2

I'm using OpenVPN on Windows 10. I'd like to exclude traffic on certain ports (for example, SSH) from the VPN and instead use the underlying network. Can this be done?

On Linux, I'd imagine using iptables with -p tcp --dport 22 to redirect to the underlying device instead of the VPN tunnel device to do this. What are my options on Windows?

The VPN has (so far) assigned me an IP in the 10.9.0.0/16 range. The underlying network gives me an IP in 10.13.0.0/16, and most of my SSH traffic goes to 10.105.0.0/16 in the underlying network, or to Github (nslookup tells me that's 192.30.252.128).

6
  • OpenVPNs client doesn't support this, some commercial VPN products do to my knowledge.
    – Linef4ult
    Nov 9, 2015 at 12:22
  • @Linef4ult so this must be handled by the VPN client? Nothing to be done on the OS side?
    – muru
    Nov 9, 2015 at 15:13
  • @muru -- Is the host you want to ssh to in the same LAN as the VPN client or a different one ? Please add full details to your question
    – dotvotdot
    Nov 12, 2015 at 12:27
  • @dotvotdot could be either - I might want to SSH to Github or to a PC in the next room. Does it make a difference?
    – muru
    Nov 12, 2015 at 12:28
  • The problem leads to very complicated routing rules. If you add two examples to your question I will try to answer those specifically.
    – dotvotdot
    Nov 12, 2015 at 12:41

1 Answer 1

1

Your home LAN is 10.13.0.0/16, I presume your Home gateway is 10.13.0.1 Your VPN subnet is 10.9.0.0/16, I presume your VPN gateway is 10.9.0.1 then we can add these routing rules:

To route your SSH via the LAN gateway not the VPN

route add 10.105.0.0 mask 255.255.0.0 10.13.0.1

To route GIT via your the LAN gateway not the VPN

route add 192.30.252.128 mask 255.255.255.255 10.13.0.1
4
  • 1
    So, this can only be done on the basis of the destination IP, but not based on the port?
    – muru
    Nov 12, 2015 at 13:54
  • As pointed out to you already -- openvpn does not filter anything on port numbers. This is the only way you can achieve your result in Windows. [edit: that I know of]
    – dotvotdot
    Nov 12, 2015 at 13:57
  • But, maybe it's my Linux background confusing me, but, again, is the VPN client supposed to do this? (I asked the other commenter too, but no response).
    – muru
    Nov 12, 2015 at 14:00
  • OpenVPN client or server does not/can not and probably never will filter on ports, this is achieved in Linux with iptables ..I am not aware of a product solution like iptables with Windows.
    – dotvotdot
    Nov 12, 2015 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .