Softethervpn: Stop rerouting internet
I successfully installed both the server and client and managed to link the two computers from the first try, super easy. However as soon as the VPN link is created, all internet traffic is rerouted trough it. How can I stop this, or at least to do that only for certain targets? I am using the client on Windows 10 x64 16299, and the main internet connection is Wifi.
Thank you!
cdcseacave
All 49 comments
Same situation :)
I set the VPN network card metric to a high value (like 999)
vampywiz17
on 22 Oct 2017
I also did that, doesn't help. As soon as the VPN is on, the internet is routed through it, no matter what metric I set to both VPN and Wifi cards. I also tried setting VPN as metered connection; nothing.
cdcseacave
on 22 Oct 2017
Maybe you could try Virtual NAT? It has an option to not give a default gateway to clients connecting to it, but I don't know if other traffic will be let through to the local network
DDGo
on 23 Oct 2017
@cdcseacave what is "certain targets", what you mean? certain applications? or certain networks? or certain IPs?
macvk
on 23 Oct 2017
forget about that for now, it is more important at least to completely disable it, otherwise it is unusable
and to answer your question, a smart decision could be made based on the native PC and server PC position in the world, and pass trough the VPN only the internet target that are much closer to the server PC
cdcseacave
on 23 Oct 2017
I set to both VPN and Wifi cards
Default Gateway on NIC with lower metric will take precedence.
Reduce the metric of the NIC you want to prioritize.
MtCedarNet
on 23 Oct 2017
@MtCedarNet as I said before, I did that, and it does not make any difference (ex: I set 10 to the Wifi and 50 to the VPN)
The VPN connection is seen by Windows as a "ethernet", so wired, connection, and for some reason it takes precedence over the Wifi connection, and the metric doesn't seem to influence it
cdcseacave
on 23 Oct 2017
It is impossible now to disable route replacing. but I can add this "feature" to SE (add option in vpn_client.config).
I can't understand why you need this. if the routes not changed, then Windows will not route any traffic through VPN client adapter. are you sure you need this?
macvk
on 23 Oct 2017
Since the metric value is a parameter of the IP layer, it is not related to the type of the device.
There is the possibility that some third party application is manipulating the routing table. (For example, the software that comes with WiFi device may lower WiFi priority on Ethernet connection.)
Why do not you check the routing table in the connected state?
MtCedarNet
on 23 Oct 2017
@macvk What I need, and what I think is the primary purpose for a VPN usage, is to route only the traffic having as destination an IP in the local IP address space set by the VPN. All the other traffic to be routed through the default network on the PC. Is there a way currently to do that?
@MtCedarNet There is not third party software neither for the Wifi not the Ethernet cards (all default Windows software and drivers it installed). Here is what I get when running netstat -rn | more; for some reason there is nowhere used the 50 metric set for the VPN:
===========================================================================
Interface List
5...70 85 c2 2f 1d 75 ......Intel(R) Ethernet Connection (2) I219-V
12...34 f3 9a 11 f1 8e ......Intel(R) Dual Band Wireless-AC 8260 #2
10...0a 00 27 00 00 0a ......VirtualBox Host-Only Ethernet Adapter
3...34 f3 9a 11 f1 8f ......Microsoft Wi-Fi Direct Virtual Adapter #3
17...00 ac 7f ef 6e f6 ......VPN Client Adapter - VPN
15...34 f3 9a 11 f1 92 ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.112 20
0.0.0.0 0.0.0.0 10.1.10.1 10.1.11.220 60
10.1.8.0 255.255.252.0 On-link 10.1.11.220 286
10.1.11.220 255.255.255.255 On-link 10.1.11.220 286
10.1.11.255 255.255.255.255 On-link 10.1.11.220 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
130.158.6.112 255.255.255.255 192.168.1.1 192.168.1.112 20
130.158.6.125 255.255.255.255 192.168.1.1 192.168.1.112 20
136.24.123.42 255.255.255.255 192.168.1.1 192.168.1.112 20
192.168.1.0 255.255.255.0 On-link 192.168.1.112 266
192.168.1.112 255.255.255.255 On-link 192.168.1.112 266
192.168.1.255 255.255.255.255 On-link 192.168.1.112 266
192.168.56.0 255.255.255.0 On-link 192.168.56.1 281
192.168.56.1 255.255.255.255 On-link 192.168.56.1 281
192.168.56.255 255.255.255.255 On-link 192.168.56.1 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.56.1 281
224.0.0.0 240.0.0.0 On-link 10.1.11.220 286
224.0.0.0 240.0.0.0 On-link 192.168.1.112 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.56.1 281
255.255.255.255 255.255.255.255 On-link 10.1.11.220 286
255.255.255.255 255.255.255.255 On-link 192.168.1.112 266
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
1 331 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
Is 192.168.1.X for your LAN?
It seems that the LAN has priority.
Could you disable DHCP on your VPN virtual NIC and static IP address for it (without default gateway)?
MtCedarNet
on 23 Oct 2017
@cdcseacave as I can see in your routing table, you have 2 default gateways. SE tries to delete old default gateway just after successful connection to VPN server. In your situation SE can't delete your old default gateway. Maybe restarting SE which admin privileges will solve this issue. You shouldn't have 2 default gateways! Also try run "netsh winsock reset" from command line and restart your computer. Or run "route delete 0.0.0.0" and then turn off and then turn on WiFi adapter (this will reset default gateway).
macvk
on 23 Oct 2017
What I need, and what I think is the primary purpose for a VPN usage, is to route only the traffic having as destination an IP in the local IP address space set by the VPN. All the other traffic to be routed through the default network on the PC. Is there a way currently to do that?
@cdcseacave: What is this "an IP in the local IP address space set by the VPN"? Do you set this space somewhere manually or what? where is described this "space" which must be set by the VPN? As a far as i know every vpn in windows tries to route all traffic through itself. this belongs to L2TP, IKEv2, OpenVPN ...
macvk
on 23 Oct 2017
@macvk what I mean is the IP space set automatically by your VPN software (assigned by the server), in the above case 10.1.11.x
cdcseacave
on 23 Oct 2017
@cdcseacave 10.1.11.x - where is this described? in DHCP server? you can't have two active DHCP servers. you can't have two default gateways which is installed by two different dhcp servers.
macvk
on 23 Oct 2017
@macvk I confirm that using route delete 0.0.0.0 MASK 0.0.0.0 10.1.10.1 solves the problem: deletes the extra route added by your software and only the 10.1.11.x traffic goes to VPN, as it should; isn't there a way for your software to automatically do this when it connects? or not adding the extra route in the first place.
cdcseacave
on 23 Oct 2017
@macvk I did not do anything apart of installing your client; I didn't add/change/delete anything related to network neither before or after installing your client; all worked just fine before installing the VPN client, and still works fine if I disconnect it
cdcseacave
on 23 Oct 2017
@cdcseacave this is not my client ;) and client does not do anything with routes. routes are managed by windows.
macvk
on 23 Oct 2017
@macvk all I know is that that happens when I use the VPN client; so if I understand correctly from your answer, there is nothing you can do to not route the internet traffic trough the VPN? Thank you!
cdcseacave
on 23 Oct 2017
@cdcseacave I can do it. but it is strange behavior because every VPN tries to hook all traffic. and almost every users need exactly routing all traffic through vpn. But you need the opposite routing only a piece of traffic... so your internet connection will not use VPN and therefore your internet connection wouldn't be secured.
macvk
on 23 Oct 2017
@cdcseacave
Hello there! Check an option called "pushroute". It is a parameter of DHCP
function. SE has that function as well. You can use it to tell VPN clients
to "USE VPN ONLY" with specific destinations and to keep using the local
gateway otherwise.
…
Raafat
on 23 Oct 2017
@Raafat do not find the option (that is also the reason why I created this issue), any guiding hints?
cdcseacave
on 23 Oct 2017
@cdcseacave
In command line mode, select a vHub and type this: dhcpset ?, then hit the Enter key, you would find it listed with explanation how to use it
Raafat
on 23 Oct 2017
doesn't seem to be what I need
DhcpSet command - Change Virtual DHCP Server Function Setting of SecureNAT Function
Start Point for Distributed Address Band:
first of all SecureNAT is not enabled
second no idea what starting point is he speaking about
cdcseacave
on 23 Oct 2017
Disable NAT and use SecureNAT, that is how to keep using DHCP with SE and to not use NAT. Starting point is the first IP address you want to use.
Raafat
on 23 Oct 2017
Let me know if you couldn't get it solved.
Raafat
on 23 Oct 2017
Hmm strange to see, that only few people use SoftEther same function like me :)
@cdcseacave the first guy to use similar (or exactly same) function this VPN software like me.
My goal this software, that i able to access my home network to a remote place (for example my work).
I dont want to routing all traffic through vpn, only just the traffic which come to my home network. All other one use the "normal" one.
Anyway, i only set the VPN network card to 999 metric and it was solve my problem.
It is very interesting that nobody (or really few people ) want to use this function the SoftEther.
vampywiz17
on 23 Oct 2017
Try to use 2 filters 0.0.0.0/1 and 128.0.0.0/1 instead of default 0.0.0.0/0
These filters will get the higher priority
Xenos13
on 8 Nov 2017
@macvk can you tell what code rewrites the routing table?
In order to everyone who needs could patch this.
Xenos13
on 9 Nov 2017
@Xenos13 sorry there isn't easy way to do it. what OS do you use for server?
macvk
on 10 Nov 2017
@macvk I am using only client on Debian.
Xenos13
on 10 Nov 2017
Dont push default route to client
See this
sonvirgo
on 12 Nov 2017
An easy way to achieve that is through OpenVPN which SoftEther supports.
There you can configure the client to reroute all traffic except a certain Set, or route only a certain Set of URLs. I know this is't what you asked for, but it is a solution.
Please see this answer:
https://serverfault.com/a/631048/114877
Summary:
# redirect all default traffic via the VPN
push redirect-gateway def1
# redirect the Intranet network 192.168.1/24 via the VPN
route 192.168.1.0 255.255.255.0
# redirect another network to NOT go via the VPN
route 10.10.0.0 255.255.255.0 net_gateway
# redirect a host using a domainname to NOT go via the VPN
route www.google.ca 255.255.255.255 net_gateway
moatazelmasry2
on 21 Nov 2017
Finally I found the solution (by pure chance):
on the client manager, select Properties for the desired VPN connection, Advanced Settings and finally select No Adjustment of Routing Table
This seems to solve my problem: internet is not routed through the VPN anymore, only the remote local network can be accessed.
I find very strange that the developer of this project, @macvk, didn't know about this option.
cdcseacave
on 16 Mar 2018
@cdcseacave It still adds default gateway through the VPN -
see https://github.com/SoftEtherVPN/SoftEtherVPN/issues/89
net147
on 17 Mar 2018
@net147 u r right, I got excited too fast, this does not solve this issue
cdcseacave
on 17 Mar 2018
@cdcseacave I think your needs are not so unusual because I also come to the same point like you. In Germany, we often have this crazy situation, that internet connections in industrial areas are (still) slower than in pure living areas. So it's simply unwanted, to route internet access from a fast internet connection at home (where a home-office is situated) through a slower internet connection in the company (where the VPN server is situated). Moreover, it's even unwanted for the company, that a home-user opens for instance a RDP connection to their infrastructure by VPN connection and at the same time all internet traffic from the LOCAL internet browser at home will be routed to the companies internet connection. What, if the home-user will do something strange, like to share copyrighted music or videos by sharing-software installed on his LOCAL computer? In this case, the company might be in danger to get in unwanted situations.
@MtCedarNet Thanks for your advice to set static IP without DNS and gateway for the VPN network interface which is quite simple but working. The disadvantage is, that if you have for instance 10 remote stations, you need to reserve a certain address space and document, which IP is assigned to certain remote stations to avoid IP address conflicts.
@macvk Now you know, why people could use this function :-)
To say it short: Yes, there is a need to get control about the fact, if (or which) gateway and DNS will be transferred to a remote station, or just an IP and Subnet Mask. A switch in the VPN client software "Use default local gateway" or "Do not use remote gateway" would do the job. Even better would be a switch or an parameter for every user in the GUI of "VPN Server Manager".
However, thank you guys from the University of Tsukuba. You really did and do something georgeous to provide high security in legendary Japanese quality to make security affordable for everyone around the world. I highly appreciate it!
nxtester
on 24 Jun 2018
Basically to change the metrics of VPN network interface at the client does the job also. But there is a big disadvantage: The first try to connect to a pc by remote-desktop (RDP) will generally fail. You have to connect a second time and it will work (the same if you try to PING where the first PINGs will get lost). I assume this is under Windows by design because of this gateway/metrics relation.
So (only) to change manually Gateway and DNS entry in the VPN client adapter seems to work as it should.
nxtester
on 24 Jun 2018
I just remove the gateway being pushed in the virtual DHCP server.
Then I add static routes to be pushed for certain IP rages.
That way only traffic destin for that IP range will be sent across the VPN adapter.
That works fine for me so far using DHCP.
However I think for static IP I would need to have it outside the virtual DHCP server pool and possibly manually setup DNS lookup zones. Wil update if/when I get to that.
2E0PGS
on 20 Sep 2018
That is using the SecureNAT virtual NAT and DHCP server built into SoftEther. I now need to figure out how to configure SoftEther to push custom routes without using the SecureNAT.
2E0PGS
on 26 Sep 2018
Related https://github.com/SoftEtherVPN/SoftEtherVPN/issues/391 seems it only supports that in DHCP mode.
2E0PGS
on 26 Sep 2018
When you click on that button, it says "Split tunnelling may be realized by..." and goes on to explain how to do it. That should give you what you need.
Arlen22
on 1 Jan 2019
Another solution for this issue (when secure NAT is used) is to clear default gateway address and to use static routes.
vchc
on 6 Mar 2019
I successfully installed both the server and client and managed to link the two computers from the first try, super easy. However as soon as the VPN link is created, all internet traffic is rerouted trough it. How can I stop this, or at least to do that only for certain targets? I am using the client on Windows 10 x64 16299, and the main internet connection is Wifi.
Thank you!
Hi, I also had this problem. I found a way to solve it and I want to share it with you. In my case I am using windows, both for my clients and for my VPN server. On the PC that is a client, all I did was go to the section where my network adapters are located, select the adapter that provides me with the internet, right click, properties, tab sharing, select the "allow other users to connect..." and select the VPN network adapter, finally click "OK ". Once you do that, all the network traffic will go through the adapter that give you an internet connection, but you will still be connected to the VPN. Tip: Modify the IP of the VPN network adapter, put an IP that is in the network segment of your server, so you can access it.
There is another way that I have not yet tested. When you first install the VPN server, the installer asks you the type of VPN you want: "Remote access" or "SITE to SITE". I'm almost sure that if we configure a "SITE to SITE" connection instead of a "Remote Access" we will solve the problem. In OpenVPN it is equivalent to making "TAP" or "TUN" connections, where "TAP" creates a bridge to your local network, and TUN makes a virtual network independent of your local networks. When I have the opportunity I will try "SITE to SITE".
larasker
on 24 Jun 2019
My windows solution was to go into the properties and tell it to not use this as the default gateway. Then I could access my private subnet, but it doesn't route all internet traffic so long as you also put in a high metric (which it normally does by default).
xori
on 7 Aug 2019
Another solution for this issue (when secure NAT is used) is to clear default gateway address and to use static routes.
I can confirm that this is the best solution to the problem!
Thank you very much.
mostrilloperfido
on 8 Mar 2020
is this pointing towards a functionality similar to openvpn's --route-gateway, --route and --route-nopull functionality? Where the client has more control over how routing happens?
Just wondering, if openvpn has a upper hand in this regard, and if it is something worth to look at.
sagar-chandarana
on 5 Jul 2020
I think I understand more now. SoftEther is being true to it's nature, and part of that is causing this issue at the Operating System level. There was another comment somewhere on the Android thread, that there is a server side component translates layer 3 packets to layer 2. Is there is a possibility for a clientside component like that? Just like on OpenVPN you could select wether you want to connect tun or tap, regardless of how server is setup. Does that makes sense? I am very new to this project, but highly interested in contributing
sagar-chandarana
on 5 Jul 2020
That's exactly how it works, yes.
The server component is called IPC: https://github.com/SoftEtherVPN/SoftEtherVPN/blob/master/src/Cedar/IPC.c
davidebeatrici
on 21 Jul 2020
Related issues
renatosc
·
3Comments
connLAN
·
9Comments
c2chance
·
12Comments
AdroitAdorKhan
·
13Comments
suyash95
·
4Comments
Most helpful comment
Hmm strange to see, that only few people use SoftEther same function like me :)
@cdcseacave the first guy to use similar (or exactly same) function this VPN software like me.
My goal this software, that i able to access my home network to a remote place (for example my work).
I dont want to routing all traffic through vpn, only just the traffic which come to my home network. All other one use the "normal" one.
Anyway, i only set the VPN network card to 999 metric and it was solve my problem.
It is very interesting that nobody (or really few people ) want to use this function the SoftEther.