Client is sharing the tunnel to it's subnet, how to disable?

eV1Te

Hi I am a new member here, but long time user of OpenVPN 🙂

When a Client connects to the VPN Server, all other computers on the Clients LAN sees all the computers on the Server side LAN. Is this a feature that can easily be disabled from the clients side?

When I connect with my laptop from a public hotspot to the VPN site I do not want others on the same public hotspot to get access to the server side LAN, this is a huge security problem for me that I just recently discovered and is enabled by default! :o

Server config:

mode server
daemon
proto udp 
port 1194
dev tap0
keepalive 10 60
server-bridge 192.168.100.1 255.255.255.0 192.168.100.240 192.168.100.249
client-to-client
management localhost 5001
status-version 2
status openvpn-status.log
verb 1
remote-cert-tls client
mute 20
keysize XX
tls-server
tls-cipher XXXX 
tls-auth ta.key 0
auth XXX
comp-lzo
ca ca.crt
dh dh.pem
cert cert.pem
key key.pem
persist-key
persist-tun
client-config-dir /tmp/openvpn/ccd

push "route-gateway 192.168.100.1"
push "dhcp-option DNS 192.168.100.1"

Client config:

client
dev tap
remote xxx.xxx
port xxx
proto udp
remote-cert-tls server
script-security 3 system
resolv-retry infinite
keepalive 5 20 
nobind
persist-key
persist-tun
ca ca.crt
cert xxx.crt
key xxx.key       
tls-auth ta.key 1
comp-lzo
keysize XX
tls-client
auth XXX

janjust

this is a OS/routing config issue on your client - with your (bridged) setup other machines on the client-side LAN should not see those resources.

But you'd most likely not be having this issue in a non-bridged setup.

eV1Te

The client in this case is a standard Windows 8 machine, and unfortunately I need bridged mode for some applications.

I will try some things to figure it out, but if anyone has an idea how to fix this without to much client side interaction (most clients does not know how to change routing tables, but if it is in the config file then its fine)

Just a clarification of the situation

192.168.100.1 Server/VPN side LAN (Computer 1)
192.168.100.10 Random computer on same LAN as VPN server (Computer 2)
130.2XX.XX.XX Client nr 1 (Computer 3)
192.168.1.28 Client nr 2(Computer 4)
192.168.1.20 Random computer that happens to be on same LAN as Client nr 2 (Computer 5)

Computer 5 can see all the other computers and clients (1,2,3,4).

Route table on the Client nr 2 (Computer 4):

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.28     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link      192.168.1.28    281
     192.168.1.28  255.255.255.255         On-link      192.168.1.28    281
    192.168.1.255  255.255.255.255         On-link      192.168.1.28    281
    192.168.100.0    255.255.255.0         On-link   192.168.100.240    286
  192.168.100.240  255.255.255.255         On-link   192.168.100.240    286
  192.168.100.255  255.255.255.255         On-link   192.168.100.240    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link   192.168.100.240    286
        224.0.0.0        240.0.0.0         On-link      192.168.1.28    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link   192.168.100.240    286
  255.255.255.255  255.255.255.255         On-link      192.168.1.28    281

janjust

what does 'ipconfig /all' show on the win8 pc? which services are bound to the tap-win32 adapter on the win8 box? if a Win8 PC decides to route/forward all traffic then there's very little that openvpn can do about it...
or is 'Internet Connection Sharing' running on this win8 pc?