Connections to other services/port of the same VPN server

Clodo

I have a Debian server with OpenVPN 2.1.3 x86_64 (routing configuration).
When a client (tested only with Windows 7) established the tunnel, if i monitor the network connections for example with "Comodo", i see connections from 10.*.*.* (vpn private subnet) to remote machines. All correct.

But... if the client need to connect to the same server of the connected VPN, for example to access to other services on other port, i see connections from 192.*.*.* .
I can replicate this by simply "ping" the same server.

This connections are not in the encrypted tunnel of the VPN? I can avoid that, and always use the tunnel also for other services of the itself VPN server?

I hope you understand me 😃

Thx!

Mimiko

If you access the OpenVPN server by it's public IP, then the client will not use the tunnel, because a rule to the public IP with mask 255.255.255.255 and GW to clients lan are added to client's routing table. To access the server thru the VPN use the VPN IP of the server, ie 10.x.x.1.

Clodo

Thanks. I know i can access to the server thru the VPN IP.

But it's a technical aspect difficult to explain to our users.

Our users expect/understand that all traffics are in the encrypted tunnel, but isn't really completely true.

I need to tell to our users, to not use our domain name (of the server) when connected to the VPN, or i need to create a specific domain name resolved inside the VPN.
And, if they have software configured with our domain/IP, they need to change every time, to switch between real IP (when not VPN connected) and VPN IP (when connected to the VPN) if they want always use the tunnel when connected.

I don't know how routing table works... that rule is mandatory? it's possible to restrict that rule only on the VPN port?

Clodo

For example, i'm thinking about all VPN services out there that offer VPN connections for privacy / file-sharing.
They said phrases like "encrypt your internet activity from prying eyes" and so on.
Many of this services allow port forwarding.

But think about this scenario:

An user connect throught this kind of VPN.
This user open a file-sharing software, for example a Torrent client.
Their "exit-ip" (the vpn-server-ip + port used) are insered in DHT tables, tracker, etc as a peer for torrents.

If another client connected throught the same VPN and the same server share the same torrent, the second Torrent client may discover the peer above, but because are the same server, tunnel are implicit not used.

Mimiko

Having OpenVPN client on the LAN as a gw for those computers and is installed on linux, you can use iptables to rewrite destination ip for the OpenVPN server from public IP to OpenVPN IP:

iptables -A FORWARD -i eth0{LAN} -d {OpenVPN server public IP} --gw {OpenVPN server tunnel IP}

Check the correct sintax, because am low on iptables,