1

I have a VPN account and use it for sensitive communication. However the VPN connection sometimes is dropped while my main connection to the internet is still alive.

The pages I visit through VPN are on HTTP (not secure) and have javascript code which pings the host every minute or so on a timer. So it happens sometimes that the VPN connection is dropped and yet js sends a request to the server (with the cookies).

How could I restrict connections so they only happen if the VPN is live?

Edit - Some required details were missing
OS: Windows XP SP2
Browser (mostly used): Google Chrome
Firewall: Windows default
Sites to filter: not all traffic but all in a list of sites like abc.com, xyz.com

1
  • What OS, software, and do you have a firewall at your network that can block outgoing packets? Do you want to block specific HTTP servers or all HTTP in general while the VPN is down?
    – DerfK
    Feb 8, 2011 at 19:20

5 Answers 5

2

You could setup a persistent static route to force traffic to go down the tunnel. If you add a route for just the IP(s) of the unsecured web server, other sites should function as normal.

route -p add U.U.U.U mask 255.255.255.255 A.A.A.A Metric 1

Where U.U.U.U is the IP address of the webserver and A.A.A.A is the IP address of the virtual network adaptor that the VPN connection creates on your computer.

Disclaimer: This should prevent connectivity to the site when the tunnel is down, but you should do some testing to verify that it works in your environment.

2
  • Thank you poke. Connection failing when there is no VPN is what I want to achieve, so it is the objective, not a side-effect. I have to ask for further help as I have no clue where I add this route; is it something I need to do in my firewall, or router, or ... where? ... and how? ;) Feb 9, 2011 at 20:12
  • @Majid: Run this command on the computer you are using.
    – poke
    Feb 10, 2011 at 1:04
1

You might configure your browser to use a HTTP proxy server that's only accessible via the VPN. If the VPN goes down the HTTP proxy becomes unavailable and the access attempts fail.

If you're concerned about requiring traffic only to some sites to traverse the VPN while allowing all other traffic to access the Internet directly you might run a local proxy server set to use a proxy server accessible via the VPN as an upstream peer only for those sites you're concerned about accessing via the VPN. For all other sites your local proxy server could directly access the Internet w/o the VPN.

As I state on all questions of this nature: Using a VPN only pushes the problem out one more "hop". If you're accessing a site via HTTP with sensitive credentials via VPN you're only encrypting the credentials "in flight" between your client computer and the VPN gateway. Once the traffic is decrypted at the VPN gateway the traffic becomes visible to snooping, spoofing, etc, all over again. It may be true that the easiest place to intercept your traffic is on a Wifi network between your client computer and the Internet, but that doesn't mean that there aren't other places in the network between your VPN gateway and the remote web server that aren't only marginally easier for attackers to use.

2
  • Thank you. I know a little about using PAC files and some Firefox add-ons that allow you to specify per-site proxies to be used. However, I hopped a method existed which did not require a proxy. Feb 8, 2011 at 19:42
  • And by the way, the single hop that the VPN is adding is enough protection from a nosy big brother ;) Feb 8, 2011 at 19:44
1

THIS WORKS, I TESTED IT. It will also affect EVERY connection and just destinations to one IP address

Change your default gateway on your PC to be the private IP address of the VPN server. Now you need to know the public IP address of the VPN server you connect to and modify your routing table. Hard to explain without an example so here it is.

Your local IP range is 192.168.1.x and your default gateway (router) is 192.168.1.254.

When you connect to the VPN server you connect on 203.0.113.10 (public IP). Once connected it assigns you an IP of 192.168.3.65 and changes your default gateway to the VPN servers private IP of 192.168.3.1 (this change means all internet traffic is now routed through the VPN server). This gives us the information needed to configure your PC now how you want to. Disconnect the VPN.

Now edit your TCP/IP settings and change the default gateway to 192.168.3.1 (so all internet traffic is routed through the VPN server). All internet traffic will now fail unless the VPN is up. Now open a command prompt and type the following:

route add 203.0.113.10 mask 255.255.255.255 192.168.1.254 metric 1 -p

This add a static route to your windows PC which will override the default gateway only when you try to connect to 203.0.113.10 (your VPN server). When it matches this entry it will go out your router (192.168.1.254) onto the internet normally. This one rule will allow the VPN to be established then all other traffic will go across the VPN.

Note: when setting the default gateway you will get a warning about it being on a different subnet, just accept it and contine.

I have never done this so i can't say it will definitly work but I know a lot about routing and from the "rules" of routing this should work for you. If it does please up vote this answer as it is actually quite difficult to work this out and I doubt you will find this solution anywhere else.

EDIT: I tested this when I got home and I was right, it can be done this way ;-)

1
  • Try not to add a live IP address in your posts unless you're volunteering to have your network tested by others.
    – Nixphoe
    Aug 9, 2011 at 15:02
0

Whether the page is on the local end or the remote end is immaterial, if the VPN connection is down then none of that traffic will exit your local network as there won't be a path (route) to the remote network.

4
  • I don't have a local network. It is a single desktop computer connecting to the Internet with a DSL router/modem. There are modems which could be set to handle VPN connection internally (end-point VPN support), however mine only supports VPN as a pass-through device, so the VPN connection is formed on the same machine that I'm using. Feb 9, 2011 at 20:16
  • Right, but my point is the same regardless of how the VPN connection is created. If the VPN connection doesn't exist then there's no pathway (route) to the remote network, unless I'm misunderstanding your question.
    – joeqwerty
    Feb 9, 2011 at 21:12
  • Maybe I'm not explaining it clearly. I have a DSL connection which connects me to my ISP. I also have a VPN connection which uses the DSL connection and creates a tunnel to the VPN server and from there to the destination host. So, when the VPN connection is active my request to abc.com (1) is encrypted (2) is sent to server.at.vpn.ip. (3) is decrypted and sent to abc.com. The response would take the same route from the opposite direction. But when VPN connection dies, I am still connected through my DSL and the request will be sent in plain text (with the cookies). Makes sense? Feb 9, 2011 at 22:51
  • So abc.com is available whether the VPN connection is connected or not and you'd like to not send the request when the VPN connection is not connected because it won't be encrypted in that case?
    – joeqwerty
    Feb 10, 2011 at 11:19
0

Why not get a certificate and install it on the web server so that you can support SSL encryption so you don't have to rely on the VPN being up?

1
  • 1
    I have no control over the services I connect to (e.g. Facebook), and actually the problem is two-folds, these services are also filtered by the government, so I cannot use them without a VPN. So when the VPN connection is dropped, the requests my browser sends do not get through to the destination, but end-up in the routers of the filtering org. Facebook per se is not an issue, but there are others which are. Feb 9, 2011 at 20:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .