bgullicksen
Hello All,
Our Infosec dept requires our OpenVPN configuration to use "Should all client Internet traffic be routed through the VPN? YES.
The problem is that we have a log of users that are connected to the VPN all of the time and this configuration prevents them from being able to access printers and systems on our local networks. We do our default inter-vlan routing via our firewall so traffic between subnets gets forced over the OpenVPN connection due to the above requirement.
Is there anyway, preferable using the Web GUI admin that the VPN can be configured to send all traffic through the VPN EXCEPT 172.22.0.0/16?
Thank you!
SomeGuy
See openvpn config option "redirect-gateway" and a setting for this "local" :
From the man page:
"local -- Add the local flag if both OpenVPN servers are directly connected via a common subnet, such as with wireless. The local flag will cause step 1 above to be omitted."
A purpose for this is if clients are on the subnet "172.22.0.0/16" when connecting to the and need to access devices on "172.22.0.0/16" then use of this "local" option under "redirect-gateway" should permit these client to bypass the vpn for connections to their local subnet.
Then then have this option in their openvpn client config for all devices on the subnet "172.22.0.0/16" , but NOT have that configuration option on devices that are not connecting from the "172.22.0.0/16" network.
If devices are to be split (mobile devices) between using "172.22.0.0/16" and not using "172.22.0.0/16" for connections to the VPN, then you will probably need two different configurations for clients, or some clever work inthe openvpn server to look at client source Ip and and then dynamically choose to push the redirect-gateway option with or without "local"
This is not the only solution, and includes several assumptions.
