1

I'm connecting from my Windows 10 machine to a Windows Server 2012 R2 machine in the same subnet. I also have an OpenVPN connection that goes to the office and the server also has its own connection.

When I'm accessing files on the server sometimes the connection goes through the VPN without me noticing. Of course this is not what I want since I have a gigabit connection to it in the local network and a lot slower through the VPN.

The strange thing about this is that I have set the server name in the hosts file to point to the local IP. And even stranger: even if I write \\192.168.23.45\share to Explorer address line the connection will actually go through the VPN!

The only way I can get it to work properly is to disable the VPN, access files and then maybe enable VPN.

Is there some way to tell Windows that it should never attempt to use the VPN address for that server and always use the local network address?

The metrics for both routes are 276, this might make for it not to favor the local route but won't explain why it doesn't use the IP address I tell it to use. I have also tried to set the metric in OpenVPN configuration to lower or higher but this doesn't change anything.

Local network is 192.168.23.0/24 and VPN network is 10.12.34.0/24 so they are completely separate. No IPv6 on the VPN, local network has the local IPv6 addresses.

I can also stop OpenVPN while transfering files or doing whatever with the file shares. The Windows 10 machine will just wait a moment, then switch to the non-VPN connection and continue. And if I restart it the transfers will switch to the VPN connection.

The server has also now been upgraded to 2016 but that hasn't changed anything. The problem is somehow in the Windows 10 machine. This also doesn't happen at all from another Windows 10 machine in the same subnet, same domain with the same OpenVPN configuration.

  • is the OpenVPN network's subnet different than the subnet you're trying to use with the local server? Have you tried simply using route to add a route to that IP through that interface? – Ƭᴇcʜιᴇ007 Jul 11 '16 at 16:16
  • @Ƭᴇcʜιᴇ007 Yes, they are completely separate. Edited the question. There is of course a route to the local network since I can access it fine if the VPN is off. It just somehow goes the wrong route sometimes when the VPN is on, even with the IP address. – Sami Kuhmonen Jul 11 '16 at 16:20
  • Did you try to disable IPv6 on the local network ? You might only have set routes for IPv4. – harrymc Sep 18 '17 at 13:21
  • @harrymc Yes, disabling IPv6 doesn't change anything. And OpenVPN doesn't do IPv6 anyway, it's all IPv4. – Sami Kuhmonen Sep 18 '17 at 17:46
  • The question here is Windows routing. Questions: (1) Why is the metric at 276? (2) What are the IPv4 Properties on both adapters? (if they are not automatic), (3) How can you be sure that it's accessing the VPN (for DNS I assume) ? – harrymc Sep 18 '17 at 18:32
1

You might be encountering a DNS wait on the VPN, because of the way that Windows 10 issues DNS requests for VPN split-dns, which is very different from previous Windows versions.

Windows 10 issues DNS queries in parallel to all adapters, then is supposed to take the first answer to arrive.

Unfortunately, it may, rather than take the first answer, wait for all answers. If this not-new bug was not yet fixed, to return the behavior as much as possible to that of previous Windows versions, do the following registry modifications :

DisableSmartNameResolution (DWORD)

In registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient.
The value is 1 to disable, 0 to enable smart resolution.
From Turn off smart multi-homed name resolution :

Specifies that a multi-homed DNS client should optimize name resolution across networks. The setting improves performance by issuing parallel DNS link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT) queries across all networks. In the event that multiple positive responses are received the network binding order is used to determine which response to accept.If you enable this policy setting the DNS client will not perform any optimizations. DNS queries will be issued across all networks first. LLMNR queries will be issued if the DNS queries fail followed by NetBT queries if LLMNR queries fail. If you disable this policy setting or if you do not configure this policy, setting name resolution will be optimized when issuing DNS LLMNR and NetBT queries.

DisableParallelAandAAAA (DWORD)

In registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters.
The value is 0 to enable, 1 to disable DNS A and AAAA queries from executing in parallel on all configured DNS servers, with the fastest response theoretically accepted first.

You may also set these policies by using PowerShell :

Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" -Name DisableSmartNameResolution -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters‌​" -Name DisableParallelAandAAAA -Value 1 -Type DWord
  • I don’t know how DNS would relate. Note: I access by IP and Windows goes through the VPN still. I have set up IPs in hosts files. Still goes through VPN. I can start VPN after starting to move files to shares and it will jump to VPN. DNS wouldn’t affect any of these. – Sami Kuhmonen Sep 18 '17 at 18:50
  • We are talking of a Windows bug or deficiency introduced in Windows 10, and these fixes turn off much of the new options. Wouldn't hurt to try. – harrymc Sep 21 '17 at 18:32
1

OpenVPN should have a "virtual" network adapter installed on your computer alongside your other physical adapters.

Try to change the priority of those network adapters as seen in this article: https://blogs.technet.microsoft.com/networking/2015/08/14/adjusting-the-network-protocol-bindings-in-windows-10/

You want the OpenVPN interface to be a larger number (lower priority) than your physical adapter.

  • Get-NetIPInterface says my OpenVPN connection's InterfaceMetric is 35 while the LAN interface is 25. So if should be using the LAN before OVPN? – Sami Kuhmonen Sep 26 '17 at 5:40
  • 1
    Yes, this sounds correct. It was worth a shot I guess. :) – Appleoddity Sep 26 '17 at 5:41
0

If you're using OpenVPN Client for your VPN Connection, then you can add custom routes for specific domains/IPs.

So that once you add the route, the connection to those domains/IPs will go through the specific route.

A route syntax for OpenVPN Config file is :

route [ip or website name] [subnet mask] [your gateway]

So in your case, if the gateway is 192.168.23.1 then you'll need to add this line to your OpenVPN Config file :

route 192.168.23.45 255.255.255.0 192.168.23.1
  • As I said, there is a route. The client just chooses to use a different IP to connect to that server and use the VPN route. – Sami Kuhmonen Jul 17 '16 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.