openvpn SSL VPN profile force all client traffic through tunnel

I try to connect from a private network to my company with a openvpn client profile which I downloaded from the Firebox. The connection is working without problems but ALL traffic is send through this connection.
In the Mobile VPN Configuration the setting "Force all client traffic through tunnel" is not ticked. When I use the Watchguard SSL VPN Software on Windows it is working without problems.
I am using Linux/Debian and imported the .ovpn file. Did I miss something to configure?

Comments

  • james.carsonjames.carson Moderator, WatchGuard Representative

    Hi @VGBH
    Was the OVPN profile created before that setting was turned off? OVPN files are static and do not automatically update.

    If so, please try downloading and importing a new OVPN file generated by your firewall.

    All of the route information is in the OVPN file -- if your client is creating a full tunnel when it should not be, it's likely getting that route from there.

    -James Carson
    WatchGuard Customer Support

  • No, this was a new download from the Firebox and the setting was never turned on.

    All connections to internal server/clients are working. Internet requests are not working.
    When I want to open a www website, the Traffic Monitor display allowed connections to our internal DNS Server.

    Primary Allow 172.31.11.3 192.168.100.51 dns/udp 45082 53 tun0 LAN Allowed

    The next entry is a https request, which is denied.

    Primary Deny 172.31.11.3 external-ip https/tcp 50288 443 tun0 Internet-VLAN Denied (Unhandled External Packet-00)

    Config:
    remote-cert-eku "TLS Web Server Authentication"
    remote IP 443
    persist-key
    persist-tun
    verb 3
    mute 20
    keepalive 10 60
    cipher AES-256-CBC
    auth SHA256
    float
    reneg-sec 28800
    nobind
    mute-replay-warnings
    auth-user-pass
    tls-version-min 1.2
    ;remember_connection 1
    ;auto_reconnect 1

  • james.carsonjames.carson Moderator, WatchGuard Representative

    I'd suggest creating a support case by using the support center link at the top right of this page. One of our reps can help look into this.

    -James Carson
    WatchGuard Customer Support

Sign In to comment.