Is my VPN leaking or is this normal?

Question

Hi when I am not connected to my VPN and do a route print I get one 0.0.0.0 entry in the Network Destination column. It has a gateway of 192.....

When I connect to my VPN and do a route print I get two 0.0.0.0 entries in the Network Destination column. The first has a gateway of 192...., the same as above. The second has a gateway of 10.... which I'm assuming is my VPN gateway.

When I run a tracert to a website the I see the 10.... ip address followed by addresses in the VPN server I'm connecting to. All tests I have run online show only my VPN information. I cannot see my ip in any of the above steps.

What concerns me is that I see 0.0.0.0 and 192.... on both route print's whether I'm connected to VPN or not.

Is this normal behaviour or is my VPN leaking traffic?

I have seen people say to delete the route but that would force me to be connected to my VPN all the time which I don't want.

Any help??

Thanks...

Answer 1

This is normal. See the last column Metric. If there are two routes to the same destination, the one with lower Metric value has less cost and is chosen as the better alternative. On the other hand, the VPN tunnel itself needs a route to 0.0.0.0, too.

Some (Open)VPN implementations do extra measurements to be chosen over any other connections. They split the 0.0.0.0 e.g. into two halves in addition to using low metric values. As this route is more specific, it gets chosen over 0.0.0.0.

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.1.254    192.168.1.100     35
          0.0.0.0        128.0.0.0         10.8.0.1         10.8.0.5      3
        128.0.0.0        128.0.0.0         10.8.0.1         10.8.0.5      3

Likewise, you still see more specific routes e.g. for your physical networks:

      192.168.1.0    255.255.255.0         On-link     192.168.1.100    291

That's because OpenVPN's redirect-gateway doesn't actively remove routes to local networks, whereas some other full tunneling implementations go further by doing it. From the Reference manual for OpenVPN 2.4:

–redirect-gateway flags…

Automatically execute routing commands to cause all outgoing IP traffic to be redirected over the VPN. This is a client-side option.This option performs three steps:

1. Create a static route for the –remote address which forwards to the pre-existing default gateway. This is done so that (3) will not create a routing loop.

2. Delete the default gateway route.

3. Set the new default gateway to be the VPN endpoint address (derived either from –route-gateway or the second parameter to –ifconfig when –dev tun is specified).

There you could leak information through various protocols e.g. mDNS, LLMNR, NetBIOS or SSDP, but that's another story and doesn't affect the connections to the Internet through the VPN.