GL-AR300M fw 3.019 and OpenVpn

onire77 · 2019-04-01T13:41:43.414Z

Hi,
yesterday I updated the firmware from 2.7 to 3.

With the old firmware I connected as a client to a vpn network, to remotely access my router, which does not have a static ip.
I uploaded the same .ovpn configuration file, but when I start the openvpn network, it doesn’t make me surf the internet anymore, but only to the vpn. What should I do?
Thanks

alzhao · 2019-04-01T13:47:52.252Z

Logs, screenshots etc pls.

At least need to know if it is dns problem or firewall problem

onire77 · 2019-04-01T14:08:50.698Z

Thanks alzhao,
I followed this guidee and it’s working now.
Why it might has potential data leakage?

kyson-lok · 2019-04-02T04:01:24.991Z

If you modify that shell script, it will enable traffic from lan forward to wan interface, so if VPN connection is lost, all data will cross wan directly, it means data leak.

mcbsys · 2019-04-02T20:31:57.185Z

Kyson, just to be sure I understand, when you say “data leak” you only mean “data will no longer go through the VPN.” In other words, it reverts to being a normal router, allowing LAN to forward to WAN without using the VPN.

It seems there are (at least) two reasons people use a VPN:

The user wants to do private Internet browsing and/or wants their browsing to originate at the VPN destination. They might be using a public VPN service. For this user, I can see how they would NOT want to go on the Internet without the VPN.
The user needs to link two LAN networks across the Internet. This user probably controls the VPN server and client. Only the LAN traffic needs to be private so only the LAN traffic goes on the VPN. However this does not mean that LAN traffic will leak onto the Internet any more than if you use the router without the VPN feature.

kyson-lok · 2019-04-03T01:29:02.467Z

mcbsys:

when you say “data leak” you only mean “data will no longer go through the VPN.” In other words, it reverts to being a normal router, allowing LAN to forward to WAN without using the VPN.

Exactly.

mcbsys:

Only the LAN traffic needs to be private so only the LAN traffic goes on the VPN.

Yup, so we are developing routing policy function now, it can solve this situation.

onire77 · 2019-04-08T19:07:23.924Z

Thank you for the fix.

mcbsys · 2019-04-08T23:40:30.001Z

Blockquote
Yup, so we are developing routing policy function now, it can solve this situation.

Sounds promising. Please post an note here when that is ready.

I just thought of another situation where this is important: perhaps an employer asks the employee to connect to the corporate VPN from their personal device. The employee needs to access the corporate files, but the employee does not want their private Internet browsing to go through the employer’s server. Of course, the employee should turn off the VPN for best privacy, but maybe they forget, or they have a long-running task on the VPN and they want to do private browsing while they are waiting.

kyson-lok · 2019-04-09T09:20:13.009Z

Please refer this post by Alfie.

VPN policy quick guide and feedback Technical Support for Routers

Hi, If you upgrade to beta firmware 3.022 and above you will find VPN policy settings. Here is a quick guide. [image] Enable or Disable VPN policy If you enable this, all the processes on the router will use vpn. It means the router’s public IP will be VPN server’s IP. Your DDNS will be your VPN server. If you disable this, only the clients connected to the router will go to the VPN. You can choose Domain/IP based policy or MAC based policy. You can only choose one but not mixed. We tried t…

suibaf · 2019-04-14T18:32:26.805Z

Hi,
today I have installed fw 3.022 on GL-AR300M. FW 3 sure is more strong but, in my opinion and for my application it was not useful.

second my opinion che cechbox in openvpn “if no vpn connection, no internet” is usefull.
VPN policy is not complete and does not cover all conditions
the thing that helped me is the guide made available: Openvpn configuration to avoid the default redirection (all through the VPN) - #6 by kyson-lok
fw 2.27 has a gui for sms. I know that in fw 3 is installed sms3tools but it is not symple to use it.
sometimes login does not work. The gui does not recognize the password. Then with putty is necessary to restart the router and then it work.

In my opinion fw 3 is not a robust and complete version. But I love the same my GL-AR300M
Best regards

kyson-lok · 2019-04-15T03:03:32.559Z

We had removed this checkbox, it will force all traffic passthrough VPN by default.
The more conditions, the more complicated. It is hard to design a well experienced UI.
emmm
v3.x has gui for sms as well, but only show it for MIFI or X750. Because only them with LTE modem module
Not sure why. I can’t reproduce this issue.

suibaf · 2019-04-16T18:19:10.285Z

kyson-lok:

We had removed this checkbox, it will force all traffic passthrough VPN by default.

Why? it is a option!!

kyson-lok:

emmm

What do you mean?

kyson-lok · 2019-04-17T06:24:48.532Z

Because it is a way to avoid data leakage when you started VPN, if you don’t like use global proxy, you can try VPN routing policy, which I had mentioned above.
It means “Yes, if you didn’t upgrade to the latest testing firmware which supports VPN routing policy, you can try it”.