"Whole-Network VPN" without a DIY router?

Hey, apologies if I’m lacking a bit of knowledge or have incorrect assumptions here.

I want to do something similar to L1T’s “Whole-Network VPN” and routing where most of my traffic goes through my VPN but I’m able to specifically exclude certain objects, or potentially have things go through a different server (location) provided by my VPN.

(I may be linking to the wrong L1T videos, but I remember watching through one where Netflix is set to have one VPN behavior to accomodate their restrictions, some things on the network are blocked off, and most other traffic just goes through a VPN ‘normally.’)

I don’t have a DIY router. I’m not necessarily opposed to it, I just haven’t really justified the cost. Perhaps this convenience is enough to motivate me.

  • Most of my traffic, I’d like to just use my VPN’s nearest server.
  • I want to have convenient access to tweaking rules so that I can allow ping-sensitive games, etc, to bypass my VPN.
  • Some things, I might want to send through a specific server or location with my VPN provider. I’m outside of the US, but I might want some of my traffic to appear as if it’s there.

Is there a way to make my (Windows 10) desktop manage this stuff on its own? Or, do I need to get a dedicated router capable of managing this?

@zovc: yes, you can turn your windows 10 into a router, just need to be able to configure it for routing, and tell other hosts to use it as their gateway (e.g. using DHCP). Naturally, when you turn windows 10 box off, or while it’s rebooting, other hosts on your lan that rely on it for internet access will not be able to access the internet through it.

Instead of using windows 10 as a router, you could also use a VM on your windows 10 box with pfsense or openwrt inside - same reboot/power off caveats apply but it might be easier to setup network filtering and policies using Linux/BSD firewalls than it is on Windows.

@RobiN0963 - give it a try.

1 Like

Do you have any leads on configuring my Windows 10 machine to take charge of DHCP for its own traffic? Or how to route to specific VPN servers? I normally just use my VPN provider’s client to either be connected to them or not.

Internet is full of useful stuff and also a bunch of people talking out of their … dunno, you could look at “eli the computer guy” videos that explain ethernet switch/hub and subnetting as a start, and maybe find some free youtube CCNA training videos if you have more time.

If you don’t, here’s a crash course.
You don’t need to use DHCP, you can always type addresses in manually. DHCP gives you 3 basic things:

  • tells your computer what your computer ip and subnet mask should be - from which your computer will be able to tell what things are on the same local network.
  • tells your computer of a gateway ip address, which identifies a target where your computer will send everything else not on the same local network. (gateway ip has to be on the local network).
  • DNS is the service used to translate hostname<->ip address, obviously generally useful for browsing and other stuff.

You can configure all of these by hand for each of your interfaces in network properties and thus not use DHCP if you don’t want to.

Specifically, way this first thing works is …
…when you look at the ip address and subnet mask, all bits in your ip address, that have 1 in the subnet mask, are all the same on all hosts in your network. Additionally, in the subnet mask, all left bits are 1s, all right bits are 0s, because of that ip/subnet mask is frequently written down as ip/number_of_ones. For example, configuring the interface with ip/netmask of 192.168.1.101/25 will tell your computer that 192.168.1.1-192.168.1.127 are directly connected to it, and it needn’t bother the gateway (you can find ip address calculators online that illustrate this, or you can do a bit of pen and paper math).

Way second thing works is via routing tables, most hosts will only have one way to reach the internet, and some stuff on the same local switch (or a router that just happens to have a switch built-in where hosts on the same subnet are connected, and a wifi access point that’s basically like a wireless ethernet switch).
Because there’s only local lan/internet these routing tables are very simple.
Typically they’d look like:
192.168.1.0/25 on ethernet_interface_1 (locally connected)
0.0.0.0/0 via 192.168.1.1 (default gateway route)

When your computer needs to send a packet out, it looks up in the routing table, and picks a route that matches the destination ip address (the most specific one).

You might also find 127.0.0.0/8 in your routing table which is just always there traditionally as a “loopback” route if a host wants to talk to itself via IP… (turns out it’s useful for some things).


VPN interfaces, if you’re referring to typical providers, aren’t configured through DHCP. But there will be interfaces and addresses and routes and in your routing table there might be multiple ways of reaching the internet over multiple interfaces. Most VPN providers give their clients skinned OpenVPN software (skinned with the VPN company logo and scripts and some on/off toggle buttons maybe with animations, maybe an auto updater) and OpenVPN will use the existing network to establish a network connection to their service, and will then run a script your VPN provider configured to setup routes and IPs on your windows host. Naturally you don’t have to use your VPN providers apps and can use VPN with your own config instead - they even provide documentation on how to do this, it’s often the only thing they support for non windows hosts.

Maybe you should go and look at some of that other basic networking stuff and let that sink in first (or CCNA if you’re really interested) and come back if you have more questions? There’s a gazillion ways these things can be configured, any particular individual guide might be glossing over a bunch of detail that’ll likely make it not work for you - having some networking knowledge might help you follow along and troubleshoot particulars of your setup if/when you get stuck.

2 Likes

Thanks for that thorough post. I know most of what you covered with the first two points on a “high level” (that is, not necessarily very deep knowledge) and I assumed that’s how the Windows (etc.) clients for VPN providers work.

But, what I don’t get is how to end up in between what he VPN provider’s bundle of OpenVPN does and how my network normally behaves.

I’m not intimately familiar with pfSense, but I am under the impression it can be configured to route different “kinds” of traffic (games, netflix, ad/telemetry requests…) to different destinations/VPNs.

That said, it looks like I might be moving within the next few months so after that it might make sense to configure a fixed router for the entire LAN.

You can search for the config files that the bundle installed on your windows system and simply read them, they’re plain text files (or they’re generated and don’t exist). You can also look at your VPN provider website for OpenVPN configs. How configs look like is documented on OpenVPN wiki and in the man pages.


https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

Same principle as on Linux (firewall/connection tracking/packet marking and rule routing based on marks) but different ui (e.g. it’s similar to mwan3 on openwrt). Recognizing different kinds of traffic before the connection is even established is usually the hard part.