0

I have an OpenVPN server set up on my home network using TAP (rather than TUN) devices, such that clients that connect to the network remotely are bridged to the same subnet as my (wired) home network.

However, I have a laptop that I dock at home using Ethernet, and use WiFi for elsewhere (I try not to use WiFi at home--it's a disaster in crowded Manhattan apartment buildings). I also like having fixed IP addresses for every device on my network, so I fix the IP configuration for its Ethernet adapter, and use the same IP as well for the TAP device when connected to the VPN (using a client configuration directory on the server side).

Is there a good and minimally hack-ish way to configure the OpenVPN service on my laptop to only connect to OpenVPN when the Ethernet connection is not active? Having the OpenVPN service running in the background automatically is super-convenient and I don't want to manually have to shut it off every time I connect to Ethernet, but having it trying to connect to the same network I'm already physically on via VPN using the same IP address I'm already using is obviously not a good idea...

I'm sure I could hack something together with init scripts, but I'd like to minimize my divergence from the official Ubuntu configuration as much as possible. I'd really appreciate if it anyone could think of a more "proper" approach.

2

I played around a found a solution that happens to work for my configuration. It's not a fully general solution, so hopefully someone can come along and give a solution that's more robust.

Instead of disabling OpenVPN on my laptop when on Ethernet, I just configured ufw (Uncomplicated Firewall) on my network's OpenVPN server to reject connections from the local subnet; it's a teeny bit more complicated than just creating rules using sudo ufw allow ... and sudo ufw deny ..., though:

  • First, if you're running ufw on a machine bridging a VPN to a local network (which I am doing), you need to configure ufw to allow forwarding traffic, since it drops that by default. This means changing DEFAULT_FORWARD_POLICY="DROP" to DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw.

  • Second, you need to make sure to add rules in the right order; ufw processes rules one by one and uses the one that you reject connections to OpenVPN (port 1149) within your subnet before allowing them from outside only if you create them in that order; in my case, this meant running sudo ufw delete deny from 192.168.16.0/20 to any port 1194 (no, that's not a typo, I actually use a /20 subnet locally :D) before running sudo ufw allow 1194.

  • Lastly, you need to make sure that connections from your local network actually do look like they come from your local network so the ufw rule gets invoked.

The last part is important because initially that was not the case when I tried the first two steps; my laptop OpenVPN is automatically set up to try to connect to my VPN at mydomainname.com, which is dynamically assigned to my home router, which in turn forwards port 1194 it to the computer running my VPN at 192.168.16.1. This might not be the case for all routers, but for my router at least, connecting to mydomainname.com from within the local subnet creates a connection to the OpenVPN server that looks like it has the router's IP address, rather than the laptop's. (And it's a long story but I actually want to allow VPN access from other devices connected to the router, on a different subnet--I have a pretty complicated home setup :D).

The solution in my case ended up being to configure my router's DNS server with a static assignment from mydomainname.com to 192.168.16.1, so that mydomainname.com resolves directly to 192.168.16.1 but to my router's external IP otherwise. This works for me, but your mileage may vary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.