Synology VPN Plus Android Client Will Not Connect Over EE 4G

[scotttoward]

I have a Pixel 2XL Android 11 phone 
I have Synology VPN Plus client installed 

When I connect to my Synology VPN server over WIFI from an external location it works fine
When I connect to my Synology VPN server over EE 4G I get connection timeout 

This used to work just fine earlier this year but now it does not 

The weird thing is I can connect my laptop to a 4G hotspot on the same phone then use the Synology VPN client on my laptop to connect to the VPN just fine  

I have tried changing the server ports of my VPN server from 42500 to 443 no difference

I tried the same phone with a different Vodafone sim and it works fine so must be an issue with my phone and the EE network 

[Christopher_B]

Hi @scotttoward

Welcome to the EE Community, I hope you're well and having a brilliant day.

It is strange that it's working fine other than the 4G. I would advise having a chat with our tech gurus so they can look into this with you.

Thanks 

Chris 

[scotttoward]

I thought that's what I was doing by posting here how do I contact the right people in your team without having to spend an hour on the phone going through the support tiers to find the right person

[Christopher_B]

@scotttoward Here at the community we don't have access to your account and our tech gurus are specialists with this kind of thing. 

However you may not need to call as we have an online chat service. If you follow the 'Technical Issues' path on the link I sent you then you should be given the option to chat online.

Thanks 

Chris 

[mikeliuk]

Hi @scotttoward ,

Do you know what subnet is configured to be used by your VPN server?

I suspect you may have chosen a subnet overlapping the 10.0.0.0/8 range which could possibly clash with an IP address assigned to you by EE.

It would anyway be a good thing to rule out by checking your Android phone's IP address before you attempt to connect to your VPN. If you get a CGNAT IP beginning 100.x.x.x then go ahead and attempt a connection. If you receive an IP address in 10.0.0.0/8, keep reconnecting until you don't.

If your VPN does use a subnet overlapping 10.0.0.0/8, you could change it to one of the other private IPv4 subnets as hinted below.

Important: Before specifying the dynamic IP address of VPN server, please note:

1. Dynamic IP addresses allowed for VPN server should be any of the following:

   • From "10.0.0.0" to "10.255.255.0"
   • From "172.16.0.0" to "172.31.255.0"
   • From "192.168.0.0" to "192.168.255.0"

2. The specified dynamic IP address of VPN server and the assigned virtual IP addresses for VPN clients should not conflict with any IP addresses currently used within your local area network.

https://kb.synology.com/en-uk/DSM/help/VPNCenter/vpn_setup?version=6

[scotttoward]

Thank you so much for your message which does make a lot of sense considering my VPN server does indeed hand out IPs in the 10.0.0.0/8 range.

I tried changing this to 172.21.0.0/24 range even rebooted the router and my phone for good measure but got the same connection ERROR CONNECTION TIME OUT 

[mikeliuk]

Hi @scotttoward ,

Based on the observation "The weird thing is I can connect my laptop to a 4G hotspot on the same phone then use the Synology VPN client on my laptop to connect to the VPN just fine", I feel that the next thing to check is whether your phone is configured for "IPV4V6" dual-stack and to add new APN settings with "IPV4" (i.e. IPV4-only) and the rest the same.

These are just a few of the obvious things and if you have commercial support for the VPN, more careful debugging may be required. I feel the above is worth a go based on your observation. If you see that the APN is already "IPV4", the mystery would deepen. I might at that point suspect the DNS chosen on your laptop may be helping it to connect etc.

If you see "ERROR CONNECTION TIME OUT" very early in the process, that suggests to me that the phone cannot route to the VPN server and the question splits into whether any applicable domain name is resolved correctly to an appropriate IP address (whether IPv4 or IPv6) and secondly whether the phone can route to that IP (given that a client laptop can). (It's possible your laptop resolves an IPv4 address but your phone resolves an IPv6 address for example.)

[scotttoward]

So when I connect the VPN client on the mobile it goes through and takes the username and password then comes back with my 2FA code which I enter it goes away and comes back with the TIMEOUT ERROR, I tried turning off the 2FA in case it was that but no difference 

As for the laptop I believe it uses the DNS assigned by the hotspot gateway which should be the same as the phone's dns but would need to check that 

Ok so how do I check the APN setting and stack on my phone as I also suspect this is the problem 

[mikeliuk · Accepted solution]

Hi @scotttoward ,

The pinned thread is https://community.ee.co.uk/t5/Mobile-Data/EE-APN-Settings-Where-to-find-them/m-p/741851 but it does not mention IPV4 vs. IPV4V6 so you can supplement that information with https://apninternet.com/ee-united-kingdom-apn-settings/ which has pictures.

All the MMS stuff can be ignored in the first pass. The main difference in the two references is that username and password are left empty in the second which matches the default configs given in the Netgear MR1100 for me. Other people find that they require username and password to be set.

[scotttoward]

OK so found the APN Setting but they are all greyed out no way to edit them 

EE Internet (Selected)

APN Protocol is IPv4/IPv6

APN Roaming Protocol IPV4

EE MMS

APN Protocol is IPv4

APN Roaming Protocol IPV4