Will a VPN router that disconnects from the VPN affect my internet connection?

Question

I am thinking of purchasing a VPN router and having that connect to my VPN package (PPTP, L2TP, SSTP), so all of my internet can flow through it automatically.

I am currently in China where VPNs are actively restricted, so they often disconnect.

If the VPN in a router gets disconnected, will this affect or stop my internet connection, or will some/all VPN routers automatically direct traffic through the normal channels, or is this simply router specific?

Answer 1

There are two things to address here:

1. (the question you asked): If the VPN is disconnected, will it redirect the traffic to the unprotected internet (failover)

Answer: This is router specific, and is very common. The better routers will give you more control over this.

2. (What you may want to think about): You're using a VPN for a reason.

If your VPN connection goes down and the router automatically switches to the unprotected internet, your system will automatically send data that you may not want to send. It may even do this without you noticing.

Answer 2

The answer depends both on the router and the protocol. The protocols you are looking at are probably not a good fit as both PPTP and L2TP rely on PPP which is broken, and SSTP would appear to require port 443 TCP - which paints a target on your back if you are sending a lot of data through it.

You should look at OpenVPN (which is open source, supported in routers which work with *Wrt and can be configured in a large number of configurations). Configuring it so it uses UDP would be advantageous to your performance, and not going through port 443 would be useful as well. Further, depending on how sophisticated you are and your control of the remote points, you may be able to set it up such that if one connection fails, the second one will automatically route the traffic - in which case you will notice a pause (say 15 seconds) before things auto-reroute.

Using OpenVPN in various modes can also reduce the likelyhood of your connection being disconnected - although working out the best way of accomplishing this would be a matter of trial and error, or asking someone in China who knows their stuff. I suspect that what is happening at the moment is that IP addresses of VPN servers get blocked or - if you are using something which uses TCP port 443, different routers are handling different parts of the payload, which could cause instability. It may be an idea to use an established VPN or Tor connection to purchase access to a low end box and run your own VPN server - in which case the IP address is less likely to be blacklisted.

As per @Joshfindit answer, you can configure a VPN to disallow traffic or to fail silently. If you set it to fail silently, a lot of web pages will continue to work, however web pages which track you based on your IP address (quite a lot of sites do this, it prevents a class of attacks), then you will need to log in again as your IP address will have changed.

The key thing is that there will be a time when the VPN is down but does not know its down - during this period the Internet will just freeze. There is little you can practically do about this - although you can configure how often the router checks that its up and reduce this downtime to a few seconds.

Answer 3

Most of the routes do not support SSTP. Only MikroTik has SSTP support but we recommend you to purchase DD-WRT so you will get some more control over your router.

When a VPN drops then all your traffic will flow through your normal ISP. If you want to prevent this then you can use some script under Administration > Command which will stop all your internet activity if VPN will drop. You will be able to configure PPTP, L2TP, OpenVPN UDP and TCP with DD-WRT

Source https://support.purevpn.com/how-do-i-configure-dd-wrt-router-vpn-such-that-if-vpn-disconnects-all-browsing-stops

Answer 4

If your VPN connection fails, it is possible that your kernel restores the routing table without the VPN, thus forwarding your traffic in clear text thru the unencrypted interfaces.

Since you are facing a skillful and powerful opponent, the best solution I can recommend is indeed OpenVPN, albeit for reasons that differ from those of others who have answered your OP.

These are my reasons:

1. OpenVPN provides you with the most up-to-date cryptographic capabilities. In particular, it does something you absolutely need, i.e. it authenticates you to your server and your server to you. In other words, it prevents anyone in the middle to pose as your server to intercept your traffic;

2. It provides a simple mechanism to reconnect automatically in case of a disconnection, ping-restart n will restart the connection if n seconds have elapsed without receiving a ping from the server (must use ping m on both client and server);

3. It allows you to setup the routing table outside the program, so that, even if the program crashes, your communications will not be re-routed over the clear-text channels (you will experience a total lack of connection, though); this can be done with the instruction route-noexec;

4. Lastly, you can setup your firewall to prevent any and all communications over the clear-text interfaces. An example of how to do that, for Linux, can be found here. The example is due to my ignorance (I am strictly a *Nix person, apologies), I am sure it can be done in Windows too, I just cannot point you to a suitable reference. But the important point is that, thru a skillful use of the firewall, you can block all traffic over the clear-text interfaces while allowing all traffic thru the encrypted interfaces.

A practical suggestion: do this thru a VPS, you can rent one for as low as 3$/mo., I have one with unlimited traffic for that much.