Hi all, as the title says I’m trying to set up Proton VPN on an old router, with the goal of piping 100% of my home traffic through the VPN. I followed this tutorial I found https://protonvpn.com/support/how-to-set-up-protonvpn-on-openwrt-routers and as soon as I got to the end of it, I couldn’t access the internet with the VPN instance started. If I turn it off, the router behaves normally. I’ve looked through the instructions and I can’t see where I’ve deviated from them, and I’m a little out of my element with routers so I’m not sure how to improvise. Any advice on what to try would be appreciated!

Facts:

  • with the VPN service down, both the router and connected clients are able to access the internet (ping 8.8.8.8 is the test). However, with the VPN service up neither the router nor any connected client appears to be able to access the internet at all.
  • running OpenWRT 24.10.3, which should be supported
  • using the Free tier of Proton, I don’t think that should be impacting as I don’t see anything that says I can’t do this with the Free tier, but it may be relevant
  • The OpenWRT router is currently behind my ISP router, which again I don’t think is relevant (and it’s how I would like the final topology to look anyway) but IDRK.

selected log snippets from the router. NOTE there are a ton of logs with the repeated EHOSTUNREACH array of varying lengths, they all seem to have the same error at the end: Host is unreachable (fd=5,code=148)

daemon.warn openvpn(protonvpn)[19695]: NOTE setsockopt TCP_NODELAY=1 failed
daemon.warn openvpn(protonvpn)[19695] sitnl_send: rtnl: generic error (-128): Network unreachable
...
daemon.notice openvpn(protonvpn)[19695]: WARNING: OpenVPN was configured to add an IPv6 route. However, no IPv6 has been configured for tun0, therefore the route installation may fail or may not work as expected.
...
daemon.notice openvpn(protonvpn)[19695]: Initialization Sequence Completed
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
... # This block repeats over and over
daemon.notice openvpn(protonvpn)[19695]: SIGUSR1[soft,tls-error] received, process restarting
daemon.warn openvpn(protonvpn)[19695]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
daemon.notice openvpn(protonvpn)[19695]: TCP/UDP: Preserving recently used remote address: [AF_INET]89.187.171.225:51820
daemon.warn openvpn(protonvpn)[19695]: NOTE: setsockopt TCP_NODELAY=1 failed
daemon.notice openvpn(protonvpn)[19695]: UDPv4 link local: (not bound)
daemon.notice openvpn(protonvpn)[19695]: UDPv4 link remote: [AF_INET]89.187.171.225:51820
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH|EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: read UDPv4 [EHOSTUNREACH]: Host is unreachable (fd=5,code=148)
daemon.err openvpn(protonvpn)[19695]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
daemon.err openvpn(protonvpn)[19695]: TLS Error: TLS handshake failed
daemon.notice openvpn(protonvpn)[19695]: SIGUSR1[soft,tls-error] received, process restarting
  • watson@sopuli.xyzEnglish
    3·
    1 day ago

    Is it being blocked by the firewall on the ISP router?

    EDIT: I have ProtonVPN running through Wireguard with Gluetun. It was pretty simple to set up that way.

    • village604@adultswim.fanEnglish
      2·
      13 hours ago

      Thank you for this. I’ve been struggling to get wireguard running in hotio containers on my Synology, and this looks like it might be what I need.

      Edit: it worked! Had to fiddle around with it because it didn’t like multiple containers in one compose yaml

    • oddlyqueer@lemmy.mlOPEnglish
      2·
      1 day ago

      I don’t think so, I’m not trying to do port forwarding or anything like that, I just want the secondary router to be treated like a regular client by the ISP router (that only sends traffic to the VPN). Thanks for the rec though, if I can’t get the native client working I’ll give Gluetun a shot.

      EDIT: I added some rules for UDP ports 1194 and 5060 to the ISP router just in case there was some back traffic that wasn’t getting back to the client, restarted the server and same result, Host Unreachable :(