0

For work, I had to use an OpenVPN server to access a few websites since they only allow the IP address from the work OpenVPN server. However, I still want to use the IP address of my own OpenVPN server to access most websites (my VPN is installed on a VPS Linux server). Currently I am able to turn the OpenVPN server that I use for work into a SOCKS proxy by using an SSH tunnel to an LXC container which has an OpenVPN client (instead of LXC, it could also be done with a Linux virtual machine in VirtualBox but the performance is better with LXC). I also created a SOCKS proxy by using an SSH tunnel to my own Linux server, in order to be able to use 2 Firefox profiles connecting to a different proxy, one for personal browsing and the other for work browsing.

The OpenVPN server that I use for work only allows browsing a few websites, so it is pushing the allowed routes instead of using a default gateway that will route all traffic through the VPN. When I use this VPN connection, a privacy issue is that it will leak my real IP address to all third-party requests of the work websites. If these third-party requests are using HTTP instead of HTTPS, there is also a risk of man-in-the-middle attack on the local network, which is a security issue due to the VPN not routing all Internet traffic. The other privacy issue is that my real IP address is leaked when connecting to the OpenVPN server that I have to use for work.

Is it possible to fix these security and privacy issues by using a proxy or another VPN before connecting to a VPN? I tried to connect to the 2 VPNs at the same time but the work website was not working. I also tried redsocks to have a SOCKS proxy system-wide and then connect to the work OpenVPN server but the work website was not working either. I tried proxychains too. And I heard there is a socks-proxy variable that can be configured in the OpenVPN client file but I did not get it working, maybe because the OpenVPN server is using UDP instead of TCP, which is not supported by a SOCKS proxy using an SSH tunnel.

Update: I partially fixed the problem by using a route like ip route add WORK_VPN_IP via GATEWAY_IP which allows to use the 2 VPNs at the same time. In the LXC container, I can now use the work VPN for work websites and use my own VPN for all other websites or third-party requests. However I think this will still leak my real IP address to the work VPN. By using the traceroute command on a work domain name, I can see that the traffic only goes through my work VPN. Using my own VPN outside of the LXC container and using the work VPN inside the LXC container does not even make it possible to access HTTPS websites through the work VPN (https://askubuntu.com/questions/703905/unable-to-open-sites-with-https-when-connected-through-openvpn/1206914#1206914). Instead of using an LXC container, I also tested using a virtual machine with NAT network in VirtualBox. The HTTPS problem also happens with a script like VPN-Chain (https://github.com/TensorTom/VPN-Chain/issues/7). A solution would be to connect directly to the work VPN on my Linux server but I don't want to enter work VPN credentials in the cloud for security reasons (it could also mess the routing of my own VPN installed in this Linux server).

Update 2: I installed Dante SOCKS proxy on my server and I am now able to connect to my proxy before the work VPN, by using the socks-proxy variable in the OpenVPN client config file. This solves my problem but I would still be interested to know if it is possible to connect to a VPN instead of a proxy before connecting to another VPN, without the problem I had with HTTPS websites.

Update 3: I was able to solve the problem by adding mssfix 1400 in the OpenVPN client config file like @Enrico suggested in an answer but it does not work anymore with another VPN. Now I have to use a workaround by connecting to one of the VPNs on the TCP port 443 instead of UDP port 1194. See comments: Use a proxy or another VPN before connecting to a VPN (link working without JavaScript: https://superuser.com/posts/1522164/comments).

Improve this question
0

1 Answer 1

Reset to default
1

You wrote:

By using the traceroute command on a work domain name, I can see that the traffic only goes through my work VPN

If you're using the work VPN for accessing a (work) website, then that website will see the IP address of the Internet connection where the (work) VPN server is linked to.

If you're concerned about the (work) VPN concentrator itself, yes it can see your original IP address if you're using the static route that you mentioned. To avoid that, you can avoid the static route and launch the work VPN after your own personal VPN: by doing so, all work VPN packets will flow inside the personal VPN (as you stated that your personal VPN will set a default gw).

If the work VPN doesn't work when the personal VPN is up, maybe:

  • Your personal VPN is blocking particular destination IPs, ports or traffic
  • Your work VPN concentrator (or its firewall) is blocking the source IP/subnet used by your personal VPN

For the latter, you may ask to the IT department of your company if there are any firewall restrictions for incoming connection to the VPN.

Improve this answer
15
  • Thanks for trying to help. Yes, the work website will see the work VPN IP address but I also don't want the VPN server to see my real IP address which can leak my location if I travel for example. I don't think my personal VPN is blocking the IP address of the work VPN because I configured it myself and just tested to disable my Linux server firewall with the command iptables -F.
    – baptx
    Feb 2, 2020 at 17:15
  • I also don't think the problem can come from the work VPN server blocking my own VPN IP address because I tried another work VPN that redirects all Internet traffic through it (compared to the previous work VPN, even visits of websites not needed for work are going through the work VPN). If I connect to my own VPN first, then this other work VPN and go to a website showing my IP address, I see my own VPN IP address instead of the work VPN IP address, which means the traffic is only going through my own VPN. Let me know if you have other ideas.
    – baptx
    Feb 2, 2020 at 17:34
  • If the work VPN, as you said, is pushing only some routes, only for those routes you'll end up using that VPN. So, if the website that you used in order to get the IP address is not in those (pushed) routes, you see your personal VPN public IP. So if you try to launch the work VPN after the personal VPN, what is telling the OpenVPN log?
    – user900382
    Feb 2, 2020 at 18:21
  • 1
    It might be an issue of MTU. Try to lower the MTU in your OpenVPN client configuration (see OpenVPN config for the correct syntax). Usually I use 1400, but you need to try to see the higher value that works for you. Nested VPNs needs smaller values
    – user900382
    Feb 5, 2020 at 8:37
  • 1
    The MTU is the max transfer unit. If you're using a VPN, which adds some bytes for IP headers, then the max transfer units decreases. With two VPNs, you have two VPN IP headers, and so on. The traceroute will display, as the first hop, the VPN endpoint (not external IPs).
    – user900382
    Feb 6, 2020 at 21:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .