OpenVPN Client-to-Site routing all traffic through VPN
OpenVPN Client-to-Site routing all traffic through VPN
I just added the Omada OC300 contoller to our office network and added our TP-Link TL-R605 router to it to use OpenVPN as the VPN server.
I added the Client-to-Site VPN configuration and exported the config.
With the OpenVPN client it is possible to connect and to access resources inside our office network. However, by default not all traffic from the client is going through the VPN. When accessing the internet the client is not going through VPN, which results in some external resources ony available from our office network are not accessible through VPN because the client is using his own ip-address.
I tried adding a few changes to the VPN client-config like "redirect-gateway autolocal" but that results in no internet access at all when connected through VPN. So at the VPN-server side there needs to be something added/modified. I know that I am not the first or the only one with these kind of issues, but can not find a good solution to have all traffic from the client gone through the VPN-tunnel.
Anyone who has resolved this?
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
"Unfortunately, now the ER7206 doesn't support this function.
Upon checking with the related department, the Controller V5.8 will add this feature. And the supported firmware of the ER7206 is planned to be released on the official website at the end of the year."
This is what I got from Support when asking the same thing.
- Copy Link
- Report Inappropriate Content
@Mvdput
Requesting to add this feature as early as possible. I bought tp link particularly cause of the VPN options. To my surprise, you cannot route all traffic through the tunnel. This almost half the usefulness of openvpn and the reason why i chose tp link
- Copy Link
- Report Inappropriate Content
- Copy Link
- Report Inappropriate Content
Pretty sure I saw full tunnel support in the notes for the Windows Controller v5.8.4, unfortunately no good for me as I'm running OC200 and a Synology docker image in my world and I'm not in the mood to stand up some Windows box for a few weeks or months.
- Copy Link
- Report Inappropriate Content
A reference was made to it in the Windows 5.8.4 controller release notes:
10. Added support for the following features to Omada Gateway, which requires firmware updates to be released later. Some Omada Gateway models may not support all features, details will be listed in the release notes of new firmware.
-
Full mode for OpenVPN
However the release notes for the new ER605 V2 firmware 2.1.0 doesn't call it out:
This firmware is fully adapted to Omada SDN Controller 5.8.
New Feature/Enhancement:
-
Add support GRE function in Standalone mode.
-
Add stateful ACL.
-
Add mDNS Repeater .
-
Add support for setting port speed and duplex mode in Controller mode.
-
Add support for setting port mirroring in Controller mode.
-
Optimized the logic of judging Me in ACL. If you need to use ACL to restrict the connection to VPN client, please select Me in Destination. Please note that if Me is included before the upgrade, the client may not be able to access the Web UI after the upgrade.
-
Add support for displaying the Source IP address of large Ping attack packets.
-
Add Non-Address mode for IPv6.
-
Optimized the DNS settings on the WAN side, the WAN side cannot set the DNS Server of the same network segment as the LAN.
-
Add IP-MAC binding in Controller mode.
-
Add One-to-One NAT in Controller mode.
-
DHCP Server's DNS support for adding network addresses.
-
Add "Certificate + Account" mode for OpenVPN.
-
Add support to customize DNS server for VPN servers in Controller mode.
-
Add "Custom IP" type for Local Networks in Controller mode.
-
Add "IP Address Range" type to VPN IP Pool in Controller mode.
-
Add support for custom Local IP Address for L2TP/PPTP VPN Users in Controller mode.
-
Add RIP and OSPF dynamic routing function in Standalone mode.
Notes:
-
For ER605 v2.0 and v2.6 only.
-
Your devices configuration wont be lost after upgrading.
That said, while I've already upgraded the router firmware, I'm still awaiting the 5.8 controller for Linux to be released so I can't confirm or deny if it's an undocumented addition. For me though, I've pretty much abandoned OpenVPN anyway because the performance so awful. It's a little better running from my Synology 220+ but still not the best. Wireguard is hands down the way to go (which by the way was also called out in the controller release notes but not documented in the router firmware update). I've run Wireguard on a Pi and now running it on my Synology. And Wireguard can do full or split tunneling. On both, clients connect almost instantly and throughput is WAY faster than OpenVPN by a long shot. The highest I've been able to confirm with Wireguard so far is around 300mb. OpenVPN isn't anywhere close. In short, if you have a Pi, a capable NAS, or some random Linux system you can run it on, give Wireguard a try. There are plenty of articles on getting it running on Pi (using PiVPN) as well as Synology.
- Copy Link
- Report Inappropriate Content
Thanks for the answers. I'm still running standalone mode so I wonder if I just add the redirect-gateway to my client policy will that work.
BTW I'm on ER7206 v1.0 and v1.2.3 FW
- Copy Link
- Report Inappropriate Content
ok, this doesn't work I also don't see any mentioning of that in the latest v1.2.3 FW.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 2
Views: 8954
Replies: 17
Voters 0
No one has voted for it yet.