1

After connecting to a VPN-server (in this case with the OpenVPN protocol) on a Windows 10 machine, some applications have access to the internet. Firefox, Edge are usable. I can even ping online destinations.

However, Office applications like Outlook, Word, Excel with OneDrive integration do not have internet access. The same is true for Microsoft Store App. Sometimes this can even results in licensing issues because office cannot validate an active subscription anymore. (A confusing side note is that the OneDrive application itself is working (sometimes) and syncing files when edited in Explorer, but the OneDrive integration within office is not working.)

Context:

  • The machine is configured to only allow traffic via the VPN network.
  • Exceptions are made for entry-ips of VPN-servers and certain DNS-providers.
  • This concerns Office 365 though I have reason to believe the version does not matter.
  • VPN-connection is made with OpenVPN software.
  • IPv4

It took me a while for finding a temporary work-around, so I share it here in the hope somebody can find a more practical solution.

After reading the temporary solution below, a follow up question would be: How can a OpenVPN config file set the gateway IP in the VPN adapter without knowing the IP beforehand since it is determined by DHCP?

Feel free to re-address the problem with a different angle if you find one; to goal is to have a VPN-connection and have office applications work via that connection.

1

After a long search, I found this article based on

It explains some technical workings considering

  • NLA – Network Location Awareness
  • NCSI – Network Connection Status Indicator

In a nutshell the problem is related the gateway in the VPN-adapter. The NLA/NCSI is confused and incorrectly assumes there is no active internet connection because the VPN adapter does not have an explicit default gateway IP defined. Please take note that the client-IP of the VPN adapter is determined by the VPN-server via DHCP. Via Routing rules a gateway is implicitly defined. That is why applications not depending on the NCSI can connect to the internet. The routing table has the information.

(Temporary) Manual solution:

Within the properties of the VPN-network-adapter, you can define the IP, subnet, gateway and DNS-server.

  1. In order for this to work, first determine your VPN local IP which could be something like: 10.100.5.25

  2. Based on the IP, determine the gateway IP, I assume the gateway will be 10.100.5.1. (You could also look in your route print table.)

  3. Fill this IP into the gateway field.

In your adapted overview the VPN connection will now be marked as having internet access. Your office and windows 10 applications will now be able to connect after you restart them.

You need to update the gateway IP next time you connect to an OpenVPN sever because you will most likely receive an other IP and therefore another gateway will be valid.

~At the moment I only know how to achieve this via the GUI. Via the command line you could set this, but you are required to define an IP then, which can change every time you reconnect and since I can set an gateway IP but leave the rest op to be assigned to DHCP via the GUI, I would expect this also to be possible via Powershell or other scripting language; I have not found such a solution yet.~ If I did, I could automate setting the gateway IP.

(On that note, a next question could be: can an *.ovpn file configure the adapter to have a gateway IP set?)


Source: https://blogs.technet.microsoft.com/the_microsoft_excel_support_team_blog/2014/03/24/office-2013-reports-no-internet-connectivity-with-vpn-connection/

Some other information sources that might add complexity but also context:

https://www.ryadel.com/en/yellow-triangle-over-network-connection-status-how-to-fix-it/

https://support.umbrella.com/hc/en-us/articles/230900948-Umbrella-Roaming-Client-Microsoft-Windows-Limited-Network-Connectivity-Warning-Yellow-Triangle-#7hotfix

https://www.interfacett.com/blogs/how-to-disable-network-connectivity-status-indicator-ncsi-with-group-policy/

https://community.spiceworks.com/topic/2131702-limited-connectivity-indicated-but-internet-works


Scripting solution:

Well, a bit unexpected, but I found a commandline answer:

I guess I previously searched on "gateway" which resulted in a lot of noise, but when I searched "default gateway" that gave more relevant results.

Adding the default gateway to your VPN adapter in PowerShell:

Set-Variable vpnadaptername -Value ENTER-NAME
Set-Variable vargateway (Get-NetRoute -DestinationPrefix 0.0.0.0/1 |Select-Object -expandproperty "NextHop"); Write-Host $vargateway 
New-NetRoute -InterfaceAlias $vpnadaptername -DestinationPrefix 0.0.0.0/0 -NextHop $vargateway
Get-NetIPConfiguration -InterfaceAlias $vpnadaptername

Assumptions:

  • You 'route-pull' in your VPN config and Get-NetRoute will list your VPN gateway IP as nexthop next to 0.0.0.0/1.
  • The VPN connection is active while you run the top script and is down when you run the script below.
  • Commands are run with admin privileges. (Only the set/remove route commands actually require them.)

Unfortunately, after a reboot or at least a reconnect, your VPN-adapter will have been assigned a new IP, but the old gateway IP is still in the adapter.

You could update it by replacing 'New-NetRoute' with 'Set-NetRoute', but I guess clearing it before OpenVPN makes a connection is more stable.

So the script before your VPN is connected:

Clearing default gateway ip:

Set-Variable vpnadaptername -Value ENTER-NAME
Set-Variable vargatewayold (Get-NetRoute -InterfaceAlias $vpnadapternam -DestinationPrefix 0.0.0.0/0 |Select-Object -ExpandProperty "NextHop")
Remove-NetRoute -InterfaceAlias $vpnadaptername -DestinationPrefix 0.0.0.0/0 -NextHop $vargatewayold Confirm:$false

Final notes. As you can see, the route command is used to edit gateway IP of an adapter, this means that if the order of the scripts is incorrect, you can mess up you route table. Your adapter could end up with two gateways for example.

Restoring normal operations can always be achieved by manually removing the IP via Networkadapter -> properties -> IPv4 --> properties --> select gateway IP and click edit or delete. Reconnecting OpenVPN will reset the route table.


Commands found: https://richardspowershellblog.wordpress.com/2016/02/22/ip-default-gateways-by-cmdlet/

https://www.vexasoft.com/pages/set-networkadaptergateway (Third party, didn't feel right, software might work but seems outdated even though the commands look perfect!)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.