Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have seen working solutions around the issue of forcing Internet traffic to go through the OpenVPN server but they are all done in Linux, all I want to know is how to add an entry to the route table in windows to make this happen. connectivity between the client and server is fine, my Windows 7 client can establish a connection to the Windows 2008 Server, but when established Internet traffic is still going from the local Windows 7 machine. Here are the details:

Server:

Windows 2008 Server with one NIC
OpenVPN IP Address: 192.168.0.1
Local NIC IP Address (connects the server to the Internet): 10.242.69.107

Client:

Windows 7 with one NIC
OpenVPN IP Address: 192.168.0.2
ISP allocated IP Address: 10.0.8.2 (gateway 10.0.8.1)

Server OpenVPN Config:

dev tun
ifconfig 192.168.0.1 192.168.0.2
secret static.key
push "redirect-gateway def1"

Client OpenVPN Config:

remote xxx.xxx.com
dev tun
ifconfig 192.168.0.2 192.168.0.1
secret static.key

I'm not an expert with adding routes...etc. I would be grateful if someone could let me know how to add this entry in my server/client route table.

EDIT:

Output from the client's netstat -rnv

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.8.1         10.0.8.2     20
         10.0.8.0  255.255.255.252         On-link          10.0.8.2    276
         10.0.8.2  255.255.255.255         On-link          10.0.8.2    276
         10.0.8.3  255.255.255.255         On-link          10.0.8.2    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.0.0  255.255.255.252         On-link       192.168.0.2    286
      192.168.0.2  255.255.255.255         On-link       192.168.0.2    286
      192.168.0.3  255.255.255.255         On-link       192.168.0.2    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.0.8.2    276
        224.0.0.0        240.0.0.0         On-link       192.168.0.2    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.0.8.2    276
  255.255.255.255  255.255.255.255         On-link       192.168.0.2    286
===========================================================================

EDIT:

Manual table update

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1         10.0.8.2     21
      192.168.0.1  255.255.255.255         On-link          10.0.8.2     21
  204.236.211.109  255.255.255.255         10.0.8.1         10.0.8.2     21
===========================================================================

Client OpenVPN log:

Sat Nov 12 10:34:42 2011 us=740000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.0.2/255.255.255.252 on interface {C79F7583-EF9F-4E4F-86A7-16DC58BAC404} [DHCP-serv: 192.168.0.1, lease-time: 31536000]
Sat Nov 12 10:34:42 2011 us=740000 Successful ARP Flush on interface [18] {C79F7583-EF9F-4E4F-86A7-16DC58BAC404}
Sat Nov 12 10:34:42 2011 us=771000 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:4 ET:0 EL:0 ]
Sat Nov 12 10:34:42 2011 us=771000 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto UDPv4,ifconfig 192.168.0.1 192.168.0.2,cipher BF-CBC,auth SHA1,keysize 128,secret'
Sat Nov 12 10:34:42 2011 us=771000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto UDPv4,ifconfig 192.168.0.2 192.168.0.1,cipher BF-CBC,auth SHA1,keysize 128,secret'
Sat Nov 12 10:34:42 2011 us=771000 Local Options hash (VER=V4): '9960c5ae'
Sat Nov 12 10:34:42 2011 us=771000 Expected Remote Options hash (VER=V4): '9978ceb9'
Sat Nov 12 10:34:42 2011 us=771000 UDPv4 link local (bound): [undef]:1194
Sat Nov 12 10:34:42 2011 us=771000 UDPv4 link remote: 204.236.211.109:1194
Sat Nov 12 10:34:52 2011 us=615000 Peer Connection Initiated with 204.236.211.109:1194
Sat Nov 12 10:34:59 2011 us=42000 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up
Sat Nov 12 10:34:59 2011 us=42000 Initialization Sequence Completed
share|improve this question
    
Can you please add the output of netstat -rnv from the client? –  Mircea Vutcovici Nov 11 '11 at 22:07
    
I added the output to the question. Thanks. –  JuliaS Nov 11 '11 at 22:39
    
From client, can you ping any machine on the server subnet? –  quanta Nov 12 '11 at 1:55
    
The server is a standalone machine, but I cant even ping its OpenVPN IP address 192.168.0.1 –  JuliaS Nov 12 '11 at 9:55
add comment

2 Answers

The problem is that the default route is via 10.0.8.1, not via 192.168.0.2. This means that the redirect-gateway was ignored.

redirect-gateway def1 should add 0.0.0.0/1 and 128.0.0.0/1 routes via 192.168.0.2

Try to increase the verbosity on the client and find out why the 0/1 and 128/1 routes were not added. Alternatively you can test without def1 and you should see the default route replaced.

share|improve this answer
    
So what do I need to modify in the table to get this working? –  JuliaS Nov 11 '11 at 23:42
    
Add verb 3 to the client configuration and paste the relevant log from the client (the part with the pushed commands and the part with the routing configuration). –  Mircea Vutcovici Nov 11 '11 at 23:45
    
I have cleared the table manually and added the above edit, but still the Internet traffic is going through local ISP. –  JuliaS Nov 12 '11 at 9:49
add comment

I had the same problem on Windows 7. It worked after I started the VPN client as Administrator. It seems it cannot add the route without administrator privileges.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.