Always connect except on "home" network
-
- OpenVpn Newbie
- Posts: 7
- Joined: Thu Aug 29, 2019 1:55 am
Always connect except on "home" network
brianjmurrell posted this message in the Openvpn Connect (android) forum. I am also interested in exactly the same solution...how can I pause openvpn connect when the WiFi is connected to the "home" network(s)? The 1.1.1.1 app which is a "VPN" for DNS only does this exactly...it allows specific SSIDs to be entered and if connected to those SSIDs then the VPN connection is paused. When moving to cellular or other WiFi SSIDs then the VPN resumes. Seems this would be a very valuable addition to OpenVPN Connect for iOS.
Here is the post from the android forum: <<How can I make OpenVPN automatically connect when I am on any network (mobile or WiFi) that is not the network that the OpenVPN server is gatewaying to (i.e. the network that is "behind" the OpenVPN gateway)?
So to be clear, I want to automatically always connect to my OpenVPN server except when I am on the network that is behind the OpenVPN server since that doesn't work and seems pointless anyway. I trust my local network.>>
Any solutions or workarounds would be great.
Here is the post from the android forum: <<How can I make OpenVPN automatically connect when I am on any network (mobile or WiFi) that is not the network that the OpenVPN server is gatewaying to (i.e. the network that is "behind" the OpenVPN gateway)?
So to be clear, I want to automatically always connect to my OpenVPN server except when I am on the network that is behind the OpenVPN server since that doesn't work and seems pointless anyway. I trust my local network.>>
Any solutions or workarounds would be great.
-
- OpenVPN Protagonist
- Posts: 11137
- Joined: Fri Jun 03, 2016 1:17 pm
Re: Always connect except on "home" network
You can either, try to convince the developer of the software you are using that this is a good idea to implement in their software or you can invest in better network equipment and configure your network to do what you want.
-
- OpenVpn Newbie
- Posts: 7
- Joined: Thu Aug 29, 2019 1:55 am
Re: Always connect except on "home" network
The router software on the "home" internal network is Pfsense and sure, I can configure a hairpin but that is just absurd...no need for a VPN when you are already on the network the VPN connects to. It is OpenVPN Connect that needs to implement the change to disable the VPN when it senses a WiFi connection to the "home" internal network. Only seems logical...
-
- OpenVPN Protagonist
- Posts: 11137
- Joined: Fri Jun 03, 2016 1:17 pm
-
- OpenVPN User
- Posts: 30
- Joined: Thu Nov 24, 2011 11:17 pm
- Location: Netherlands
Re: Always connect except on "home" network
Kicking this topic.
@TinCanTech
What do you mean with your reply? Are you suggesting to deliberately *not* use a hairpin so that OpenVPN will fail to connect when being home? That would be a solution I guess, but not something that should work for the external IP always. Better would be to filter out only the VPN connection attempt, maybe by port. Hope this is possible on OpenWRT (iptables).
@TinCanTech
What do you mean with your reply? Are you suggesting to deliberately *not* use a hairpin so that OpenVPN will fail to connect when being home? That would be a solution I guess, but not something that should work for the external IP always. Better would be to filter out only the VPN connection attempt, maybe by port. Hope this is possible on OpenWRT (iptables).
-
- OpenVPN Protagonist
- Posts: 11137
- Joined: Fri Jun 03, 2016 1:17 pm
Re: Always connect except on "home" network
You answered your own question ..
-
- OpenVpn Newbie
- Posts: 7
- Joined: Thu Aug 29, 2019 1:55 am
Re: Always connect except on "home" network
The way Cloudflare does this on their 1.1.1.1 client app is the correct solution. If the 1.1.1.1 app sees connection on a specific SSID/WiFi network (they call this a trusted connection) then 1.1.1.1 client disables itself so the connection doesn't happen. They allow multiple SSIDs to be entered. When internet connection is via a different SSID/WiFi that is not identified as a trusted WiFi connection or a cellular connection then the 1.1.1.1 client establishes a connection.
I can make a clumsy solution on the server side but it shouldn't be necessary. OpenVPN connect should implement this feature in a future release. It would simplify my network connections and I'm sure others as well. Simple is better and more reliable.
I can make a clumsy solution on the server side but it shouldn't be necessary. OpenVPN connect should implement this feature in a future release. It would simplify my network connections and I'm sure others as well. Simple is better and more reliable.
-
- OpenVPN User
- Posts: 30
- Joined: Thu Nov 24, 2011 11:17 pm
- Location: Netherlands
Re: Always connect except on "home" network
I just made an OpenWRT firewall (iptables) rule to reject traffic on the OpenVPN port received from within the LAN towards the OpenVPN server LAN ip address. This last part sounds a bit weird, but specifying the external IP as destination did not result in a reject/block. I think the firewall rule is applied after OpenWRT translated the external IP to the internal IP.
-
- OpenVpn Newbie
- Posts: 7
- Joined: Thu Aug 29, 2019 1:55 am
Re: Always connect except on "home" network
This isn't the issue I'm referring to. When using OpenVPN Connect on iOS I use the Seamless Tunnel setting to block internet while the VPN is reconnecting...this is just more secure. However, when inside the LAN, the external IP address is not reachable so OpenVPN Connect fails and prevents the mobile device from having any internet connectivity. I can't do anything on the router to fix this as the problem is on the mobile device. The best solution is to have OpenVPN Connect recognize that the connected WiFi is a secure/identified SSID and then disconnect the VPN. Cloudflare does this on their 1.1.1.1 app. Even if I turn off Seamless Tunnel, then after 30 seconds (default) the connection attempt to OpenVPN fails and will timeout. I will have internet connectivity but OpenVPN Connect will not automatically reconnect when leaving the trusted Wifi SSID. Again, Cloudflare's 1.1.1.1 app shows this is possible and would be a terrific addition to OpenVPN Connect
-
- OpenVpn Newbie
- Posts: 1
- Joined: Sun Jan 19, 2020 4:21 pm
Re: Always connect except on "home" network
I’m also looking for this feature. Most other VPN apps do this now.
-
- OpenVpn Newbie
- Posts: 1
- Joined: Fri Feb 07, 2020 6:03 am
Re: Always connect except on "home" network
This is a must in my humble opinion.
Recently I did set up an OpenVPN server at home (PiVPN), which was very easy and performs flawlessly. The Pi uses another Pi with the Pi-Hole software for DNS resolving (it can be set up on one Pi though, there is a guide on the Pi-Hole website). With this setup I can enjoy a secure connection from my iPhone to my home, and blocking ads/trackers as a bonus which is great.
I expected the OpenVPN iOS app to behave just like is stated in this topic, but as you know, one has to manually disable WiFi when leaving home so the iPhone connects via cellular and then in the OpenVPN app toggle the switch to connect to the OpenVPN server. This is quite a hassle and prone to be forgotten when in a bit of a hurry. Also when there is a WiFi hotspot I'd like to use, it requires me to enable WiFi again
Long story short, would the dev's implement this feature in the iOS app, will make it an allround set-and-forget solution for the roadwarrior, which right now it is not.
Recently I did set up an OpenVPN server at home (PiVPN), which was very easy and performs flawlessly. The Pi uses another Pi with the Pi-Hole software for DNS resolving (it can be set up on one Pi though, there is a guide on the Pi-Hole website). With this setup I can enjoy a secure connection from my iPhone to my home, and blocking ads/trackers as a bonus which is great.
I expected the OpenVPN iOS app to behave just like is stated in this topic, but as you know, one has to manually disable WiFi when leaving home so the iPhone connects via cellular and then in the OpenVPN app toggle the switch to connect to the OpenVPN server. This is quite a hassle and prone to be forgotten when in a bit of a hurry. Also when there is a WiFi hotspot I'd like to use, it requires me to enable WiFi again
Long story short, would the dev's implement this feature in the iOS app, will make it an allround set-and-forget solution for the roadwarrior, which right now it is not.
-
- OpenVpn Newbie
- Posts: 2
- Joined: Wed Oct 13, 2021 1:48 pm
Re: Always connect except on "home" network
wow what a douchebag comment - not evenly remotely helpful. Some of us have lives and don’t spend countless hours down in our “homelab”. Get some sun bro
P.S. your response so irritated me I felt compelled to sign up just to respond. Congrats you’re my first post !
P.S. your response so irritated me I felt compelled to sign up just to respond. Congrats you’re my first post !
TinCanTech wrote: ↑Thu Aug 29, 2019 9:49 pmYou can either, try to convince the developer of the software you are using that this is a good idea to implement in their software or you can invest in better network equipment and configure your network to do what you want.
- openvpn_inc
- OpenVPN Inc.
- Posts: 1333
- Joined: Tue Feb 16, 2021 10:41 am
Re: Always connect except on "home" network
Hello,
This feature is on our roadmap - the ability to specify 'safe' networks where the VPN isn't needed.
However I am sorry to say I cannot give any information on when it will be implemented exactly. For now the only solution is as mentioned in this thread to block the traffic if you don't want it to be established in a particular network. Or just turn it off yourself.
Kind regards,
Johan
This feature is on our roadmap - the ability to specify 'safe' networks where the VPN isn't needed.
However I am sorry to say I cannot give any information on when it will be implemented exactly. For now the only solution is as mentioned in this thread to block the traffic if you don't want it to be established in a particular network. Or just turn it off yourself.
Kind regards,
Johan
![Image](/download/file.php?avatar=g17_1613474857.png)
Answers provided by OpenVPN Inc. staff members here are provided on a voluntary best-effort basis, and no rights can be claimed on the basis of answers posted in this public forum. If you wish to get official support from OpenVPN Inc. please use the official support ticket system: https://openvpn.net/support
-
- OpenVpn Newbie
- Posts: 2
- Joined: Wed Oct 13, 2021 1:48 pm
Re: Always connect except on "home" network
How long has this been on the roadmap?
openvpn_inc wrote: ↑Fri Oct 15, 2021 6:07 amHello,
This feature is on our roadmap - the ability to specify 'safe' networks where the VPN isn't needed.
However I am sorry to say I cannot give any information on when it will be implemented exactly. For now the only solution is as mentioned in this thread to block the traffic if you don't want it to be established in a particular network. Or just turn it off yourself.
Kind regards,
Johan
-
- OpenVpn Newbie
- Posts: 1
- Joined: Wed Dec 01, 2021 10:54 am
Re: Always connect except on "home" network
Or use the Passepartout app on iOS and it'll do all that for you already.
I switched about 6 months ago and never looked back.
Works great with PiVPN server.
I wished they also had a Windows Client.
Now I have to wait until the OpenVPN GUI client supports this.
I switched about 6 months ago and never looked back.
Works great with PiVPN server.
I wished they also had a Windows Client.
Now I have to wait until the OpenVPN GUI client supports this.
-
- OpenVpn Newbie
- Posts: 14
- Joined: Thu May 23, 2013 2:15 am
Re: Always connect except on "home" network
Is this feature available yet on the Android Open Connect app? If not, does the beta version have this yet?
-
- OpenVpn Newbie
- Posts: 1
- Joined: Thu Apr 28, 2022 7:13 pm
Re: Always connect except on "home" network
I think this feature would also help my issue (as well as many other people). However, a slightly different feature may be needed.openvpn_inc wrote: ↑Fri Oct 15, 2021 6:07 amHello,
This feature is on our roadmap - the ability to specify 'safe' networks where the VPN isn't needed.
However I am sorry to say I cannot give any information on when it will be implemented exactly. For now the only solution is as mentioned in this thread to block the traffic if you don't want it to be established in a particular network. Or just turn it off yourself.
Kind regards,
Johan
Android Auto Wireless is becoming fairly common. However, it does not work when OpenVPN is connected since the phone uses both the WiFi connection (Ptp to AA) and the mobile network for data. As a result I need OpenVPN turned off every time I drive, which results in me simply not using OpenVPN as I never remember to turn it back on. The ideal solution though would be to be able to select if I want OpenVPN to apply only to mobile networks, only to wifi, both, or none. By doing this I could have it set to only apply to mobile networks, as the only WiFi I almost ever connect to are home (where the VPN takes me to) or my car (where VPN breaks android auto). If I connect to a foreign WiFi, I am ok with manually enabling OpenVPN in the app for Wifi at that time.
This seems like an easy feature to add, as you just need a switch on the screen that adjusts the applicable networks for the routing.
Please expedite this request (or an alternate way to address the issue) as every user of android auto would appreciate this!
-
- OpenVpn Newbie
- Posts: 1
- Joined: Tue Oct 10, 2023 4:18 pm
Re: Always connect except on "home" network
SDeath wrote: ↑Wed Dec 01, 2021 10:56 amOr use the Passepartout app on iOS and it'll do all that for you already.
I switched about 6 months ago and never looked back.
Works great with PiVPN server.
I wished they also had a Windows Client.
Now I have to wait until the OpenVPN GUI client supports this.
Passepartout app on iOS solved this issue for me, easily import configs from .ovpn files. Enables "Connect on Demand" capabilities in the native VPN control which forces it on always unless you turn it off explicitly. It also has a "Trusted Network" section where you can trust a WiFi SSID and even optionally cellular carriers where it will auto disable VPN. OpenVPN Connect devs I highly recommend taking a look at this app has some really nice features for OpenVPN profiles.
-
- OpenVpn Newbie
- Posts: 1
- Joined: Fri Dec 29, 2023 2:49 am
Re: Always connect except on "home" network
I found a workaround that works for me by doing the following (assumes you have Pi-hole installed)
1) created a FQDN with a service like DuckDNS.org (ie. example.duckdns.org)
2) used that FQDN in my OpenVPN configuration
3) set OpenVPN to continuously connect
4) setup Pi-Hole with a local DNS entry for the FQDN (example.duckdns.org) pointing to IP 0.0.0.0
This way when I'm connected to wifi and Pi-Hole is acting as my DNS resolver, OpenVPN is redirected to 0.0.0.0 and does not connect. As soon as I leave my home WIFI OpenVPN is able to connect.
1) created a FQDN with a service like DuckDNS.org (ie. example.duckdns.org)
2) used that FQDN in my OpenVPN configuration
3) set OpenVPN to continuously connect
4) setup Pi-Hole with a local DNS entry for the FQDN (example.duckdns.org) pointing to IP 0.0.0.0
This way when I'm connected to wifi and Pi-Hole is acting as my DNS resolver, OpenVPN is redirected to 0.0.0.0 and does not connect. As soon as I leave my home WIFI OpenVPN is able to connect.
-
- OpenVpn Newbie
- Posts: 4
- Joined: Sun Oct 28, 2018 10:43 pm
Re: Always connect except on "home" network
Just found this and trying to do the same.Can you elaborate on your config a little?ezoN wrote: ↑Fri Dec 29, 2023 3:02 amI found a workaround that works for me by doing the following (assumes you have Pi-hole installed)
1) created a FQDN with a service like DuckDNS.org (ie. example.duckdns.org)
2) used that FQDN in my OpenVPN configuration
3) set OpenVPN to continuously connect
4) setup Pi-Hole with a local DNS entry for the FQDN (example.duckdns.org) pointing to IP 0.0.0.0
This way when I'm connected to wifi and Pi-Hole is acting as my DNS resolver, OpenVPN is redirected to 0.0.0.0 and does not connect. As soon as I leave my home WIFI OpenVPN is able to connect.
reason is, if I do the same as you, it doesn't disconnect the vpn which causes all traffic to be dropped instead of redirected to the wifi.
Since the routes are still present (from no vpn disconnect) traffic never goes over to the wifi and continues to try the vpn link.
How are you dropping the routes?