Connecttion problem

[facx]

Hello,

Im wondering if anyone could help me out with a little problem im having.

I have set up OpenVPN running on a Linux server and I use Win XP SP2 to connect to it with its own client (not pptp). I connect to internet using DSL, now is there anyway that i can make VPN the default network connection? I guess what i need to do is route my DSL connection to the VPN so the whole computer uses it like a chain (DSL>VPN>Internet). Is there any way to do that?

Thank you

[Scarecrow Man]

From what I know of VPN's, you connect to it so it acts like a LAN. Therefore, your only connected to those computers. I don't know how the internet fits into all of this..

Bump :huh:

[facx]

ya, you use it to connect to a LAN, but in my case the internet is the lan, so instead of DSL > VPN Server > LAN, it would be DSL> VPN Server> Internet

[homecomputeraid]

Hi Facx,

I'm having a little trouble visualizing your network. Is it:

XP Computer --> Linux/OpenVPN Computer --> DSL Connection --> Internet?

If so, do have 2 nic's on the Linux box, and are you using it as a Firewall? Not sure what you're trying to set up.

In order to make the XP machine's Internet bound traffic go through the VPN tunnel, you go to Network Connections, right click the VPN connection you want to edit and select Properties. Then go to the Networking tab, select Internet protocol (TCP/IP), and click Properties. Click Advanced, and on the General tab, make sure Use default gateway on remote network is checked. If it is, any traffic going off your local LAN should use the VPN.

If I misunderstood your question, or this answer isn't what you're looking for or is incomplete, plese let me know.

Sincerely,

[facx]

Just about right, but its going like this:

XP Computer --> DSL Connection --> Linux/OpenVPN Computer --> Internet

The VPN is on a remote server. I have enough IPs available so thats not a problem.

VPN is configured as a TAP adapter (LAN).

What Im looking to do is make windows think TAP is the main connection to the internet while still using DSL.

So basicly route it somehow like this (locally): DSL > TAP adapter(VPN)

Hope that explains it.

[homecomputeraid]

facx,

If the VPN is on a remote server, you have to get to the Internet to create the VPN Connection, don't you? When you say remote, do you mean on a seperate LAN segment, or over the Internet?

Once the VPN's up, if you use the gateway of the remote network as I described earlier, all traffic from that PC should pass through the Unix box before going out. Is that what you're after?

Sincerely,

[facx]

Hello homecomputeraid,

Yes, to establish VPN connection I would have to be connected to the internet.

Does default gateway work for all adapters on the computer(Win XP)?

Since TAP is under LAN(in network connections) I have the following tabs in TCP/IP Properties > Advanced:

IP Settings, DNS, WINDS, Options

Putting IP in Default Gateway did not change anything.

Thanks

[homecomputeraid]

facx,

Once the tunnel is up, the "primary" adapter becomes the VPN adapter. The VPN Adapter should be used for all traffic unless "split tunneling" (Nortel Term) is enabled. To do split tunneling, you would not use the gateway on the remote (vpn) side.

Am I explaining clearly? Once the tunnel comes up, the PC should send any packets destined for "remote" networks, or networks off your local LAN through the tunnel.

Once the VPN tunnel is up, should you be able to browse the Internet through the tunnel via the Unix box? If you are supposed to be able to, what indications do you have that it's not working the way you want?

From what you're describing, it's hard to know whether the PC is going directly to the Internet (which it has to do to set up the VPN Tunnel), or whether the traffic is actually going through the tunnel, out the Unix box via the tunnel, and back to you.

I hope I'm not making your head spin with all these questions while I try to help you! :)

You seem to have a pretty good grasp of networking. I'm trying to figure out what you ultimately want to accomplish, and find out why you feel it isn't happening now.

It sounds to me like it's set up like you want. The PC gets to the Internet, it creates a VPN Tunnel with the Unix box (again to be able to access the Internet I think?) and all traffic then goes through that tunnel to get to the Internet. Or, is that not what's happening?

You may have to use a sniffer to know for sure, but you could try a trace route (tracert) from the windows machine when the tunnel is up. That may be deceptive though because the tunneled traffic still has to go across the same routers.

A free sniffer program, Ethereal is available if you want to download it. If you choose to do so, make sure you download and install WinPcap, also available at the same site, and install it before installing Ethereal.

Hope I'm helping, not making you pull your hair out!

[facx]

Hello homecomputeraid,

Yes, that is what Im ultimately trying to get to, internet through the Linux servers.

How do I know its not working?

I did traceroutes yesterday, in a VPN connection the first hop would show the VPNs IP instead of your normal ISPs gateway. Also when accessing a web site it would show your IP as was assigned by the VPN.

If there was a problem with the VPN setup then once using the VPN I would not be able to access anything (Which might happen, after the windows issue is fixed)

If you have any more ideas, I'll gladly try them out, I myself dont know how to fix the problem.

Thanks

[homecomputeraid]

Thanks facx,

It sounds like you've done some excellent trouble-shooting to determine whether traffic is going through the tunnel.

And, thinking more about it this morning, I did believe a trace route should tell you because of the reason you stated. If all traffic is going through the tunnel, the first hop should have the IP of the VPN adapter.

I'm not familiar with a Microsoft TAP Adapter. How did you set that up?

I've done PPTP adapters with Windows, and IPSec with clients from Nortel and Microsoft. They seem to behave as I said when use gateway on the remote netowrk is checked. I'm going to do some testing myself to verify.

Here's a link to troubleshooting OpenVPN. It will be more meaningful to you than me, probably? I'm not very knowlegeable about Unix yet!

http://openvpn.sourceforge.net/trouble.html

If I'm able to test with that TAP adapter, I may be able to offer more insight. Please let me know how you added that.

Sincerely,

[facx]

Thanx for all your help so far.

I installed the TAP adapter using the OpenVPN Windows files.

The troubleshooting guide covers connection problems, in my case the connection is succesfully established.

What Im looking for I guess, is how to make it use the vpn as default gateway or how to route traffic between adapters before it hits internet so VPN in fact becomes hop 1.

[homecomputeraid]

I believe I understand what you're trying to do. Unfortunately I don't know how to make it happen for you yet. Any chance you can make me a temporary login on your OpenVPN box, and some instrucitons on where to get the VPN Client for Windows XP?

[homecomputeraid]

facx,

If you decide to let me into your network, I suggest a temporary account with minimal rights (user rights) which will only allow me to create a VPN session and get to the Internet through your OpenVPN box. If you'd like me to try generally searching the Internet instead, please post.

If you find the answer yourself, it would be great for future reference if you could post here.

Thanks for providing all the information you have so far! :)

Sincerely,

[homecomputeraid]

Just an update on this thread;

facx made me a login on his VPN Server. We connect ok, but the OpenVPN product isn't that easy for us to figure out. If anyone has some experience with it, please post here. We connect fine, but the Default Gateway does not switch over to the VPN Adapter's IP Address like it does with other VPN Products.

Sincerely,