Full Fibre, Own Router & OpenVPN

[#1]

I have just joined PlusNet (like days ago).

I'm using my own router on my new full fibre connection, internet all working.

On the router it has a built in OpenVPN server that I use to connect to my network from outside to access CCTV cameras, media and Home Assistant.

When I try to connect to the OpenVPN from my mobile now I'm getting a CONNECTION TIMEOUT error message.

Is this being blocked at the server end by PlusNet via a blocked port or similar?

Does anyone have any idea how to fix this?

I did explain that I was going to be using this when I signed up and no one raised a red flag.

[#2]

@gordon861 how are you connecting ? are you using DDNS or do you have a static IP ?

[#3]

For a new account there wouldn't be anything on the Plusnet side blocking it.

From what you say, it sounds like you have had this set up previously, and used it on another ISP.  Is that correct?

If so, have you updated the IP Address that the VPN client is connecting to, to that of your connection at the moment?  You would be on a dynamic IP Address, unless you have requested and paid for a static IP Address, so it is possible that it has changed.

As the VPN server is part of your router, I would guess that the right ports get opened up by enabling the VPN server, though that might be worth a check.

[#4]

Thanks for your replies.

I thought that OpenVPN didn't need static IP addresses, but I may be wrong.

I was on VirginMedia previously and that also has dynamic IP and it always just worked

Doing a quick search I see that PlusNet only charge a small setup fee for static IP so I might try that out.

My main concern was that there may be something fundamental that wasn't able to be fixed.

[#5]

I thought that OpenVPN didn't need static IP addresses, but I may be wrong.

I was on VirginMedia previously and that also has dynamic IP and it always just worked

So presumably you have a DDNS url you use to make the connection from a client ?

Is that setup correctly and resolves to your Plusnet IP ?

as @pjmarsh says , there shouldn't be anything on a new account to block it. On older accounts, there was a server side firewall , the 'Broadband firewall' that could be configured to block incoming connections, but that should not be present on new accounts.

[#6]

OpenVPN does need a static IP address, but the VPN client needs to know the address of the server to connect to.  With a static address that address doesn't change.  With a dynamic address it probably will change from time to time.  Using a DDNS provider, your router would tell the DDNS provider what your current IP address is when it changes, so if you use a DDNS url then that will point to your current dynamic IP Address shortly after it changes.

The other option would be to manually change the IP address in the client each time it changes, but you wouldn't know when it might change, or what it is when you aren't on your connection, so would be quite hit and miss if the VPN would work when you wanted it to.

[#7]

Just looking at the OpenVPN client on my phone and I see a 'Server Hostname (locked)' which is an IP address, which I assume was the IP when it was set up and what it is trying to connect to.

Under that is a 'Server Override (optional)' which I assume is where I would type in the current IP address if I knew what it was.

My router is a fairly recent ASUS which I think has Dynamic DNS service options available.

So if I understand your info above, if I sign up to one of the free Dynamic DNS services I just need to add the new hostname into the Override line and I should be good as it'll use that to link to my current IP address?

[#8]

@pjmarshis that a typo and you meant 'doesn't'  need a static IP ?

Just looking at the OpenVPN client on my phone and I see a 'Server Hostname (locked)' which is an IP address, which I assume was the IP when it was set up and what it is trying to connect to.

@gordon861 as I understand it, that's because you normally export a client connection profile .ovpn file from the server and you then import that into the client and its locked.

You SHOULD be able to export a new profile from the server using a DDNS hostname instead of an IP

or it might be simpler just to get a static IP and export a new profile with that IP

[#9]

Oops, thanks @MisterW. Yes a typo.  I definitely meant doesn't!

[#10 · Accepted solution]

OK, it's now working.

For anyone else that finds this thread in future:

1. OpenVPN was setup on my router and a config file was exported and sent to my phone, and installed there.
2. On my router I used the built in DDNS options (under WAN on my router) and setup one of the DDNS options.  I used the ASUS one as its an ASUS router, others may need to be setup externally first.
3. Once the DNS is setup, open OpenVPN on your phone select the edit for your VPN config and change the 'Server Hostname (optional)' to match your new DDNS that you set up above.
4. Save changes and that's it

I can now access my Plex/Jellyfin, CCTV and Home Assistant from anywhere so long as I have internet access.

This should, in theory, make public hotspots much less dangerous, if you must use them (personally I don't).

Thank you for your help.