andrus Bridged connection is used to encrypt internet traffic between home wifi 192.168.4.1/24 notebook and work network 192.168.91.1/24 both running Windows Vista. If openvpn client is started, all is ok. "route print" returns: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.91.1 192.168.91.123 30 After some time a line after that automaticaaly appears: 0.0.0.0 0.0.0.0 192.168.4.1 192.168.4.241 25 and internet traffic is sent unencrypted over 192.168.4.1 If second route is manually deleted using route delete 0.0.0.0 192.168.4.1 uncrypted connection is restored. After some time this line appears again and connection is not encrypted again. How to force internet access to be encrypted always ? Andrus. client config: client dev tap remote mysite.com persist-key persist-tun mute-replay-warnings ca ca.crt cert andrus-notebook.crt key andrus-notebook.key mute 20 server config: dev tap dev-node tap-bridge ca ca.crt cert server.crt key server.key dh dh1024.pem server-bridge 192.168.91.1 255.255.255.0 192.168.91.123 192.168.91.254 push "redirect-gateway" push dhcp-option DNS 1.2.3.4 keepalive 10 120 persist-key persist-tun mute 20
janjust check the DHCP lease time of the wireless adapter - perhaps it is renewing too rapidly. Try adding route-metric 10 to the config file to give the VPN route a higher metric then the Wifi route.
andrus I added route-metric 10 to both server and kiend config files, re-started openvpn service in server and re-connected client. Metric is still 30 route-metric sets default value for route command. I do'nt have any route commands in config so it does not take any effect. How to set metric ? Andrus.
andrus I also tried to set static ip addres 192.168.91.121, default gateway 192.168.91.1 in client but in this case openvpn connection is not created, log reports netsh error.
janjust The 'route-metric' should be added only on the client side. You can also increase the metric of the wifi adapter in it's network control panel page. Another thing to try is to use push "redirect-gateway def1" (i.e. add "def1")
andrus Thank you. Now animation icon in right corner is incorrect: 1. there is no earth icon 2. network control center shows that internet connection is used through unencrypted adapter. How to fix ?
andrus If def1 hack is used and vpn does not work for same reason, all traffic is silently routed through unencrypted channel. This is big security hole. How to fix it ? Andrus. rout print if def1 is used looks like: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.4.1 192.168.4.241 25 0.0.0.0 128.0.0.0 192.168.91.1 192.168.91.123 30 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 128.0.0.0 128.0.0.0 192.168.91.1 192.168.91.123 30 192.168.4.0 255.255.255.0 On-link 192.168.4.241 281 192.168.4.241 255.255.255.255 On-link 192.168.4.241 281 192.168.4.255 255.255.255.255 On-link 192.168.4.241 281 192.168.91.0 255.255.255.0 On-link 192.168.91.123 286 ....
