Bridging local adapter and VPN adapter

[ScottForum]

Are there any performance or security issues in bridging local adapter with VPN adapter? VPN is an external service provider.

 

[bill001g]

Security wise just having the VPN to a point exposes the internal network. Not sure you will be able to actually get it to bridge. Most VPN are based on IP addresses so even if you were to get the bridge commands to work the ip would likely not pass correctly. The vpn would not forward arps and other broadcast traffic so it hard to say how useful it would be. A method to bridge a ethernet port over a vpn is actually called L2TPv3. This is a completely different type of vpn that lets you connect lans over a routed network.

 

[ScottForum]

Security wise just having the VPN to a point exposes the internal network. Not sure you will be able to actually get it to bridge. Most VPN are based on IP addresses so even if you were to get the bridge commands to work the ip would likely not pass correctly. The vpn would not forward arps and other broadcast traffic so it hard to say how useful it would be. A method to bridge a ethernet port over a vpn is actually called L2TPv3. This is a completely different type of vpn that lets you connect lans over a routed network.

Thanks @bill001g. I'm using Viscosity's Virtual Adapter to connect to my VPN service provider. I've been successful in bridging this adapter to my local adapter.

Maybe there's another way to reach my end-means. The reason I bridged them is because I could not reach my main PC via hostname. Internally, I make connections fine, but not from outside my network. I've forwarded ports in router, etc. The only thing that works is bridging adapters. It could be due to the VPN adapter using a different internal IP?

 

[ScottForum]

Did you have proper DNS setup and did you have your external PC pointing to the right DNS?
What exactly are you trying to achieve?
why don't you configure a static DNS that points to your internal DNS IP on you VPN interface ?

Thanks @sajidali27. I have part of the problem figured out...I can't forward traffic to my PC over the VPN IP.

I received a response from the Viscosity virtual adapter dev...

Your dynamic name service provider will have an application running on your PC which regularly reports back your public IP address (that of your ISP) so when you use your host name external to your network, the request is sent to your router and then onto your home PC.

The issue when you connect to a VPN Service Provider is your external IP changes, so your dynamic IP is being reported to your Dynamic Name provider is your VPN Providers. When you then use this DNS name, it is instead pointing to your VPN provider which will be blocking traffic from going into their network for their users security, instead of that request landing at your router.

So there are one of two reasons that bridging your network adapters is working:
1. Your VPN Provider has no firewalls in place and you are being given a public IP address visible to the Internet. When you hit your VPN Provider IP with your dynamic DNS, traffic is getting passed through. This is highly unlikely though and is still a big security hole to leave open.
2. When you bridge the connections, it is probably destroying all the routing that is pushing your data to your VPN Provider, meaning even though your VPN Connection is active, most likely it isn't actually doing anything and all your traffic is going to the Internet as if you were not connected at all.

So you have three options to resolve this issue so you don't have to use bridging:
1. Use another PC on your network that doesn't use VPN or your router (if it has the capability) to report your public IP to your Dynamic Name Service. Some providers also have apps for phones or tablets which you can use to send an update only when required.
2. Setup routing so the application reporting your IP to your Dynamic Name Service is sent through your normal Internet connection. You can do this by editing your connect and going to the Network tab. You will need to ask your Dynamic Name Service Provider what IP addresses you will need to route. You need to add a new route for each IP address required and set the Subnet mask to 255.255.255.255 and the Gateway to Local Network Gateway
3. If your ISP assigned IP address does not change regularly, close the reporting application before you connect to a VPN Server. You can setup Viscosity to do this automatically via scripting

 

[ScottForum]

That response just confuses me further as to your setup. Dynamic DNS shouldn't come into play for public IP addresses unless that's how you are trying to access the device publicly, I thought this was connecting to it from your internal network. Also when a device is bridged routing should not become and issue at all.

Let me reset my endeavor and issue...I want to be able to connect to my home PC (Home) via Internet when I am away from Home, i.e. using phone to connect to Home.

Since I do not have a static Home IP, I use a Dynamic DNS service (no-ip) to keep my IP updated (hostname). This works fine when my computer is connected directly to the Internet via router/ISP IP. However, if I am connected to my external VPN service, I can no longer reach Home via my hostname, due to traffic isn't forwarded on through my VPN service provider to Home.

The VPN adapter I refer to is a 'virtual' adapter called Viscosity that allows me to connect to my external VPN service (I do NOT have an internal VPN server), and according to Viscosity's dev, bridging my Home network adapter and the Viscosity virtual adapter is either a security risk or I probably won't benefit from the use of the VPN, as the traffic will simply pass on by.

Suffice to say, it will take a fair amount of explanation to convince me now that bridging these adapters is okay, after having the dev of Viscosity basically tell me it's not a good idea to bridge them.

In addition to the solutions he outlined, my only other alternatives would be to a) stop using a Dynamic DNS service, or b) simply disable my VPN when away from Home, but that would certainly be a last-resort option and require me to manually due so each time.

 

[ScottForum]

Regarding routing specific updater traffic...yeah, since the Viscosity dev had originally recommended it, I've posed the question to my DDNS SP. I haven't done this before, but I'll see if I can first get the IP(s).

Routing traffic completely...I'm not sure I understand, though I'll look into it to see if I can figure it out. Bridging was the only solution that I could think of.

UPDATE: Now that I grasped an understanding of routing, I discovered there was an option in my DDNS updater client to bind it to my local network adapter. Thanks all for the input.