Forward internet traffic over openvpn?

My current setup is that I have an openvpn server running at home and a client running on my laptop. The connection works (I can ssh over it) but I want to forward my (web browsing) traffic over it as well. Does anyone know how to accomplish this? I'm running KDE if that helps.

Another option would be to set your gateway to the far end of the vpn and make sure you enable routing on that box. That would make *all* traffic bound for the internet travel through the vpn. This may not be what you want.
One thing to watch with the proxy aproach is that while your web traffic is sent through the vpn, your dns lookups will stil be going through your isp making it possible to see which websites you have been to. There is an option in firefox to fix this if it bothers you.

Similar Messages

  • How can I route internet traffic over IPSec point to point?

    I have a remote site that connects by IPSEC with the end points on a router and ASA. The connection is working fine and the remote site can access my other networks at the main headquarters. The problem is, currently this remote site is accessing the internet via the same link that is supposed to VPN everything back to headquarters. I need to figure out how to VPN their internet traffic to my main headquarters. There's an IPrism behind the firewall to filter web access so it seems like I need to point the remote sites default gateway to my routing device that's behind my Iprism? 
    Also, currently the outside interface on the remote site's router does not have an ACL applied, can someone suggest what that ACl should look like? Thank you for your help! Here is a sample configuration of the remote site's router:
    crypto isakmp policy 20
    (encryption parameters here)
    crypto isakmp key password address x.x.x.x (Public ASA IP) no-xauth
    crypto ipsec transform-set remotesite (encryption parameters here)
    crypto ipsec df-bit clear
    crypto map Mainsite 1 ipsec-isakmp
     set peer x.x.x.x (Public ASA IP)
     set transform-set remotesite
     match address 100
    interface FastEthernet0/0
     description $ETH-LAN$
     ip address 10.1.1.1 255.255.0.0
     ip nbar protocol-discovery
    interface FastEthernet0/1
     description ISP Interface
     ip address x.x.x.x (public IP) 255.255.255.0
     crypto map Mainsite
     crypto ipsec df-bit clear
    ip route 0.0.0.0 0.0.0.0 x.x.x.x (ISP's default gateway)
    access-list 100 remark Access list Mainsite Access
    access-list 100 permit ip 10.1.0.0 0.0.255.255 10.3.0.0 0.0.255.255
    and other various headquarter networks...

    Hi Mark, you can modify your crypto acl to permit any any on your remote site which will make all traffic goes through the tunnel. Then on ASA you need to do hairpinning on the outside interface. This will make users on remote site to access internet via HQ. But if you do it this way the internet traffic goes straight to internet without having them filtered by your iPrism. 
    What I am not sure about is if there is a way to do it if you want those traffics to be filtered by the iPrism before going out to internet. 
    HTH

  • Dmvpn wtih backhauled internet traffic to central site

    using dmvpn,but backhauling internet traffic over dmvpn to central site for monitoring, etc.  This unfortunately has the side effect of breaking spoke to spoke dynamic tunnels.  Anyone know a work around?

    For this Scenario you can put your internet-link into a different VRF. The differences to a "normal" DMVPN-config are the following:
    interface GigabitEthernet 0/0
    description Connection to ISP
    ip vrf PUBLIC
    interface Tunnel1
    description Tunnel to Hub
    tunnel vrf PUBLIC
    ip route vrf PUBLIC 0.0.0.0 0.0.0.0 GigabitEthernet 0/0

  • Vpc bind-vrf on Nexus 7000/N7k to ensure forwarding of multicast traffic over peer-link?

    In previous vPC setups with N5k (or also N6k), I had to use the 'vpc bind-vrf' command to ensure the forwarding of multicast over the vpc peer-link, especially for receivers in in non-vPC VLANs and the receivers connected to Layer 3 interfaces.
    I am wondering why this command isn't available on N7k? Isn't this necessary on this platform or is it just not yet implemented?
    Any hint is welcome!
    Stephan Strack

    Hey Stephan,
    The 'vpc bind-vrf' command allocates a special internal VLAN for routing traffic over the vPC peer-link to ensure L3 connections on the vPC peer or orphan ports successfully receive multicast traffic on N5k/N6k platforms.  This workaround is not needed on the N7K because that platform implements the vPC loop prevention rule differently in hardware.
    In short, 'vpc bind-vrf' is not required on N7K.
    -Andy

  • Mountain Lion Server VPN unable to route internet traffic

    Hi! I have set up a VPN server on my home network specifically so that I could connect via a VPN client remotely and tunnel all internet traffic through my home network (It is a long story but I need to be able to access services that are specific to my home IP . . . ) I have been tearing my hair out trying to get it work but can not. The VPN connection happens OK and I can set up the remote client to send all traffic via VPN but any internet traffic just times out . . . In other words I can not get the server to share my home network via the VPN connection.

    Hi and thanks for taking the time to answer.
    As I am sure you have guessed I don't have much experience or knowledge with this. So I will try to clarify what I am trying to do.
    I do not need a VPN server for the conventional reasons of being able to access a private network (i.e my home network) remotely, although this is a nice additional benefit. I need the VPN server so that I can log in remotely (when I am using my mobile broadband or when I am overseas for example) and make it look like the machine I am using is on my home network.
    The reason for this is that I have access to web services that are IP specific. That is I can ONLY log in if I am logging in from my registered home IP (which is static for this exact reason).
    I have been told on similar support sites that if I route ALL traffic through the VPN, then when I use my browser on the remote machine all web traffic will go through the VPN as well and it will look like the traffic is coming from the subnet of my home IP.
    I guess in other words I am trying to use my VPN as an "anonymous" proxy (anonymous in the sense that although the traffic is coming form somewhere else, it still looks like it is coming from my home IP).
    I know this will cripple the speed due to the narrow upstream bandwidth but I am willing to pay this price.
    Now as for your questions:
    I have the server set up on a machine on my home subnet and I have enabled VPN port forwarding on the ADSL router.
    I know the connection happens as when I connect the VPN either from my iPhone using 4G or my laptop using my mobile broadband I get the "connecting . . . authenticating . . . connected" messages and when I check in properties it shows it to be connected to my home IP as VPN server and has an IP address that looks like it is on my home subnet.
    By internet traffic timing out I meant web traffic.
    As I mentioned above, I need all web traffic to go through the VPN. So indeed not ALL traffic but definitely ALL web traffic. The only way I could find to do this is to enable the "Send all traffic" option.
    Now I guess the obvious question is why am I not using a proxy. I have tried (and spent ages setting up Squid) but could never get it to "hide" the true origin of the traffic completely.
    Now having written all this, I reinstalled mountain lion and server yesterday (out of sheer frustration rather than anything else) and it seems to work this morning. So if I log in via VPN on my mobile or laptop and use an IP checker on the web it comes up with my home IP : ))
    The only thing I have now noticed is that if the VPN server stops working (which seems to be as soon as the computer I run it on goes to sleep) web traffic reverts to using the normal channels which is potentially problematic for me.
    So my questions now are -
    Any ideas what I was doing wrong in the first place?
    Any suggestions on how I could set this up better?
    Any way to set up the remote device so that it only allows web traffic via VPN (so that if the VPN connection drops, it is unable to use it's own internet connection for continuing web traffic)?
    Thanks for any suggestions : )
    Cheers

  • Understanding 5505 firewall-site to site and internet traffic

    Hi,
    My question is mutli-faceted. I apologize for the lengthy intro here but i think the info is necessary to understand where I am headed in this.
    I am new to the cisco 5505. I have had very limited exposure to a 5510 that was preset. I have managed to make modifications to it here and there, but dont completely understand how it was put together. I learn by watching, listening, and gleaning what I can from others. I have had no formal training in CLI, but I have learned some of the commands. I know enough to be dangerous, but I respect my limitations.
    That being said, I have been charged with setting up a 5505 at a remote site. I need to accomplish several things.  Our ultimate goal is to use this device as a site to site with the 5510 at the corporate office. However, I need to accomplish this in baby steps, test, test real users and then maybe convert in full. Where I could outsource this in its entirety, that would preclude me from learning so I can address this in the future on my own.
    We need to have this in place by the end of February 2013.
    Currently the remote site is connected via a very slow (by todays standards) T1 line on a MPLS. Stable. Works, but slow. All internet traffic as well as work traffic is routed through that connection. We have added a 50mb cable connection (with static ips) to the office. First we want to set up the 5505 so that it can be used as follows:
    1, Internet traffic can be routed out through this device and all other "work" traffic routed through the MPLS.
    2, Test using this connection as a route out to the internet AND use it as a site to site VPN connection to the home office. (or anyconnect vpn)
              I need to be able to have users in both environments. IE, some still using step 1 and some starting to use and test step 2.
    3, long term, use this as the main connection per number 2, but add the IP address so that if the cable connection drops, the office can access internet via the VoIP T1 line as a life line.
    In all cases, I dont want internet going through the home office as it currently is traveling.
    I have done a lot of searching but so far have come up empty with answers.
    Question 1:     (This one probalby shows my ignorance the worst) - in using the 5505 firewall, will it segregate normal internet traffic from the VPN traffic when used by the workstation? Using the Gui, I didnt see where this was necessarily happening. Do I need to use CLI language (and what) to make this happen? Or is that a basic function that happens during the setup of the firewall using the GUI. Do I need to do some sort of "split tunneling"?
    Question 2:     Do I use this device as the Default gateway for both step 1 and 2/3) for normal use and then change the gateway on the Pcs to the VoIP network during emergency use,(that would bypass the firewall though or is there a way to have it route to that router if there is no connection through the Outside port? Or as long as I have some access to the device, can I make a change remotely to help accomplish this failsafe?
    Question 3:     We have 25 Anyconnect VPN licenses. Should we use these and not the Static site to site, if so, why or why not? They dont need to be used at all.
    Question 4:     In setting up the VoIP line for backup, would using that on the "DMZ" connection help in making this viable so that the device could still ultimately control the internet traffic?
    Question 5:     In setting up the VPN connections, unless i am getting the two methods confused, I will need the 5505 to hand out IP addresses for the vpn connection. I see in using a class c schema that i can use 92.168.0.0 to 192.168.255.0. So for instance, I could use 101.1.20.0 for the inside network Vpn addresses?? I need to stay away from 192.168.0.0 networks as we use that in our normal structure.
    Reasons for setting this up:
    Slow speeds over the T1.
    increasing demand for Skype, Video conferencing etc that the T1 pipe couldnt adequately handle
    Lack of backup pathways for downed connections - ie, backhoe chopping through wire at a construction site).
    I read through the Getting started guides on both the 5510 and the 5505 and feel I can likely get the site to site setup (I have a list of all the Ip addresses i need for inside networks and outside networks etc.
    additional notes:
    I have to email ATT anytime I want a change made on the MPLS router, so doing as little to that as possible would be good.
    I will be onsite for testing at the end of February  and will have direct access to the home office via other methods to work on the asa5510 if any additional work needs to be done on it once i am onsite.
    Thanks for taking the time to read through all of this. please forgive my lack of knowledge...
    Dave

    Thanks for getting back to me and so quickly!
    1) I am not sure if I understand the “ACL” portion of your question, but this is how I want to access info via the VPN tunnel:
    192.168.D.0 inside(NJ) to outside 5505 - 12.175.X.X to outside 5510 - 12.200.X.X to inside network (HQ)192.168.X.0. Routes are needed to find subnets 192.168.A.0, 192.168.B.0 and 192.168.C.0. The default gateway to those subnets right now is: 192.168.X.XX4 inside of HQ. This would be so that the NJ office could find resources of the other offices if needed. This will change as we wean off the MPLS. Inside the ASA 5505, the IP addresses are 192.168.D.0 for data, 10.X.X.0 for the Phone system. All other traffic would be sent out through the internet. Phone system uses the XOcomm conection to route phone traffic.
    2) I did some reading on SLA. Thanks for pointing that out. For purposes of learning here, I am showing this as 12.175.XXX.XXX for Comcast and 12.200.XXX.XXX for XO comm.
    4) I guess I would use an Outside 2 as that makes sense, in description, I would label them “ComCast” for outside 1 and “XOcomm” for outside 2.
    5) I am still not sure I understand this part. Are additional IP addresses needed for the Site to site VPN to talk to the local hosts, or will it use the IP addresses assigned by the local server?
    Next Steps
    1-         Configure the ASA5510 for the 5505 connection
    2-         Configure the ASA5505 for the 5510 connection
    3-         Configure SLA for Comcast and XOcomm outside connections
    4-         For this I need help….I think this is from step 1, but I need help to configure the internet to be segregated via my question from #1. Have I given enough information to do so? Please advise on ACL entries, and route statements needed so that NJ can talk to all the offices when using this connection, not just the Headquarters.
    Thanks
    dave

  • Best way to pass IPv4 and IPv6 traffic over a GRE Tunnel

    Hello,
    We have two 3825 routers with Advanced Enterprise IOS 12.4.9(T). Each of them serves many IPv4 (private and public) and IPv6 networks on their respective site.
    We have created a wireless link between the two, using 4 wireless devices, with IP Addresses 10.10.2.2, 3, 4, 5 respectively (1 and 6 are the two end Ethernet interfaces on the routers).
    Then we created a GRE tunnel over this link using addresses 172.16.1.1 and 2 (for the two ends) to route traffic over this link.
    Now we want to route IPv6 traffic over the same link. However, we found that simply routing the IPv6 traffic over the above GRE / IP tunnel did not work.
    Questions:
    Is there a way we can use the same (GRE / IP) tunnel to transport both IPv4 and IPv6 traffic?
    If not, can we setup two GRE tunnels over the same wireless link, that is, one GRE / IP for IPv4 traffic and a second one GRE / IPv6 for IPv6 traffic?
    In brief, what is the suggested way to transport IPv4 and IPv6 traffic over the aforementioned (wireless) link?
    I have read http://www.cisco.com/c/en/us/td/docs/ios/12_4/interface/configuration/guide/inb_tun.html#wp1061361 and other Internet material, however I am still confused.
    Please help.
    Thanks in advance,
    Nick

    We have set up two tunnels over the same link, one GRE / IP for the IPv4 traffic and one IPv6 / IP ("manual") for the IPv6 traffic. This setup seems to be working OK.
    If there are other suggestions, please advise.
    Thanks,
    Nick

  • Encapsulate ODBC traffice over HTTP???

    Does anyone know if it's possible to have an external client (in the internet) make an ODBC connection to a database that is behind a firewall which only allows HTTP traffic to pass through? I guess the question is, Is is possible to encapsulate ODBC traffic over the HTTP protocol so that it can pass through the firewall?
    Thanks in advance,
    John Sebastian

    Probably not easily, no.
    If the firewall allows arbitrary traffic on port 80, you could configure the Oracle database to accept connections on that port and configure the tnsnames.ora on the client machine to use port 80. This wouldn't go through HTTP, so if the firewall is actually analyzing the traffic, you'd be out of luck, but it would work if the port is wide open. Of course, it is a terrible idea from a security perspective-- opening up databases to connections over the internet is a recipe for pain and suffering.
    It is certainly possible to write an ODBC to HTTP proxy that converts an ODBC call into some sort of web service call and then write an HTTP to ODBC proxy that lives inside the firewall that translates the HTTP calls back into ODBC calls, but that is likely to be very slow. And a lot of code-- I'm not aware of any commercial utilities that do that sort of thing.
    Generally, the proper way to do something like this is to use Oracle Connection Manager (or something similar that is baked in to certain firewall products) to proxy the Oracle connection through the firewall. But that requires changing the firewall setup and/or installing additional software.
    Justin

  • How to redirect Internet traffic from RV082 to RV042 through a VPN Tunnel??

    Fellows,
    We have offices in USA and Venezuela.
    In our USA office we have a RV042 router and in Venezuela we have a RV082 router.
    We have connected a VPN tunnel (gateway-to-gateway) between both offices.
    The point is:
    How   could we redirect the internet traffic from our Venezuela office   (RV082) to the USA Office (RV042) to navigate using USA public IP's?
    The   reason for this is that we need to use online streaming services which   are only available for IP's from USA and we can't use them from the   Venezuelan IP's.
    We  can not use the PPTP option since the  equipment which will use the  streaming services (like hulu, crackle,  etc.) in Venezuela is a Google  TV device which doesn't allow the  configuration of proxy navegation or  PPTP VPN connections itself. That's  the reason why we need to do that  through the routers.
    We will really appreciate your support on this matter.
    Daniel

    Hi Daniel, this is called ESP wildcard forwarding which the router does support.
    https://supportforums.cisco.com/docs/DOC-12534   <- This is older but applicable
    https://supportforums.cisco.com/message/3766661
    -Tom
    Please mark answered for helpful posts

  • Windows VPN internet traffic handling

    So at work, I installed Windows 2012 R2's built-in VPN server. I can connect to it from home (using Windows 8.1), but I noticed that when the VPN connection is enabled, all internet traffic that would normally go to my local gateway is now going into the VPN line to my office's gateway and thereby going through my office's firewall. So my home browsing activity is being transacted as if i'm in the office.
    I'm about to roll-out the VPN to the rest of the office but want to see if there's anything I can do to change this behavior. The SonicWall NetExtender VPN doesn't do this.
    This topic first appeared in the Spiceworks Community

    Hi Ross,
    You can do this in several ways:
    1. If your proxy is to be configured on the computer browsers (like ISA proxy), then simply add the traffic from the PCs to the IPs of the proxy to the VPN ACL and to the nonat (with deny).
    2. Add all traffic over VPN from the user subnet. At this time you can remove the NAT commands all together since no NAT is required anymore. You can use this even if the proxy is something like Websense that works by sniffing the traffic.
    Please rate if this helped.
    Regards,
    Daniel

  • Internet Traffic Even When Mail And Safari Shutdown?

    I have just noticed that my SurplusMeter is detecting slight internet traffic even with Safari and Mail shutdown.
    I have, of course, Surplus Meter open, together with ClamXav.
    The Bytes Up and Bytes Down fields jump a few hundred every 5 seconds or so and when timed, the meter moved by 0.1MB every 4 minutes.
    This would represent about 1.5MB per hour and over 20MB per working day (8am to 11pm) which I would have noticed before as I frequently use less than 10MB per day.
    In the past I have come back to my meter after hours and it hasn't moved.
    Any ideas what might be causing this slight trickle of activity?

    I have just noticed that my SurplusMeter is detecting slight internet traffic even with Safari and Mail shutdown.
    I've never used SurplusMeter, but if it's like any of the other bandwidth monitoring tools I've seen it's not watching your internet traffic, it's watching your ethernet traffic.
    There is an important difference. Even if the only device on your network is your Mac and your router there will always been some background noise.
    Amongst other things, ethernet uses ARP - Address Resolution Protocol - to map IP addresses to physical devices on the network. It does this by sending out an ARP request for any device the machine needs to talk to. For example, if your Mac has the IP address 192.168.1.2 and a default router address of 192.168.1.1 then it will send out an ARP request 'hey! where is 192.168.1.1', to which the router will reply "hey! I'm over here'. That's two packets of data, even if there is no other activity or device on the network.
    IIRC, ARP replies are cached for 5 minutes after which the OS sends out another ARP reply to update its ARP table, which ties in exactly with the interval you're seeing.
    I'd further guess that 0.1MB is the smallest unit of measurement that SurplusMeter reports, so even the 28-byte ARP request and play packets get reported as 0.1MB
    Furthermore, by definition, ARP is limited to the local network and never transmits over your ISP link, so it's not going to count towards any bandwidth usage limits.
    So this isn't likely to be anything to worry about. You can confirm this with any of the ethernet sniffers, or even just a simple tcpdump in Terminal.app

  • How can i use an existing vpn connection without using the option "Send all traffic over vpn connection"?

    I have been trying to get my computer (os x.7) to astablish a remote desktop connection to my work computer via a vpn tunnel. In fact I have just discovered that it works fine if i select to "send all traffic over vpn connection" from the options in the advanced setup of the vpn.
    If the option is selected microsofts "Remote desktop connection for mac" works just fine. However without selecting the option it is not taking advantage of the tunnel but tries to connect as if the tunnel would not exist.
    Now the question is how do I get program to use the vpn tunnel without checking the above option?
    Thanks for any hints and pointers.

    Then can her computer be authorized to both accounts?
    Absolutely. You can authorize any given computer to up to five iTunes Store accounts.
    If purchases are made on her account, to a computer authorized to my account, can I put those songs on my iPod?
    If you connect your iPod to her computer, yes. Tracks download only to the computer from which they're purchased, regardless of which iTunes Store account is used for the purchase. Or you could copy the tracks from her computer to yours and then authorize your computer to her iTunes Store account. But that's sort of defeating the original purpose, it would seem to me.
    is it better to buy music through Amazon downloads and/or actually purchasing CDs to avoid the security features iTunes puts on its music?
    That's certainly an option. If it's an entire album I want, I buy CDs. That way I can import them at the quality I want and to whichever of my systems I want. Amazon or one of the other download stores that offer tracks as MP3 are also an option, though for me download stores are best when you just want a couple of tracks off a given CD.

  • How to get JSP to forward a request over SSL?

    I'm new to JSP and servlets, although I've been working with Java for a long time. I'm trying to write a simple user registration and login system to teach myself JSP. I would like to set things up so that the user is able to login securely over https. I'm not sure how to do that, though. There seems to be no place in the relative URLs to indicate that you should be forwarding a request over SSL. I've got sample login page below - would anyone know how to modify it so that it happens securely?
    Also, do I need to install a certificate on my web server?
    index.jsp
    <html>
        <body>
            <h1>Index</h1>
            <a href="login.jsp">Login</a>
        </body>
    </html>login.jsp
    <%@page contentType="text/html" pageEncoding="UTF-8"%>
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
       "http://www.w3.org/TR/html4/loose.dtd">
    <html>
        <body>
            <h1>Login</h1>
            <jsp:useBean id="userLogin"
                         class="com.kitfox.webrpg.UserLogin"/>
            <jsp:setProperty name="userLogin"
                             property="*"/>
            <%if (userLogin.isValid()) {%>
            <jsp:useBean id="userId"
                         class="com.kitfox.webrpg.UserIdent"
                         scope="session"/>
            <jsp:setProperty name="userId" property="*"/>
            <jsp:forward page="index.jsp"/>
            <%} else {%>
            <form action="login.jsp" method="post">
                <fieldset>
                    <legend>Enter login information</legend>
                    <label for="login">Login</label>
                    <input type="text" name="login" value="${userLogin.login}"/> <br/>
                    <label for="password">Password</label>
                    <input type="password" name="password"/> <br/>
                    <input type="submit" value="submit">
                </fieldset>
            </form>
            <%}%>
        </body>
    </html>

    <security-constraint>
    <web-resource-collection>
    <web-resource-name>Secure Login</web-resource-name>
    <url-pattern>/login.jsp</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
    </security-constraint>
    This code is used basically for different authentication type . Forward to any jsp under any layer works with <jsp:forward> or else try with request.getRequestDispatcher(" url (can be absolute or accurate path)").forward(request,response);
    Edited by: user8483670 on Mar 13, 2011 9:46 PM

  • Unable to receive internet connection over wifi connection.  Shows that I am connected to the network, but do not have internet access.  Checked my firewall and turned it off.  What else am I missing or should be doing differently?

    Unable to receive internet connection over wifi connection.  Shows that I am connected to the network, but do not have internet access.  Checked my firewall and turned it off.  What else am I missing or should be doing differently?

    You might want to try resetting your router and your modem - just unplug the cords, leave them unplugged for about 3-5 minutes and then replug the modem and then the router in that order.
    This may or may not correct your problem - call back if it doesn't.
    Clinton

  • How do I get the internet traffic to come to my own server?

    If I'm moving from paying a host for coldfusion to using my own license on my own server, How do I get the internet traffic to come to my own server?

    You connect the computer to a network.  This is pretty much automatically handled by the hardware and the operating system.
    You may want to read up on some of the basics of networking and the tcp/ip world.
    To have a networked computer tell you its IP address type 'ipconfig' at a dos command line.

Maybe you are looking for