Is it possible to get "real" IP from a host machine which is using a SSL-VPN connection?

Question

We'd like to obtain the public IP of a user that connects via SSL VPN, the one that the user would have if he didn't connect that way.

But this looks impossible to do, if we use web services like the ones shown here: https://stackoverflow.com/questions/391979/how-to-get-clients-ip-address-using-javascript, when user is not connected via SSL VPN, it gives the correct IP, but once the user connects if a webservice like that is called it gives the public IP of the connected machine.

Maybe I'm missing something, that's the reason I'm asking if there's such a way, but I'm afraid there's no way to control from javascript that calling that service could be done outside of the SSL VPN connection once it's connected there.

Answer 1

In general that's a hard task, and unless there is an exploit on the VPN solution that allows someone to get the IP, I'm afraid that is not possible. Let me explain why:

Take as an example the following network diagram

UserA <------- VPN -------> VPN Service <----------------> ServiceB

In general when you make a VPN connection on the user side, all traffic is tunnel through a device (VPN device) on the UserA. Of course, you can configure the VPN client to not tunnel all traffic (for example youtube traffic, google, etc..) but in general, that's how works.

So the traffic between the UserA and the VPN service is encrypted. At this point, the UserA IP is known by the VPN Service. Then the VPN service establishes a session with a ServiceB with the IP addresses of the VPN Service, so ServiceB only has visibility on the VPN Service IP.

Even if you have a javascript on the ServiceB and that javascript is executed on the UserA, the traffic generated by that javascript will be routed through the VPN.

So the only case that I see is that there is a misconfiguration on some point of the client VPN or on the VPN Service that may be exploited by some code.

Answer 2

The client system cannot provide information it does not have.

While you don't explicitly describe the client side scenario I must assume that you talk about a client system which is some private internal network which is the connected through some router to the internet. The VPN software is running on the client system but you are interested in the public (internet facing) IP address of the router.

With full VPN (i.e. all traffic is passed through VPN) the client has no visibility of this public address and neither has the server. Any probing done from the client side to external servers (this is essentially what STUN in WebRTC does) sees as public IP only the VPN exit.

If split VPN is used (i.e. only some traffic is passed through VPN) there will be external systems which will be reached directly w/o VPN by the client and which will thus see the routers public IP. In some cases only selected IP are tunneled through VPN (for getting access to company internal stuff) but nothing else. In this case one could simply setup some external server, let the client access this server (some Javascript) and then observe at this external server from which public IP the access was done.

In other words: there is no solution for full VPN, but there is a solution for split VPN as long as you control a target server reachable w/o VPN and make the client access it.