I'm connecting from my Windows 10 machine to a Windows Server 2012 R2 machine in the same subnet. I also have an OpenVPN connection that goes to the office and the server also has its own connection.
When I'm accessing files on the server sometimes the connection goes through the VPN without me noticing. Of course this is not what I want since I have a gigabit connection to it in the local network and a lot slower through the VPN.
The strange thing about this is that I have set the server name in the hosts file to point to the local IP. And even stranger: even if I write \\192.168.23.45\share
to Explorer address line the connection will actually go through the VPN (where it would be \\10.12.34.56\share
)!
The only way I can get it to work properly is to disable the VPN, access files and then maybe enable VPN.
Is there some way to tell Windows that it should never attempt to use the VPN address for that server and always use the local network address?
The metrics for local route is, for example, 276 and for the VPN connection it's set to 5120 in an attempt to stop it from using it. Still Windows decides to ignore my given IP and use the IP that goes through the VPN.
Local network is 192.168.23.0/24 and VPN network is 10.12.34.0/24 so they are completely separate. No IPv6 on the VPN, local network has the local IPv6 addresses.
I can also stop OpenVPN while transfering files or doing whatever with the file shares. The Windows 10 machine will just wait a moment, then switch to the non-VPN connection and continue. And if I restart it the transfers will switch to the VPN connection. So Windows is internally choosing which IP to use to that server, not just using the IP I give.
The server has also now been upgraded to 2016 but that hasn't changed anything. The problem is somehow in the Windows 10 machine. This also doesn't happen at all from another Windows 10 machine in the same subnet, same domain with the same OpenVPN configuration. But that machine is usually with ethernet and/or better wifi connection.
Edit: At some point it seemed that Windows sees OpenVPN adapter as 1Gbps network and thinks it’s better than wifi, which is of course not 1Gbps. So is there a way to say “ignore this functionality”, if that is the case? Or say “VPN is actually a bad bad network, use only if you can’t use other ways”?
Edit: Here's the routing table:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.23.254 192.168.23.220 266
10.12.34.0 255.255.255.0 10.100.101.1 10.100.101.14 5120
10.100.101.0 255.255.255.0 On-link 10.100.101.14 356
10.100.101.14 255.255.255.255 On-link 10.100.101.14 356
10.100.101.255 255.255.255.255 On-link 10.100.101.14 356
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
VPN.SERVER.IP 255.255.255.255 192.168.23.254 192.168.23.220 5120
192.168.23.0 255.255.255.0 On-link 192.168.23.220 266
192.168.23.220 255.255.255.255 On-link 192.168.23.220 266
192.168.23.255 255.255.255.255 On-link 192.168.23.220 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.23.220 266
224.0.0.0 240.0.0.0 On-link 10.100.101.14 356
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.23.220 266
255.255.255.255 255.255.255.255 On-link 10.100.101.14 356
===========================================================================
As mentioned, accessing \\192.168.23.45\share
connects to \\10.12.34.56\share
instead if the VPN is on. Just like any other machine in 192.168.23.0/24
block if they also have a 10.12.34.0/24
address available. If VPN is off it goes fine. If I turn it off while copying files it'll switch to 192.168.23.45
transparently. If I turn it back on it will again switch to 10.12.34.56
transparently. Routing is fine everywhere and naturally any server that only has 10.12.34.0/24
address is accessible just fine, just like any machine in 192.168.23.0/24
that does not have address in the VPN block is fine.
The server has the two IPs set in internal DNS, nothing anywhere else, so if Windows wants to resolve something it can and will get either nothing or both IPs, so that will not explain any behavior.
Here's a shot of Wireshark dumping information. As you can see, I've gone to \\192.168...
path but Windows still asks 10.100.101.21
for information about the shares and files. So there's no question it literally uses the other IP of the server, not the one I manually write to the address bar.
As I wrote before, the wifi adapter is 300Mbps and VPN is 1Gbps and I do remember sometimes the VPN showing as lower speed and then this didn't happen. So it may be Windows assuming the 1Gbps VPN is better than the wifi to connect to the server, even though it obviously is not 1Gbps connection. But I can't find any information about this nor how to disable it.
The TAP adapter doesn't have settings to change it from 1Gbps to something smaller if that would help.
arp -a
:
Interface: 192.168.23.220 --- 0x5
Internet Address Physical Address Type
192.168.23.45 d8-cb-8a-xx-xx-xx dynamic
192.168.23.254 c4-6e-1f-xx-xx-xx dynamic
192.168.23.255 ff-ff-ff-ff-ff-ff static
224.0.0.2 01-00-5e-00-00-02 static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
Interface: 10.100.101.14 --- 0x7
Internet Address Physical Address Type
10.100.101.1 e2-e0-45-xx-xx-xx dynamic
10.100.101.21 00-ff-52-xx-xx-xx dynamic
10.100.101.255 ff-ff-ff-ff-ff-ff static
224.0.0.2 01-00-5e-00-00-02 static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.251 01-00-5e-00-00-fb static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
255.255.255.255 ff-ff-ff-ff-ff-ff static
I also dumped again what happens when I start copying a file without VPN and then turn VPN on in the middle. There's DNS queries about the domain.local
(not the server I'm connected to, just the domain), WPAD queries, SRV record queries, NBNS registration of my machine to the network, Negotiate Protocol Request/Response, Session Setup Request/Response, and then the file data starts flowing through the VPN instead if direct connection without interruption.
route
to add a route to that IP through that interface?