enabling specific programs to bypass router based OpenVPN

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
Sam1789
DD-WRT User


Joined: 14 Oct 2016
Posts: 313

PostPosted: Tue Aug 13, 2019 17:14    Post subject: enabling specific programs to bypass router based OpenVPN Reply with quote
Overview:
I run a router stack with 3 tiers. Tier 1 is connected to the ISP modem; tier 2 routers connected Wan to the front router LAN. Tier3 routers are connected WAN to LAN of their specific tier 2 router. Over all purpose is to have securely separated subnets. OpenVPN is run the 2nd tier routers.

System works well. But two things I need to fix.

1) allow selected programs bypass the VPN on their tier-2 router and access the front Tier-1 router's logs.
The connection logger I use can not see/access the front (tier-1) router's logs when the VPN is running. Thus I miss the bogons and the NAT information. which is primarily trapped by the front router. Only a few sites seem to get thru the front (tier-1 router). {sneaky Google ob some occasions- less than 6 a day & Apple if our Ipad is connected}

2) be able to let a user turn off & on (or bypass) the router's VPN on occasion. Want something simpler & safer than giving users full access to the router's settings. Thought about using the SES button on the back of the router. But that requires the user have physical access to the router itself. ideas?

Sam

_________________
multi-tier router stack
wrt 3200's for speed & cpu power, NG R6300v2's for WiFi AP's,
wrt 1200v2 for one of my secure subnets.
wrt54GLs for ad'l 3rd tier machines.


Last edited by Sam1789 on Wed Aug 14, 2019 1:14; edited 1 time in total
Sponsor
portsup
DD-WRT User


Joined: 20 Oct 2018
Posts: 58

PostPosted: Tue Aug 13, 2019 22:13    Post subject: Reply with quote
You could allow the users to bypass the vpn by changing either ip or gateway. You would also need to setup this on the vpn router.

I am guessing you could allow access to the router for logs by either restrictive routing to it or firewall or routing rules on the client machines.
Sam1789
DD-WRT User


Joined: 14 Oct 2016
Posts: 313

PostPosted: Wed Aug 14, 2019 1:30    Post subject: Reply with quote
portsup wrote:
You could allow the users to bypass the vpn by changing either ip or gateway. You would also need to setup this on the vpn router.

I am guessing you could allow access to the router for logs by either restrictive routing to it or firewall or routing rules on the client machines.


portsup,
Thanks for your. Not sure how to do either of those. It sounds almost like just a paraphrasing of my questions?

Sam

_________________
multi-tier router stack
wrt 3200's for speed & cpu power, NG R6300v2's for WiFi AP's,
wrt 1200v2 for one of my secure subnets.
wrt54GLs for ad'l 3rd tier machines.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 3772
Location: Netherlands

PostPosted: Wed Aug 14, 2019 10:03    Post subject: Reply with quote
You can use Policy Based routing to route some IP adresses via the VPN and others not.

Normally you set a static lease for those addresses and if you set those addrsses in the PBR field of your VPN then those Clients/IP addresses will go via the VPN (the other way around is also possible).

Now on your client (which normally has this static lease) you can change the network settings, for windows you can use a utility NetSetMan (If I remeber correctly) to easily switch between Network settings and in this way you can easily switch between VPN or non VPN routing

(I think that this is also what @portsup is talking about Smile )

It is possible to use SSH to send commands to your router to disable the VPN entirely but then nobody can use the VPN at that moment

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
Install guide Linksys EA6900: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=291230
Simple PBR (Policy Based Routing) script: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318662
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN server setup guide:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614


Last edited by egc on Wed Aug 14, 2019 14:02; edited 2 times in total
portsup
DD-WRT User


Joined: 20 Oct 2018
Posts: 58

PostPosted: Wed Aug 14, 2019 13:54    Post subject: Reply with quote
Egc is describing largely what I am intending. The program for changing windows network settings sounds good. Rather than PBR, a gateway based solution would be better. You could setup multiple ips on tier 2 routers and have routing based on either of those ips with one going to vpn the other wan. Then the client merely changes gateway for vpn or wan.

You could do that I think on a tier 2 router by using pbr and adding an address in the subnet to the vpn device and adding that address to the pbr. Configure that address as gateway on the client for vpn, and the other address for wan.

As to routing to tier 1 while on vpn. I am guessing you can just make a rule for it. I am not sure though how linux prioritizes routing rules. PBR is a routing rule that says from a certain address go via vpn, you also want to say but to this other tier 1 address go here so to get to the tier 1 router.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum