Open VPN Client Settings (Redirect Internet Traffic)

[Capmdiged]

Hi Team,
I've been using Merlin for a few years now and its been a great f/w package. I've got a quick question in regards to OpenVPN settings for 2 x VPN's.

Ive setup "Client 1" VPN1 to go to "LOCATION1" and set "REDIRECT INTERNET TRAFFIC" to "policy rules strict" for "IPADDRESS1" so only IPADDRESS1 uses the VPN tunnel and has been working great (kill-switch works great as well - Block routed clients if tunnel goes down") .

I have recently setup "Client 2" VPN2 to go to "LOCATION2" and set "REDIRECT INTERNET TRAFFIC" to "policy rules strict" for "IPADDRESS2" so only IPADDRESS2 uses the VPN2 tunnel.

From what I can see, this is what is happening

CLIENT 1 ONLY active - Only IPADDRESS1 is traversing the tunnel VPN1 as per design, all other traffic is using normal internet

CLIENT 1 + 2 active - ALL Traffic goes thru VPN1, regardless if it is in the policy or not.

CLIENT 2 ONLY active - ALL traffic, regards of policies are using normal (No VPN1 or VPN2) internet.

Im a bit of a newb in regards to linux so assistance would be greatly appreciated

 

[Capmdiged]

Hi All,
Issue has been resolved.
It appears the issue arises if you use the same cipher for each VPN connection. I changed the VPN cipher for each VPN client and all the issue are resolved

 

[Xentrk]

Hi All,
Issue has been resolved.
It appears the issue arises if you use the same cipher for each VPN connection. I changed the VPN cipher for each VPN client and all the issue are resolved

That seems strange. I'll test it out on my router tomorrow to see if I can duplicate.

Do you have static IP addresses assigned for your clients in the LAN (LAN-DHCP Server Tab)? I would consider it a requirement or best practice if using Policy Rules for OpenVPN Client.

 

[RMerlin]

You probably didn't just change the cipher - I bet you also changed the server. Using two tunnels with the same server will cause a conflict, as they would both use the same subnet. Changing server probably put the other client on a different subnet.