Hello, I have a question around using the openVPN client that I can't seem to find a resolution to online. Hopefully someone can help..
Setup:
Single machine running Windows Server 2013 behind NAT router exposing remote desktop and web server externally.
What I want to achieve:
Machine connected to a vpn server to direct all traffic to vpn with the following exceptions; machine should still be acessible via remote desktop, and web server should still be accessible.
If the VPN fails/disconnects I want to kill certain services. On reconnection I want to bring them back up. I do not want to kill all network traffic while the VPN is down.
The problem:
- OpenVPN sometimes completes with "Initialization sequence completed with errors". When this happens traffic is not directed through the VPN at all. However the '--up' script is still run. To get this resolved it seems I need to disable/enable the tap driver and/or the lan connection itself.
I have switched to use ip-win32 netsh and haven't seen an issue yet, but the fact it doesn't fail and still runs the '--up' script bothers me.
- The '--up' script seems to be run before all the traffic is routed to the VPN (e.g. before 'Initialization Sequence Completed' shows in the logs), I have also tried using --up-delay, but it seems to be showing the same behaviour
- With thought to the above issues, my VPN provider also allows L2TP connections. I came across a script that uses rasdial to kill/start services when the connections is down/up. This is exactly what I want, however, when the machine is connected via Windows to the L2TP tunnel, it is no longer accessible via remote desktop or as a web server. I assume this is down to a different routing strategy? OpenVPN does not exhibit this behaviour and my remote desktop/webs erver are still accessible via the non-VPN IP (What I want), I don't fully understand why.
The solution?:
Assuming netsh proves stable, my only plan at the moment is to write a script to:
-check external IP via a 3rd party
-connect to openvpn
-wait for up script to complete
-wait a bit more ('Initialization Sequence Completed' seems to need to run)
-loop:
--check external IP again and compare to original
--if non-matching then start services
--if matching stop services
The question:
I feel like I've missed something obvious. This seems extremely complicated for what I feel seems like a typical use case. Have I missed something?
Is there a way to make the openvpn client fail on the '.. completed with errors', or is there a way to tell for sure that the connection has been successful without using a 3rd party to check the IP before and after?
Thanks for your help,
