Routing Issues - Multiple OpenVPN Connections

yankee77

I have a windows 7 machine that is running two instances of OpenVPN, one as a client and one as a server. When this windows 7 machine connects as a client its default gateway is changed to route all traffic out the vpn. This is desired from my end. However, when connecting to this windows machine from my clients, the tls negotiation fails because the packets that should be returned to the connecting client are being routed out of the vpn. I could easily solve this problem by adding a static route to the windows routing table for the client's address; however, the client is dynamically assigned an ip address and it is impossible to know what it will be ahead of time. If the server were a linux machine instead of windows, I am aware that policy-based routing would be a possibility, however that is not an option for me as I do not own any linux machines and am a newbie to the networking world and do not have any knowledge of linux. I wondered if there were some way for a script to grab whatever the client's ip address was as it initiated the tls negotiation and added that route to the windows routing table via a tls-verify script?

***Basically I'm looking for a way for openvpn to automatically add whatever incoming address is trying to make the tls negotiation to the windows routing table.***

Or are there any programs for windows that make policy-based routing possible? If none of these are possible, I would welcome any other solutions or workarounds. Thank you!

yankee77

I've done some more digging in the manual page and I found the "remote_host" feature; however, this is undefined in server mode, which is what I'm looking to use it for. I found an old post where this is addressed (https://openvpn.net/archive/openvpn-users/2005-08/msg00385.html). From what I can gather, I think what I'm trying to do is extract the ip address from a connecting client using the "untrusted_ip" environmental variable and then use the "tls-verify" script to add that address to the windows 7 server's routing table. Is this doable? If so, I would appreciate any help with how to do this (scripting, etc.) as I'm new to this stuff. Thanks!

yankee77

OK - so I fixed the timing of the tls-verify script issue by switching to tcp. For some reason, it fails on the udp protocol. I was able to get a test route added to the routing table and then taken down via batch scripts set at "tls-verify" and then "down", respectively. However, it was just a test route, as the real route I would need to add is a dynamic ip address that I would not know in advance.

***So basically, the last thing I would need help with on this would be how to get the "untrusted_ip" environmental variable into my batch script.***

If anyone has any help they can offer me on how to do this, it would be much appreciated. Thanks!