarded to mikrotik router, everything inside home network is handled with mikrotik router.
Mikrotik router is connected to ISP router over ethernet1 interface.

Connection is similar to this one but without the AP:

I have configured OpenVPN network following the instruction from mikrotik and added the firewall exception for openVPN. When I’m connected to internal wireless network the connection over OpenVPN is established successfully but it just won’t connect from the internet.

In the firewall exception I can see that the mikrotik router is receiving the packets every time when I try to connection from the internet but the OpenVPN server won’t respond.

So any suggestions what am I missing or doing wrong?

Do you get public addres form isp router?
It could be you need to set up DMZ in isp router.

What model is it?

Hi kristaps,

the model of ISP router is:
ROUTER ZYXEL VMG5313-B

The mikrotik internet interface doesn’t get public IP.
ISP router receives for example 111.222.333.444 IP address from ISP DHCP. Local IP address of ISP router is for example 100.100.0.1. and IP address of mirkotik router is 100.100.0.2.

I’m trying to replace current Siemens Sx763 router with mikroitk. SX763 router has DD-WRT on it and OpenVPN is working fine.

Also when performing the online check if the 1194 port is open for the SX763 I get that it is but when I replace it mikrotik I get that the port is closed.

Maybe with OpenWRT you used UDP for OpenVPN?
MikroTik (sadly) does not support this!
With MikroTik OpenVPN works only with TCP!

Hi pe1chl,

it's not that. I always use TCP for VPN since it provides extra transfer security.

This “extra transfer securitY” is not required and can cause problems when the connection is heavily loaded.

But anyway, it seems that to resolve this you will have to do some debugging that is impossible to do remotely.
Start with doing a packet sniffer trace to see what is going where.

Hi all,

after struggling with the OVPN for a couple of days I have decided to restore default config on Mikrotik and connect ISP router as public address. Not really what I had in mind but now everything is working.

Anyway thanks guys for help.

The best way in that kind of problem is setup SSTP on RouterOS CHR (cloud hosted) that is installed on VPS server.