OpenVPN blocking all traffic unless Norton VPN enabled

jaypdx

I have OpenVPN installed on my Win10 laptop and have been using it to get to my home network through my Asus router (which is the OpenVPN server). This has been working fine until recently. Now I can still initiate the connection to my home router (it appears to connect successfully), but once connected I can't access anything on my home net nor on the internet.

If enable Norton VPN (provided with Norton 360) and then connect my OpenVPN everything works just fine - I can then access both my home network and the internet. Somehow all network traffic is being blocked if I connect my OpenVPN connection by itself, but not if I connect it while the Norton VPN is active. Is the OpenVPN connection going through the Norton VPN? Or is it just working for some reason when the Norton VPN is connected?

I recently upgraded my Asus router to the latest version of firmware. Maybe this broke something, but why does it work if I connect through the Norton VPN?

I double-checked my local OpenVPN config against the files exported from my router and they are identical.

I tried upgrading to the latest OpenVPN and that didn't help.

I've tried disabling Norton's firewall and that didn't help.

openvpn.exe is set to 'allow' in Norton's Firewall config.

If I enable my OpenVPN first, I can't enable Norton's VPN. But if I enable the Norton VPN first then I can connect my OpenVPN and everything works as expected.

Here's my client ovpn file (this is just downloaded from my Asus router):

remote xxxx.asuscomm.com 3137
float
nobind
proto udp
dev tap

sndbuf 0
rcvbuf 0
keepalive 10 30
comp-lzo adaptive
auth-user-pass
client
auth SHA1
cipher AES-256-CBC
remote-cert-tls server
...followed by the certs and keys...

Here's my openvpn log file... it looks the same whether the Norton VPN is connected or not:
------------------------------------------------------------
2021-10-29 23:32:05 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021-10-29 23:32:05 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2021-10-29 23:32:05 OpenVPN 2.5.4 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 20 2021
2021-10-29 23:32:05 Windows version 10.0 (Windows 10 or greater) 64bit
2021-10-29 23:32:05 library versions: OpenSSL 1.1.1l 24 Aug 2021, LZO 2.10
2021-10-29 23:32:07 TCP/UDP: Preserving recently used remote address: [AF_INET]11.11.11.11:3137
2021-10-29 23:32:07 UDP link local: (not bound)
2021-10-29 23:32:07 UDP link remote: [AF_INET]11.11.11.11:3137
2021-10-29 23:32:07 [RT-AX58U] Peer Connection Initiated with [AF_INET]11.11.11.11:3137
2021-10-29 23:32:09 open_tun
2021-10-29 23:32:09 tap-windows6 device [OpenVPN TAP-Windows6] opened
2021-10-29 23:32:09 Successful ARP Flush on interface [22] {xxxxxxxxxxxxxxxxxxxxxxx}
2021-10-29 23:32:14 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-10-29 23:32:14 Initialization Sequence Completed
------------------------------------------------------------

I don't know how to troubleshoot this.... any ideas?

jaypdx

I tried completely uninstalling Norton and my OpenVPN is still not working. I'm starting to suspect something with the router firmware I recently upgraded (an Asus RT-AX58U, now at 3.0.0.4.386.45898). I'll try downgrading and see if the problem goes away.

never-stop-learning

You can try the below options, but before you try make sure that your VPN Server is reachable outside using the port you’ve used.

Option 1) use TCP for your ovpn profile of client, change: proto UDP to proto TCP

Option 2) uninstall completely your Norton AV, reboot after you’ve uninstalled then once it’s boot up, turn off your Windows Firewall

Option 3) try to connect the vpn client from any other device, like mobile

jaypdx

Thanks for the ideas.

I tried changing to TCP and it won't connect at all... maybe some server-side config setting is not allowing that.

I'm going to try with another client later on.

It actually looks like the OpenVPN connection is not completely shutting down my connection... with it connected I still get a few packets through (like maybe one in every 20 pings goes through with a really long round trip).

Below I'm pasting my routing table with and without OpenVPN connected. The remote server (my home LAN) is the 192.168.1.x network - the network I'm on right now is 192.168.2.x. Should the remote network have a lower metric than my local network? There aren't many options on the Asus OpenVPN Server config page, but I definitely told it NOT to route internet traffic through the VPN.

OPENVPN NOT CONNECTED:
IPv4 Route Table

===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1     192.168.2.16     35
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.2.0    255.255.255.0         On-link      192.168.2.16    291
     192.168.2.16  255.255.255.255         On-link      192.168.2.16    291
    192.168.2.255  255.255.255.255         On-link      192.168.2.16    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.2.16    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.2.16    291
===========================================================================

OPENVPN CONNECTED:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1     192.168.2.16     35
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.74     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.1.0    255.255.255.0         On-link      192.168.1.74    281
     192.168.1.74  255.255.255.255         On-link      192.168.1.74    281
    192.168.1.255  255.255.255.255         On-link      192.168.1.74    281
      192.168.2.0    255.255.255.0         On-link      192.168.2.16    291
     192.168.2.16  255.255.255.255         On-link      192.168.2.16    291
    192.168.2.255  255.255.255.255         On-link      192.168.2.16    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link      192.168.1.74    281
        224.0.0.0        240.0.0.0         On-link      192.168.2.16    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link      192.168.1.74    281
  255.255.255.255  255.255.255.255         On-link      192.168.2.16    291
===========================================================================

jaypdx

I think I figured it out. It looks like the Asus router OpenVPN server is always having traffic routed through it, regardless of how I set the "Client will use VPN to access" option - in both cases the remote gateway is getting a lower metric than my local one.

If I manually force the remote gateway to be a higher metric everything works as normal:

C:\WINDOWS\system32>route change 0.0.0.0 mask 0.0.0.0 192.168.1.1 metric 45 if 21
OK!

It didn't actually set for the remote gateway to 45 - it set it to 70, but whatever - it's still higher than my local gateway.

Maybe this is a bug in the latest Asus firmware. I'm thinking it's working when I have Norton's VPN enabled because that is forcing all internet traffic through the Norton VPN and only the stuff to my home LAN is going through my OpenVPN. The routing table becomes a lot more complicated when I enable both the Norton VPN and my OpenVPN and I'm not an expert parsing that.

Is there a way to set the metric of the remote gateway in my .ovpn config file? I've tried 'route-nopull' and 'route-metric 55' and it still adds the remote gateway with a lower metric than my local gateway.