VPN server on 4G router

Tech, TV, Mobile, Internet and Geek Corner
1
Calling all network engineers! :-)

I've just got a tp-link 4G router and it works fine with my salt SIM card. It offers a VPN server, either openvpn or PPTP. I set it up but can get neither of these to work.

If I ping the dynamic dns address of the router it translates to an IP address but the ping times out. If I ping the (different) IP address reported by the router it also times out. Is this just a symptom of using a mobile network and I won't ever be able to get it to work?

2
probably it just doesn't answer ping due to security reasons. Any idea why is the ddns IP different from the IP reported by the router?

What do you exactly want to achieve? I cannot really imagine a use-case for which somebody needs VPN server on a 4G router.

3
I wanted to set-up a 4G router in a remote location where I don't want to pay for broadband and as it seems to offer VPN servers I wanted to set that up for the usual reasons but specifically for security and to bypass website blocking when using internet in dodgy foreign countries. I read though that mobile ISPs work a bit differently though to regular ones and that VPN might not work but then I wonder why the functionality exists in the router.

4
I had a Yallo (aka Sunrise) 4G router for 9 months in 2020 and that worked fine with both Nord and ExpressVPN

5
all 4G networks in CH use NAT. the internet facing address is not unique to your router.

that's the whole point of the VPN, no?

i have one set up running openvpn on a raspberry pi to a virtual server in frankfurt via a Salt 4G connection. works fine.

6
if this is the case, OP has two options: ask the provider to assign a unique public IP to this SIM card (probably will be expensive) setup the VPN server on a landline connection

PS: nordVPN and so are irrelevant as they are VPN clients, indeed they work even behind NAT.

7
Something not pinging doesn't necessarily mean anything (although often it does).

Definitely setup a ddns as a SIM is very likely not going to have a static IP.

Once the ddns is up and running, try to run a simple web server with a random html page, setup the port forwarding and see if you can see that page using the ddns. If so, that is a good proof of concept for any other service (such as a VPN).

8
Ping failing means the route drops ICMP packets. Nothing special there.

What are you trying to do? If they have CG-NAT which they undoubtedly do then you might want to look at www.remoteutilities.com

This is how I get around the exact same problem (CG-NAT at both ends).

If your devices are all Windows or Mac or similar (not mobile) then also look at TailScale. This can create a network across your devices (I've not tested this).

9
I set-up a NOIP DDNS on my wired fritzbox which has NOIP support built in and that works fine. Never had to do any explicit port forwarding for the VPN (server) on that.

The TPlink 4G router offers remote connection and VPN and should also set the standard ports automatically (1723, 80, 443 etc). It also has built-in NOIP DDNS support. I can http to it using the ip address listed by the router if I'm on the same network (not 192.168... but rather like 10.155.xxx.xxx which I think is also internal) but otherwise not and the DDNS hostname doesn't work either.

Router has a WAN socket so I might one day see if it'll work with a wired connection. Important right now is just to get the 4G router in place.

I discovered Windscribe VPN and that'll do me for the occasional UK IP address need on my phone.

10
totally irrelevant since you are behind a NAT. DDNS is just going to point you are the 4G ISP's NAT gateway. no way from there back into your router without a VPN>

11
Makes me wonder why the 4G router would have this feature (VPN server and DDNS) if it's doomed to work from the start.

Edit: Seems in some locales public IP is given by the mobile ISP, just not here. Tried it on a broadband WAN but couldn't get it to work. Probably needs some port forwarding from the broadband router. Given up now.

12
exactly. not all 4G provides NAT but all in CH do and its increasingly common everywhere.

port forwarding won't help. you need to tunnel the NAT. just set up a vpn server externally on a virtual server (any number of providers) and then vpn via that. this is how i connect to my DVR from my phone to see CCTV at home. its way more secure than opening up ports on your router anyway so even if you were not on a NAT ip this would be the preferred solution.

13
So, the answer is likely called "IPv6"....

This as most of the phone networks that do CG-NAT, also provide IPv6.

Check if you can open http://ipv6eyechart.ripe.net/

That should give a decent showing if you have IPv6 or not.

Or check with something like https://whatismyipaddress.com/

If you have IPv6, you are done, well more or less, as it require the remote end to still have IPv6 too, but that can be gotten in a variety of ways.

If you do not have IPv6.... you effectively need a static IP somewhere to do a callback. OR, if the remote end does have public IPv4 you could for instance send a SMS to your VPN server and ask it to connect to other public IP (or just change client/server roles).

Another trick is TURN/STUN which can be used as a rendezvous point (but that requires software support).

And another option, eg. https://ungleich.ch/u/products/ipv4-as-a-service/ or any other "VPN" provider that gives you a public IP, be that IPv4 or IPv6