I'm using redirect-gateway to redirect traffic down the vpn. This seems to work well on Macs and Linux, but on Windows, I'm seeing "leakage" where many connections do not get redirected into openvpn.
On Mac, I see the default gateway is replaced with a default gateway using openvpn. However, on Windows, I see something different. On Windows, the default gateway remains and 2 other routes are inserted:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.135 55
0.0.0.0 128.0.0.0 10.8.0.1 10.8.0.2 291
128.0.0.0 128.0.0.0 10.8.0.1 10.8.0.2 291
The idea here is that the second two routes with the 291 metric are more specific routes and should take precedence over the default route. They are more specific because of the /1 network mask.
This seems to work for new connections or programs that are not already running when Openvpn connects, however, if there are connections already, for example dropbox, any open web pages, OneNote, and dozens other that I see, they continue to use the default route thus avoiding the VPN. I know this for a fact because I have used tcpdump on the router.
I have also tried 'redirect-gateway def1' which makes no difference to this situation. Why are the routes different in Windows versus Mac/Linux? Why isn't the Windows version of Openvpn temporarily removing the default route as the documentation claims?
TinCanTech has responded to me in the past that a policy based firewall is the answer here and that this works only on linux. However, modern Windows versions have a firewall. Perhaps Openvpn on Windows should insert those rules on connect and remove them on disconnect.
Could someone please explain to me what's going on in Windows with respect to routing and connections not using the routing table? Is Windows networking really so vastly different than Unix/Linux/Mac with respect to routing? Do processes on Windows cache their own copies of the routing table or do their own routing looking directly at interfaces or something really odd like that? I am really surprised at what I'm seeing on Windows.
The way redirect-gateway is acting on Windows, it gives a false sense of security! This is a serious security issue!
