Hi. Due to converting to pfSense, I recently started using openvpn as a vpn server. But, during tests I learnt that OpenVPN is subject to WebRTC leaks on Windows. So, I have been trying to find a fix for it but unfortunately I couldn't find one. I tried [b]redirect-gateway def1[/b] but that didn't help either. So, I figured out one way to overcome this. 10.8.4.1 being my vpn server's ip, when I ran the command below on a client machine my real ip no more showed in webrtc leak test pages such as: [url]https://diafygi.github.io/webrtc-ips/[/url] [code]route change 0.0.0.0 mask 0.0.0.0 10.8.4.1 metric 2[/code] Right now, temporarily I am using this code in XXX_up.bat file along with other routes to exclude 192.168.0.0 subnet from using openvpn. I tried somehow integrating this code to the server and/or client ovpn file but unfortunately to my dismay I couldn't do so. The only way is using the XXX_up.bat file on the client side and using the code there but that's not preferable to me either as it's only for OpenVPN Gui. What I need is either to push this "route change" command from the server side or either use it in the client ovpn file. OR if there's a better way to fix it, to learn it. I'ld appreciate any input.

If you're still pursuing this, I would try to use option [b]route-up[/b] in the client ovpn file to change the route. Look at the [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAU]Environment Variables[/url] section of the man page. Example: [code]route-up route change 0.0.0.0 mask 0.0.0.0 $route_vpn_gateway metric 2[/code] (I'm not sure which variable is best to use - have a play)

Redirecting the client gateway is of [b]no consequence[/b] .. even if the server side of the VPN NATs your connections.

Fix for WebRTC Leak?

nomadic

Hi.

Due to converting to pfSense, I recently started using openvpn as a vpn server.
But, during tests I learnt that OpenVPN is subject to WebRTC leaks on Windows. So, I have been trying to find a fix for it but unfortunately I couldn't find one.

I tried redirect-gateway def1 but that didn't help either.

So, I figured out one way to overcome this.

10.8.4.1 being my vpn server's ip, when I ran the command below on a client machine my real ip no more showed in webrtc leak test pages such as: https://diafygi.github.io/webrtc-ips/

route change 0.0.0.0 mask 0.0.0.0 10.8.4.1 metric 2

Right now, temporarily I am using this code in XXX_up.bat file along with other routes to exclude 192.168.0.0 subnet from using openvpn.

I tried somehow integrating this code to the server and/or client ovpn file but unfortunately to my dismay I couldn't do so.
The only way is using the XXX_up.bat file on the client side and using the code there but that's not preferable to me either as it's only for OpenVPN Gui.

What I need is either to push this "route change" command from the server side or either use it in the client ovpn file.

OR

if there's a better way to fix it, to learn it.

I'ld appreciate any input.

Traffic

WebRTC Leak is a function of your browser.

OpenVPN does not function at the application layer so cannot help you.

Try this:
https://www.privateinternetaccess.com/forum/discussion/8204/how-to-stop-webrtc-local-ip-address-leaks-on-google-chrome-and-mozilla-firefox-while-using-private-i

nomadic

Doesn't help the case.
I need if OpenVPN can somehow push a route change.

True, OpenVPN doesn't work at application level. Neither does the other VPN's though. But only OpenVPN causes this. So, there's that...

ste123

If you're still pursuing this, I would try to use option route-up in the client ovpn file to change the route.

Look at the Environment Variables section of the man page.

Example:

route-up route change 0.0.0.0 mask 0.0.0.0 $route_vpn_gateway metric 2

(I'm not sure which variable is best to use - have a play)

Traffic

Redirecting the client gateway is of no consequence .. even if the server side of the VPN NATs your connections.

masrac

All of these VPN's have known about the WebRTC hack but never bothered to tell you about it. They all owe everyone back their money and a lot more than that and someone should start a class action suit against them.