0

I use OpenVPN, it installs a TAP network adapter, I set its location to public and set all other network adapter locations to private. in Windows Firewall, blocked incoming and outgoing connections for domain and private, only public profile has outgoing connections open. created Firewall rules for all OpenVPN executables to be allowed for any/all profiles. so far so good, my kill-switch configuration works, OpenVPN connects. but then I decided to remove private and domain from all Firewall allow rules, using PowerShell, except for OpenVPN's executables, to make sure no Windows built-in component can use Internet when OpenVPN is not connected.

now my computer is connected to my WIFI router but OpenVPN can't connect, looks like one of the Windows Firewall allow rules need to be able to make connection over any network/profile and bypass OpenVPN in order to provide Internet connectivity, but I don't know which one it is.

can anyone help me find that out or does anyone know which Windows Firewall allow rule is absolutely necessary for Internet connectivity? I use Windows 11 latest version.

Improve this question
4
  • Well, if openVPN uses a host name like server.domain.com, then you'll need outbound DNS to work, for example. The correct way to troubleshoot is to enable windows firewall logging, and see what gets blocked when openvpn tries to connect
    – Cpt.Whale
    Commented Oct 24, 2022 at 19:56
  • So nothing from Network Discovery group is necessary? and the DNS you are referring to are the mDNS rules in Windows Firewall? or is it Core networking - DNS (UDP-out)?
    – user1737559
    Commented Oct 24, 2022 at 20:03
  • Typically, "Core networking - DNS (UDP-out)" would be required. Most other network connections would come from the openVPN process. The only way to be sure is by checking the logs though
    – Cpt.Whale
    Commented Oct 24, 2022 at 20:27
  • Thanks, will check the logs, so far figured out I have to allow Core Networking - Dynamic Host Configuration Protocol (DHCP-Out) so that my computer can get local IP from the router, otherwise i have to set local IP myself which is fine too.
    – user1737559
    Commented Oct 24, 2022 at 21:09

0

Reset to default

You must log in to answer this question.