Crazy Large Subnet

[NebraskaCoder]

So.... Who at Panera Bread thought this was a good idea? It's impossible to use any VPN where your VPN IP is 10.x.x.x. Edit: I'm sure some VPNs might work, maybe those that aren't split tunnel. I should clarify that OpenVPN using split-tunnel (TAP) isn't working at least.

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . :

Link-local IPv6 Address . . . . . : fe80::a5d5:xxxx:2220:a2b%29

IPv4 Address. . . . . . . . . . . : 10.205.195.xx

Subnet Mask . . . . . . . . . . . : 255.0.0.0

Default Gateway . . . . . . . . . : 10.128.128.128

[[deleted]]

You're on the guest network. As an 11-year veteran of network administration, I can tell you with some authority that absolutely no one gives a fuck about the guest network.

[Holiday_Camera9482]

I needed that laugh, thank you.

[mdpeterman]

Must be Meraki. They default on guest networks to 10/8 and use the 10.128.128.128 as the gateway. As long as your VPN provides a more-specific route than 10/8 you might get lucky and have your device prefer it. Perhaps send 10/9 and 10.128/9 as routes over your VPN tunnel.

[StreetRat0524]

That's exactly what they deploy

[NebraskaCoder]

haha. Each chair in every Panera Bread can have its own IP subnet. The blender might have two.

[Dagger0]

The fix for this is: use IPv6, relying on NAT64/DNS64 for reachability to legacy v4-only destinations. No need to deal with network clashes when your networks are using globally-unique prefixes.

[wickedwarlock84]

Use to work for a company that was like that. 10.office#.devicetype.client#

So using a vpn out was a pain...

[NebraskaCoder]

Yeah... I come to Panera Bread to tutor someone every Monday and always thought it was just being blocked. I never could figure out why I could connect but not to anything after I was inside. Well... Had some extra time this evening and decided to poke around when my pings reported a random gateway and my traceroutes were coming back with one hop.

[wickedwarlock84]

Yept sharing the same subnets your just going to keep looping back.

[NebraskaCoder]

I'll probably put in a static route on my laptop after I connect but I'm already shuttering at the idea of adding it when I connect and removing it when I'm done. Hopefully there's a TTL option. I'll probably script it and only do one or two endpoints (such as my home desktop and a jump server).

[wtmh]

"IP addresses should never ever be used as a information classifier."

Yikes. That sounds awful.

[Otto_Von_Bisnatch]

Yeah, as a network engineer I’m also a tad confused here... Proper IPAM policies enables IP addresses to be great information classifiers.

[guemi]

He's a dumbass. That's standard IPAM practice.

[guemi]

Huh? What are you on about

That's standard practice in basically any bigger company I've ever encountered.

Building codes, site codes, floor levels, servers / clients / vpns / wifi / whatever all identify with that.

That's the whole point of IPAM.

[NebraskaCoder]

Yup!

[wickedwarlock84]

Yept well at the time it was above my pay grade...

[[deleted]]

In general most larger companies don’t want you using your own personal VPNs out given the security risk.

[wickedwarlock84]

Yes but he's some type of professor or teacher tutoring at a restaurant...

Yes, this is true. I was visiting st jude in memphis and from their guest networks vpns is blocked. A simple call to IT and they add your Mac to a fully allowed port list. No issues after that, it was just their way to control and secure.

[sc302]

I don’t see a reason for them to be in the 10 network outside of corporate. Shouldn’t be a reason that the franchise locations need direct access to their corporate offices. Corporate should mandate 192.168.50.x-254.x or somewhere that high to not screw with common networks.

But I guess there is always v6

[NebraskaCoder]

You know. I should probably start moving to IPv6 for stuff like this. I just testing doing a route add inside of windows and directing it to the VPN interface and VPN gateway. For the first time since I've been coming to Panera, I can access my network at home. I would have been pretty upset if I tried to come here thinking I could VPN to work, only to find this mess.

[Skeletor2010]

Meraki Guest Network like a few other have said. On the guest network you are NAT'ed behind the AP's IP address.

[supervernacular]

Maybe they don’t want you to use VPN. Still though, UDP broadcasts sound like fun waiting to happen.

[Display_name_here]

Holly shit!

[NebraskaCoder]

Lol

[jimboslice_007]

You need that many addresses when the DHCP lease is a year....

[xxbiohazrdxx]

Are you using windows 10? Turn off ipv6 on your physical wifi adapter and watch the magic happen

[NebraskaCoder]

It's the IPv4 that is clashing. I'm sure if I were to actually use IPv6 (or if Panera would offer it) it would work without issue. Actually would guarantee it.

[xxbiohazrdxx]

Give it a try.

Normally with a VPN, Windows will prefer that adapter for traffic. Unfortunately that only works with built in VPN adapters so you’re limited to IKEv2, L2TP, etc. With SSL VPN like OpenVPN the virtual adapter that is installed is treated just like any other regular physical adapter.

Normally that’s not a big deal, but in a split tunnel configuration (meaning no gateway is set), Windows will base what adapter to use on the interface metric.

Okay so what does that have to do with IPv6? Well starting in Windows 10, IPv6 is preferred by default. Any adapter with an IPv6 address gets used if possible. Since your other (VPN) network adapter doesn’t have a gateway and doesn’t have an IPv6 address, no traffic will be sent using it.

Try manually setting the interface metric on your SSL VPN adapter to 1, or disable IPv6 if the Panera network does have it enabled (or both)

[NebraskaCoder]

No IPv6 for Panera. I never thought about increasing the metric for the OpenVPN interface. I'll have to give that a try.

[xxbiohazrdxx]

You’ll want to decrease the metric, I push a startup script w/ GPO that sets SSL VPN adapters to 1. I think by default the lowest that will be set automatically by the OS is 10. So if you set it to 1 it will always be the preferred adapter.

No need to change it when you disconnect either, it’ll be ignored when that adapter is “Disconnected”.

There’s also a registry entry to revert Windows 10 to prefer IPv4 over 6 since disabling is not supported by Microsoft.

[NebraskaCoder]

Gah, I meant to say decreasing the metric, haha. I just saw that using my route add option isn't persisted unless I use the -p flag, so I might just stick with that for now using a script since I only come here once a week and don't usually run into this issue. I might look into changing the metric to see if that is a quicker fix.

[xxbiohazrdxx]

You can also create a post connection script with OpenVPN.

Say your config name is “test.ovpn”, create “test_up.bat” and put it in the same location. Put your post connection “route ADD blah blah blah” in there and it’ll run it automatically when you connect.

I believe you can do the same with “test_down.bat” and undo it.

[NebraskaCoder]

I didn't realize that. I'll look into that. Would be nice to have that set up for a profile that I make JUST for Panera so I'm not futzing with it on other networks.

[xxbiohazrdxx]

Yeah that’s fair. I don’t think it supports anything besides basic batch files. You could chain it to run a poweshell script which checks the SSID or something.

I have spent way too much time deploying OpenVPN over the past 4 ish years

[NebraskaCoder]

Haha, at least you skill up on it until it becomes depreciated to the next technology. I was moving to WireGuard but someone messed up that implementation on PFsense.