Routing Internet Traffic thru remote gateway-Win7 64bit lost

winger

When traveling, I frequently log onto the internet at coffee shops, airports, hotel and such - all public, unsecured wifis. In order to keep my transmitted and received data secure, I use OpenVPN client on three Windows laptops to access my Netgear R7000 router at home that is running OpenVPN server and I route all internet traffic through the R7000 (the remote gateway). When logged on, I use services such as IPChicken or WhatIsMyIP to verify my connected IP address is that at at my home (issued by my home ISP Comcast).

For my two Windows 7 XP 32-bit machines, the OpenVPN clients are able to maintain for hours on end this 'secure' VPN connection which all internet traffic flows through the home gateway/IP address (again, I verify using IPChicken or WhatIsMyIP ). However, on my Win 7 64-bit machine, after a few minutes (could range anywhere from a couple of minutes to 10 minutes), the internet starts to route through the local IP address (as opposed to the one at my home), which I believe mean is no longer 'secure'.

Why could this be happening?

I am running OpenVPN client 2.3.3 I002 on all the machines. On the Win 7, I tried even upgrading to several versions including a couple 2.3.4 to the latest 2.3.5, but no improvement.

maikcat

can you check if the rip listener is enabled?

Michael.

winger

maikcat wrotecan you check if the rip listener is enabled?

Michael.

What is rip listener. Sorry, I am relatively new to this whole VPN thing.

maikcat

To turn on RIP Listener

    Open Programs and Features by clicking the Start button Picture of the Start button, clicking Control Panel, clicking Programs, and then clicking Programs and Features.

    In the left pane, click Turn Windows features on or off. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

    Select the RIP Listener check box, and then click OK.

if its on turn it OFF please.

Michael.

winger

maikcat wrote

To turn on RIP Listener

    Open Programs and Features by clicking the Start button Picture of the Start button, clicking Control Panel, clicking Programs, and then clicking Programs and Features.

    In the left pane, click Turn Windows features on or off. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

    Select the RIP Listener check box, and then click OK.

if its on turn it OFF please.

Michael.

Thanks Michael. It looks from the instructions this RIP Listener feature is on the OpenVPN server, which unfortunately is on the Netgear R7000 router. Although I have admin logon to the R7000, the OpenVPN server is something embedded in the R7000 OEM and I do not believe I can get into that part of the router.

Help me understand better what you are trying to accomplish by having me turn this feature off? For example, is there some incompatability with OpenVPN 64-bit clients running on Win 7 machines when the server has this RIP Listener turn on?

maikcat

if you connect from your win7 to the openvpn (which alters your gateway) and after some
time traffic ignores openvpn , it seems possible that win7 changes its routing table,

1)can you confirm by issuing netstat -nr when vpn is bypassed to check that default gateway is changed or not?

2)if it is indeed altered this may be done by:routing protocol (rip) or by network discovery service (upnp).

thats why i asked you to disable RIP if it enabled on your win openvpn client.

Michael.

winger

OK, I ran the "netstat -nr" on the Windows XP machine (the one which I believe has no issues) and I see a 'default gateway' which is the IP address of my Netgear R7000 router; however, on Windows 7, I cannot see the 'default gateway'.

On my Windows 7 machine, when I first connect and run "etstat -nr", I get the following:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\johnnywarren>netstat -nr
===========================================================================
Interface List
20...00 ff cb fc 19 f8 ......TAP-Windows Adapter V9 #2
18...00 26 37 bd 39 42 ......PdaNet Broadband Adapter
16...08 11 96 2a 91 69 ......Microsoft Virtual WiFi Miniport Adapter #2
15...08 11 96 2a 91 69 ......Microsoft Virtual WiFi Miniport Adapter
14...08 11 96 2a 91 68 ......Intel(R) Centrino(R) Advanced-N 6205
13...5c 26 0a 7d 84 07 ......Intel(R) 82579LM Gigabit Network Connection
12...d0 df 9a b1 2b 6e ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
21...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
41...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
17...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
42...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
43...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
44...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
45...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.13.1 192.168.13.103 30
50.185.39.129 255.255.255.255 172.20.216.1 172.20.216.134 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.20.216.0 255.255.248.0 On-link 172.20.216.134 276
172.20.216.134 255.255.255.255 On-link 172.20.216.134 276
172.20.223.255 255.255.255.255 On-link 172.20.216.134 276
192.168.13.0 255.255.255.0 On-link 192.168.13.103 286
192.168.13.103 255.255.255.255 On-link 192.168.13.103 286
192.168.13.255 255.255.255.255 On-link 192.168.13.103 286
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.13.103 286
224.0.0.0 240.0.0.0 On-link 172.20.216.134 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.13.103 286
255.255.255.255 255.255.255.255 On-link 172.20.216.134 276
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
17 58 ::/0 On-link
1 306 ::1/128 On-link
17 58 2001::/32 On-link
17 306 2001:0:9d38:6ab8:14ad:df5:cd46:d84c/128
On-link
20 286 fe80::/64 On-link
14 276 fe80::/64 On-link
17 306 fe80::/64 On-link
17 306 fe80::14ad:df5:cd46:d84c/128
On-link
14 276 fe80::81f6:a74d:111d:6475/128
On-link
20 286 fe80::89bb:f080:7f80:eae6/128
On-link
1 306 ff00::/8 On-link
17 306 ff00::/8 On-link
20 286 ff00::/8 On-link
14 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

After about 12 minutes, the IP address shown on IPChicken changes (from the one my home ISP issues to presumably issued to the hotel I am staying at), I then when I run "etstat -nr", I get the following:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\johnny>netstat -nr
===========================================================================
Interface List
20...00 ff cb fc 19 f8 ......TAP-Windows Adapter V9 #2
18...00 26 37 bd 39 42 ......PdaNet Broadband Adapter
16...08 11 96 2a 91 69 ......Microsoft Virtual WiFi Miniport Adapter #2
15...08 11 96 2a 91 69 ......Microsoft Virtual WiFi Miniport Adapter
14...08 11 96 2a 91 68 ......Intel(R) Centrino(R) Advanced-N 6205
13...5c 26 0a 7d 84 07 ......Intel(R) 82579LM Gigabit Network Connection
12...d0 df 9a b1 2b 6e ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
21...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
41...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
17...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
42...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
43...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
44...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
45...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.13.1 192.168.13.103 30
50.185.39.129 255.255.255.255 172.20.216.1 172.20.216.134 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.20.216.0 255.255.248.0 On-link 172.20.216.134 276
172.20.216.134 255.255.255.255 On-link 172.20.216.134 276
172.20.223.255 255.255.255.255 On-link 172.20.216.134 276
192.168.13.0 255.255.255.0 On-link 192.168.13.103 286
192.168.13.103 255.255.255.255 On-link 192.168.13.103 286
192.168.13.255 255.255.255.255 On-link 192.168.13.103 286
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.13.103 286
224.0.0.0 240.0.0.0 On-link 172.20.216.134 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.13.103 286
255.255.255.255 255.255.255.255 On-link 172.20.216.134 276
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
17 58 ::/0 On-link
1 306 ::1/128 On-link
17 58 2001::/32 On-link
17 306 2001:0:9d38:6ab8:14ad:df5:cd46:d84c/128
On-link
20 286 fe80::/64 On-link
14 276 fe80::/64 On-link
17 306 fe80::/64 On-link
17 306 fe80::14ad:df5:cd46:d84c/128
On-link
14 276 fe80::81f6:a74d:111d:6475/128
On-link
20 286 fe80::89bb:f080:7f80:eae6/128
On-link
1 306 ff00::/8 On-link
17 306 ff00::/8 On-link
20 286 ff00::/8 On-link
14 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

I do not see any difference.

For background info, here are what three IP addresses shown above represent:
192.168.13.1 = my R7000 router's IP address
192.168.13.103 = the IP address my R7000 router assigns to my machine once I logged onto my R7000 router remotely
50.185.39.129 = the IP address issued by our ISP at home

When OpenVPN first runs, IPChicken shows: 50.185.39.129
After 12 minutes, IPChicken shows: 66.251.117.187 (I do NOT see this IP address in either of the two "netstat -nr" results above).

Since the Windows 7 result of "netstat -nr" does not show 'default gateway' (as it did under Windows XP), I cannot verify that it changed or not.

I do not under stand the following point:

2)if it is indeed altered this may be done by:routing protocol (rip) or by network discovery service (upnp).

I also do not see where the RIP setting is set on the OpenVPN client I am running.

Another thing to point out. I see a few of the following errors on the OpenVPN log for the Windows 7 machine which I do NOT see on the Winddows XP machines and am unsure if this gives any clue as to what is occurring:

Mon Nov 24 22:52:39 2014 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #9166 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Mon Nov 24 22:52:39 2014 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #9167 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Mon Nov 24 22:55:14 2014 Extracted DHCP router address: 192.168.13.1
Mon Nov 24 22:57:15 2014 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #16291 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Mon Nov 24 22:57:15 2014 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #16292 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings ]

winger

maikcat wrote

To turn on RIP Listener

    Open Programs and Features by clicking the Start button Picture of the Start button, clicking Control Panel, clicking Programs, and then clicking Programs and Features.

    In the left pane, click Turn Windows features on or off. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

    Select the RIP Listener check box, and then click OK.

if its on turn it OFF please.

Michael.

Thanks for the instructions - I verified that the "RIP Listener" option is NOT checked.

maikcat

can you post the output of:

tracert 8.8.8.8

when ip chicken shows your wan ip?

Michael.

winger

From a coffee shop 45 miles from the hotel I am staying at, I ran a tracert 8.8.8.8 :

C:\Users\johnny>tracert 8.8.8.8

Tracing route to google-public-dns-a.google.com [8.8.8.8]
over a maximum of 30 hops:

1 1501 ms 1632 ms 842 ms 192.168.13.1
2 * 1405 ms 1351 ms 50.185.38.1
3 930 ms 952 ms 1179 ms te-0-7-0-15-sur04.pleasanton.ca.sfba.comcast.net
[68.85.190.245]
4 1237 ms 1142 ms 1554 ms te-1-9-0-3-ar01.oakland.ca.sfba.comcast.net [68.
87.226.34]
5 1594 ms 1598 ms 1380 ms te-0-1-0-12-ar01.sfsutro.ca.sfba.comcast.net [69
.139.198.26]
6 1331 ms 1189 ms 1359 ms he-1-5-0-0-cr01.sanjose.ca.ibone.comcast.net [68
.86.90.93]
7 307 ms 499 ms 359 ms be-23-pe02.529bryant.ca.ibone.comcast.net [68.86
.82.157]
8 437 ms 467 ms 516 ms 66-208-228-70.ubr01a.hurtl301.al.hfc.comcastbusi
ness.net [66.208.228.70]
9 618 ms 686 ms 1129 ms 72.14.232.136
10 798 ms 723 ms 754 ms 209.85.246.253
11 * 1390 ms * 216.239.49.198
12 * 600 ms 625 ms 216.239.50.191
13 1596 ms 1294 ms 930 ms 216.239.46.173
14 * * * Request timed out.
15 * 508 ms 675 ms google-public-dns-a.google.com [8.8.8.8]

Trace complete.

This routing looks good, going through my R7000's IP (192.168.13.1) then going through Northern California hops straight away (e.g. Pleasanton, SFsutro, San Jose, etc.)

Just two (2) things to note. At this location, the OpenVPN held my home ISP IP address for about 1/2 hr (a long time), then lost it, then regained it back automatically over a span of less than 1 minutes (I was actively monitoring IPChicken). Later lost and regain again.

I did a netstat -nr and I noticed a new IP on the second line of the IPv4 Route Table which I do not recognize (192.168.10.1) and was not at the hotel location (yesterday) - and am unsure if this is an issue or what this means:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.13.1 192.168.13.103 30
0.0.0.0 0.0.0.0 192.168.10.1 192.168.10.78 25
50.185.39.179 255.255.255.255 192.168.10.1 192.168.10.78 25

maikcat

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.13.1 192.168.13.103 30
0.0.0.0 0.0.0.0 192.168.10.1 192.168.10.78 25
50.185.39.179 255.255.255.255 192.168.10.1 192.168.10.78 25

this line alters your default gateway,probably your win7 "picked" it up from somewhere,
either network discovery or upnp...

Michael.

winger

maikcat wrote
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.13.1 192.168.13.103 30
0.0.0.0 0.0.0.0 192.168.10.1 192.168.10.78 25
50.185.39.179 255.255.255.255 192.168.10.1 192.168.10.78 25
this line alters your default gateway,probably your win7 "picked" it up from somewhere,
either network discovery or upnp...

Michael.

Thanks. Anyways, from the netstat and tracert's results (above),I also want to point out that when the VPN is 'broken' (from the IPChicken IP address changing):
1) when I do tracert, it shows hops LOCAL to where I am connected (e.g. hotel), which this week is Southern California (Los Angeles area) - this tells me my internet is likely no longer encrypted by the VPN connection to my home gateway (R7000)
2) I can still access files at home file server (ip 192.168.13.xxx) and remote desktop into my PC at home - so file transfers between my machine and data from home are still secure?

What do I do next to fix this issue where the VPN connection seems to lose the ability to direct internet traffic through my home gateway (R7000) ?

maikcat

since i am NOT a windows expert i cant tell you how to fix windows behavior and
prevent them from altering your routing table,maybe it has something to do with
windows network discovery capability,

2) I can still access files at home file server (ip 192.168.13.xxx) and remote desktop into my PC at home - so file transfers between my machine and data from home are still secure?

if you can still access your home network then yes traffic to it its via vpn, so yes you are secure,

also you can always setup a proxy server on openvpn server itself and use it via your brower 😉

Michael.

winger

2) I can still access files at home file server (ip 192.168.13.xxx) and remote desktop into my PC at home - so file transfers between my machine and data from home are still secure?

if you can still access your home network then yes traffic to it its via vpn, so yes you are secure,

So, are you saying accessing my home server's files is secure, but internet browsing is not, correct?

also you can always setup a proxy server on openvpn server itself and use it via your brower 😉

What exactly do you mean? As a reminder, my openvpn server is built into the Netgear R7000 router itself, and as such, I cannot do much with the server beyond what Netgear is built into it's user interface.

One additional note for my situation. I noticed when I am initiate an OpenVPN session using my mobile phone company's hotspot, my connection to the remote gateway (for internet traffic) is never lost, unlike what I experience at hotels, coffee shops, etc. Unsure if this behavior makes any difference.

maikcat

So, are you saying accessing my home server's files is secure, but internet browsing is not, correct?

if its not going through the vpn then yes

What exactly do you mean? As a reminder, my openvpn server is built into the Netgear R7000 router itself, and as such, I cannot do much with the server beyond what Netgear is built into it's user interface.

i am not familiar with the netgear router but if you f.e had a rasberry for vpn then you could easily
setup a squid proxy on it and use it. (rasbian is debian based)

One additional note for my situation. I noticed when I am initiate an OpenVPN session using my mobile phone company's hotspot, my connection to the remote gateway (for internet traffic) is never lost, unlike what I experience at hotels, coffee shops, etc. Unsure if this behavior makes any difference.

probably the network discovery service of windows "discover" your local LAN router and change
your routing table...

Michael.