How to Route Traffic in Case PPTP Remote Client is on Same Subnet as Server

Question

I've a PPTP server setup on my local home network (192.168.1.0/24, pfSense). Now sometimes when I'm away and want to connect remotely my client (Windows 7) is also on the same network because e.g. the hotel has set it up the same way. Thus the connection works, but I can't reach any PC on my home network because everything is routed directly to the client local router which is in the same subnet.

Is there a way to work around this by messing with a configuration or adapting Windows routing table, i.e. without modifying either network?

Solution 1

I'm afraid not. If you were able to route somewhere else traffic directed to (what appears to be) your local subnet, you wouldn't be able to reach your gateway which is sitting exactly in that subnet, so routing would just cease to work.

Your only option here is to change the subnet you're using on your home network to something a little more unusual, hoping you'll never find a network which uses the same one.

Luckily, network administrators really don't have a lot of imagination when it comes to defining subnets: there are some of them which are by far the most common ones and 192.168.0.0/24 is a prime example of that (alongside with 192.168.1., 192.168.42. and various subnettings of 10.), but you can safely bet 192.168.247.0/24 will not be used on 99% of the networks you encounter (unless someone else reads this answer, of course). For some reasons, also 172.16-based subnets seem to be quite unpopular.

Solution 2

There is a way by defining a new route for a sub net to use explicitly the VPN / PPTP interface IP and give it a high priority.

On Windows I'm using

route add 192.168.1.0 mask 255.255.255.0 192.168.1.XXX metric 1

for my VPN in case I'm on the same sub net as the venue. XXX is your VPN / PPTP IP.

The only drawback is that all traffic is routed via your VPN, so you don't have a dedicated line to the internet or local LAN, all traffic must be routed through your VPN and your VPN server side setup must take care of allowing access to the internet via VPN. (AFAIK this is the default setup for security on most VPNs anyway)

Comments

[Geoffrey]

I am doing this by using shorewall's routeback option in shorewall-interfaces, it may point you in the correct direction.

[Zoredache]

I am using 192.168.247.0 on my system. Or more accurately Vmware Workstation randomly picked that as one of the networks it would use for guests.

[Massimo]

You probably already know this, but it can be changed, if needed.