How to cut off internet when your OpenVPN server goes down- Win 7.

[Deleted member 27741]

This is obviously for those who redirect all internet traffic.

Openvpn does not do a good job of telling you when your tunnel is down this can be annoying! This will remove the default route to your router, so that when your openvpn tunnel goes down, your internet is cut off.

In the same directory that your ovpn file is located, create a file. The file format is: xxx_up.bat
you substitute the name (before .ovpn) of your ovpn file for xxx.

In that file, type the following command and save-
route delete 0.0.0.0 mask 0.0.0.0 192.168.1.1

Substitute the ip address of YOUR router for 192.168.1.1 if it is different!!

When your tunnel connects the default route to your router is deleted. If the tunnel goes down you will no longer have internet access. If you want the internet back, reboot or run cmd.exe as an admin and type in the command:

route add 00.0.0 mask 0.0.0.0 192.168.1.1

Again, substitute the ip address of your router for 192.168.1.1 if it is different.

***Do note that if your tunnel does go down, you will have to add the route back to reconnect as you will have no internet access (DNS won't work).

Of course, you can use the xxx_up.bat file to execute other commands. There is also xxx_pre.bat and xxx_down.bat. I have not tested this extensively, so if you try it out let me know how it goes. Do note that all the routing changes go away if you reboot, so there is no worry playing with routes this way. However, using route with the -p flag makes route changes persist across boots, something I would not advise you do unless you are pretty good (much better than myself) at routing.

 

[Deleted member 27741]

Another good reason to use something like this is to circumvent ip address conflict between the network you are connected to and your vpn. I have yet to confirm this, as I have not encountered an external network that uses the same set of ip addresses as my network, but in theory it should work. I got the idea from this gentleman's web page, the section at the bottom with heading;
VPN into a network with same IP range

http://tech.snathan.org/tech/pptp_vpn_routing#vpn_into_a_network_with_same_ip_range

For people that have issues with vpn ip address conflicts this is one potential workaround.

 

[Calisro]

or give your win machine a static ip of a fixed dhcp lease and add this to your firewall script. it will prevent your computer from sending packets to the internet directly. It can only talk over your routers tun address.

iptables -I FORWARD 1 -s 10.100.1.16 -o eth0 -j DROP

Assuming you are using openvpn on the router since you posted in the merlin asus forum...

 

[Deleted member 27741]

Yes, N66U openvpn merlin fork in my sig. I am an amateur at this stuff. Would this work away from home?

 

[Calisro]

So you mean having the router as a vpn server (rather than acting as a vpn client) that you connect to? No sorry. I meant having your router as a vpn client to a vpn service.

 

[Deleted member 27741]

I understand now. For people who use their router as a vpn client this is a dead simple way to keep data from leaking out of the vpn.