3

A certain internet service I require demands that I connect from a university IP. Said service indeed works well when connected from several universities.

Now, I would like to access that service at home and to that end, I have registered for a VPN account at my university. Connecting through the VPN account, I indeed get access to university resources such as libraries and university servers (which are not accessible otherwise).

However, when accessing the service I need (which is not affiliated with my university specifically), my access is denied, since the IP appearing to that service is my regular ISP IP. Connecting to http://www.displaymyhostname.com/ confirms that (my regular IP/host is showing).

Is there any way to use the VPN IP for all communication ? I'm using CheckPoint's SSL Network Extender for the VPN connection (not my choice, that's how their VPN site works). I'm also using my university's proxy, to no avail (same external IP).

Improve this question
4
  • Does CheckPoint have any options related to "campus only" traffic or perhaps local routing options, etc.?
    – mindless.panda
    Jun 16, 2011 at 16:11
  • I don't see any option in the client. As far as I can tell, there's nothing you can do except disconnect. Also, checkpoint probably won't use uni terms such as campus since I imagine their VPN client is generic
    – Ohad Schneider
    Jun 16, 2011 at 16:19
  • Have you checked your Uni's VPN documentation? sometimes you can appended modifers to your login information to specific what type of tunnel (local, global, campus only, department specific, etc.)
    – mindless.panda
    Jun 16, 2011 at 16:30
  • I don't see any such modifiers, but it does mention a different client for mac, maybe I'll try with a VM
    – Ohad Schneider
    Jun 16, 2011 at 16:58

3 Answers 3

Reset to default
4

The CheckPoint VPN client can be configured to decide which host requests flow across the VPN and what don't (instead, that traffic uses your local gateway to get out to the Internet).

From CheckPoint's manual here:

The administrator defines the list of networks and hosts accessible for the client once connected to the gateway. This list, the encryption domain, or VPN domain, is downloaded to the client after the initial connection and is used by the client to define what network traffic should be tunneled, encrypted to the gateway, and what traffic should not.

They are (probably) doing this to prevent all your non-University traffic from flowing through their Internet connection while you're connected to the VPN.

Since the CheckPoint client gets this list from the CheckPoint VPN server, the person in charge of the server-side would have to add the service's address to the allow list so that it (the VPN client) will redirect requests for that site via the VPN, making it appear that you are connecting from the University.

Improve this answer
2
  • I was afraid of this. Any chance of modifying this at the client (my) side ?
    – Ohad Schneider
    Jun 16, 2011 at 16:21
  • 1
    I don't know for sure but I'm going to say No, since it's intended to be a secure setup. Why not ask the university VPN administrator about adding the site? If it really is a university-related site (even though it's not part of the university) with security in place I would think they'd be willing to at least consider it. If you DO circumvent it, and they catch you, you'll probably be in big trouble. :)
    – Ƭᴇcʜιᴇ007
    Jun 16, 2011 at 16:24
2

You should be able to tell your system to route connections for the IP of the service you're trying to use over the VPN network. For windows, it would require the following command run on the command line as administrator:

route add service.ip.here mask 255.255.255.255 vpngateway IF vpninterface

Where service.ip.here is the IP address of the server to which you are trying to connect to, and vpninterface is the VPN interface number through which all if your VPN traffic is flowing. vpngateway is the default gateway that shows when you are connected on campus.

To find the VPN gateway IP, run route print and look at the interface list at the top. It will have each interface on your system numbered on the left, use the number that corresponds with the VPN tunnel interface.

You can repeat this command for each server you need to access over the VPN

Improve this answer
8
  • This may work (definitely worth trying at least :) ), but if they've set up a trust list CheckPoint will/can actively refuse traffic to targets not on the list.
    – Ƭᴇcʜιᴇ007
    Jun 16, 2011 at 16:45
  • Thanks, this looks interesting. There seems to be an argument missing though, docs say it should be: route ADD [destination] MASK [mask] [gateway] IF [interface#]. Now, I know the destination and interface#, and for the mask I understand I need 255.255.255.255. As for the gateway, the client specifies both a "Gateway ID" (which is am IP) and an "Office Mode IP" - I've tried both as the gateway but then I can't connect to the service at all. Any ideas where I get the gateway from ?
    – Ohad Schneider
    Jun 16, 2011 at 16:55
  • @ohad Next time you are on the campus, check the default gateway on your computer's network connection; You should be able to use that unless they have it firewalled from the VPN
    – Darth Android
    Jun 16, 2011 at 17:15
  • Thanks, I'll check it out. Any way to figure it out from home though ?
    – Ohad Schneider
    Jun 16, 2011 at 19:59
  • I'm afraid not that I know of, unless there's a second entry in the routing table (route print) for 0.0.0.0 that is routed down your VPN tunnel (in which case, the gateway on that route would be the gateway you want for the route you're trying to add).
    – Darth Android
    Jun 16, 2011 at 20:08
0

One simple problem may be that you are not running OpenVPN with Administrator Priviledges. On Windows the route add command will fail if you are not running OpenVPN as administrator.

From an OpenVPN Support forum post (my empasis):

The client log shows

Quote:

Tue Apr 05 19:01:25 2011 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 ifndex=13] The requested operation requires elevation. Tue Apr 05 19:01:25 2011 ERROR: Windows route add command failed [adaptive]: returned error code 1 Tue Apr 05 19:01:25 2011 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 ifndex=18] The requested operation requires elevation.

if you're using windows vista/7 then you must run openvpn with elevated privileges, or you must add the local user to the > 'Network administrators' group (available on the Profession edition or higher).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .