Alternative to the function Force VPN (No Internet if VPN is not connected) on AR750S

rk47 · 2018-11-20T23:04:06.296Z

alzhao:

It does this by default.

This does not seem to work in beta firmware 3.005 on AR-300M. If the OpenVPN server is reset or drops the connection, traffic proceeds without encryption.

packer009 · 2019-01-08T18:49:04.175Z

Has this issue been sorted I only ask as im a newbie and also want the option for force VPN ( No internet if VPN is not connected

glitch · 2019-01-08T19:08:04.496Z

Yes, fixed in latest test firmware…but you have to first click “connect” in VPN menu.

packer009 · 2019-01-08T19:17:02.423Z

Thanks but I dont see a connect in the vpn menu ,I only see status and mangaement

I am using an open vpn client

sorry im new at this

glitch · 2019-01-09T10:14:51.215Z

Have you uploaded the VPN config file(s)?

Anyway, sound like another +1 for bringing back the “force” checkbox!

NeoxHC · 2019-04-16T07:48:51.366Z

I am reading this thread and can confirm this feature is exactly what I need as well. Do not allow any internet connection in case VPN is down/fails … where we are here? Using OpenVPN on 3.012 and cannot see the option. Thanks in advance!

NeoxHC · 2019-04-17T06:47:44.050Z

Hi glitch - is that confirmed? As I can’t see the way to do it even after connecting. thx!

kyson-lok · 2019-04-17T09:28:08.778Z

You can check out this post.

Openvpn configuration to avoid the default redirection (all through the VPN) Technical Support for Routers

We had disabled LAN forward to WAN when OpenVPN is started, to avoid data leakage. In your usage scenario, you have to ssh to the router, and edit the file /etc/init.d/startvpn and /etc/vpn.user. Please delete or comment on those lines, and restart the VPN client, but it might has potential data leakage. [image] [image]

NeoxHC · 2019-04-17T09:54:26.543Z

Thanks for your reply Kyson-lok. I checked the suggested thread however I am not sure this resolves my point totally. fine to stop leakes once VPN is started, but what if VPN drops? packets will go to WAN with no encryption? How can avoid no internet if no VPN is connected?

kyson-lok · 2019-04-17T09:56:24.274Z

It is the same, if you edit those files, it will enable data traffic forward to WAN interface from LAN, so if VPN connection was lost, the router still be able to access the Internet.

NeoxHC · 2019-04-17T10:03:22.171Z

what I am trying to achieve is: if VPN connection was lost, the router DOES NOT allow ANY access the Internet to ANY client on the LAN.
No VPN means no access to internet, all traffic from LAN is blocked

kyson-lok · 2019-04-18T01:48:19.159Z

It is the default case.

If VPN was lost, all LAN devices cannot access the Internet.

NeoxHC · 2019-04-18T06:30:26.335Z

Thanks for the clarifications.
Let me comment the two lines from the first screenshot and also all the ones in the “load default rules” if routine and confirm.

NeoxHC · 2019-04-18T07:34:16.699Z

Unfortunately, it is still not working, access is given when VPN is disconnected:
to double check I did things properly,

1st file - edited as per directions in picture above.

2nd file, I did comment what suggested, I am only missing last line in the second picture, where I have the following:

ovpn_main() {
local ip
local host
local enable
eanble=$(uci get glconfig.openvpn.enable 2>/dev/null)
[ “$eanble” = “1” ] || return

       # Load default rules
       #if [ "$INTERFACE" = "ovpn" ]; then
       #             # add default rules and force to main table
       #             [ -z "$(ip route list | grep -E "0.0.0.0/1 (.*) $DEVICE" 2&gt;/dev/null)" ] &amp;&amp; {
       #                           ip route add 0.0.0.0/1 dev $DEVICE 2&gt;/dev/null
       #                           ipset add mwan3_connected_v4 0.0.0.0/1 2&gt;/dev/null
       #             }
       #             [ -z "$(ip route list | grep -E "128.0.0.0/1 (.*) $DEVICE" 2&gt;/dev/null)" ] &amp;&amp; {
       #                           ip route add 128.0.0.0/1 dev $DEVICE 2&gt;/dev/null
       #                           ipset add mwan3_connected_v4 128.0.0.0/1 2&gt;/dev/null
       #             }
       #fi

       host=$(uci get glconfig.openvpn.host 2&gt;/dev/null)
       [ -n "$host" ] || return

       ip=$(echo $host | egrep '[0-9]{1,3}(\.[0-9]{1,3}){3}')

       [ -n "$ip" ] &amp;&amp; {
                      refresh_route $ip
       }

}

NeoxHC · 2019-04-18T08:29:16.847Z

yes, and I see so many of us asking to re-introduce this capability since long time, any plan to do it? as it is unfortunately is useless as I need to be 100% sure all data are sent via VPN or blocked if VPN is not available, whatever the cause is. Any plan to do it? shall I revert to an older firmware supporting this? what is your advice?

alzhao · 2019-04-18T10:15:03.275Z

In the old firmware, you also need to have a vpn profile first in order to “force vpn”. This is the same as new firmware, which you need to have one vpn profile and click “connect”.

I assume you want to have this feature even when there is no vpn profile upload to the router, right? This seems interesting and maybe we can add.

NeoxHC · 2019-04-18T10:42:39.050Z

Actually for my case it would be enough to have it when an existing VPN profile is available, as I have one. I click on connect and I “assume” VPN is always up. But we know how things work and that VPN can be disconnected at anytime; when this happens, I do not want to have any traffic by anybody from the LAN to internet. This is my use case.

alzhao · 2019-04-18T13:31:35.918Z

This is what the current firmware doing by default, isn’t it?

NeoxHC · 2019-04-18T14:03:12.244Z

No. The behaviour I am experiencing is that even when VPN is down connection to internet to LAN devices is allowed

alzhao · 2019-04-18T14:13:52.693Z

Can you restate which model you are using? In firmware 3.012 it should not happen.

Did you try to reset the firmware and try again? Don’t modify the script as this is the default behavior.