Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got OpenVPN running as a service on a client's computer, however oftentimes he will be in the office and able to physically connect to the network. The issue I have with this, is that even when connected to our LAN, OpenVPN still connects. This creates a latency issue of almost 5x the speed it would normally be if not going through VPN.

I looked at this post How to handle OpenVPN client as a service, when the laptop is physically on the network already? but am afraid either I'm not as knowledgeable as the poster here or we have a slightly different scenario. Could anyone help me understand how I could get it to not connect through OpenVPN when physically connected to our network? Thanks folks.

share|improve this question
    
You don't mention whether you have a seperate subnet for OpenVPN connections - though this has been asked on the page you refer to... –  Hauke Laging Feb 14 '13 at 15:16

2 Answers 2

From a network perspective it is best to solve this on the client: Check for the LAN ip and act accordingly (don't start OpenVPN; adapt routing; whatever). I don't know how to do that on Windows, though.

A workaround may be to change the IP addresses the client connects to. Probably it's just a few systems which the clients connects to. It may be possible to configure different IP addresses for the same host name depending on where the query comes from. So you could create a host name samba.vpn.example.org which points to e.g. 192.168.1.15. If you have a local DNS server you can configure it so that it gives e.g. 192.168.2.15 for that host name. Your OpenVPN gateway can make DNAT from .1.15 to .2.15. That does not affect bandwidth. If the client is local it does not try to connect via OpenVPN because the target is in the LAN network, not in the OpenVPN network. So OpenVPN would still (try to) establish the connection if physically connected but the OpenVPN connection would not be used and thus waste minimal bandwidth only.

A third option: Throw away the Windows client, keep Linux running in a VM, and route the company addresses (or a client-side mapping) through the VM. In the VM everything necessary can easily be done. The bandwidth loss should be quite small (if using virtio NICs).

share|improve this answer

Setup the network or VPN server such that the client fails to connect if it is on the internal network (e.g. setup a firewall to block packets to the VPN server and port from the internal network).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.