Mister V tech blog

How to use a VPN which forces routing to your employer's network AND YET access your local network at the same time

2010-01-23T15:21:00.014+01:00

My employer is paranoid.
A lot of them are these days.

This employer provides a VPN access that forces the use of the corporate gateway as the default gateway and which sets the route to this default gateway to use a metric of 1.

This leads to the following result: When my laptop (provided by my employer) is connected to my employer's VPN behind my home network firewall/NAT/router, I have no access to the various devices on my home network, including local printer/scanner and various multimedia devices.
Very annoying indeed.

So I have found a way to circumvent that.

Basically, what I do it that I set a standard VPN connection instead of using my employer's provided wrapper (above MS Windows VPN links). And then I change the routing table so that my default gateway is the one of my home router (or the hotel router) and all the traffic to my employers network go through the VPN link.

My employers owns 2 C-Class Internet ranges so the routing to my employer's network is easy to figure out.

OTOH, when specifying a route in Windows, one must know the IP address and ID of the interface to use for these packets. And a VPN interface (actually a WAN PPP interface) has the nasty habit of changing its ID each time it is launched, and usually, it will also get a different IP address each time. So I developed a small utility to recover this ID and store it in an environment variable.

Then, I just have to invoke the corresponding "route change" or "route add" commands to add the routes to my employers C-Class and to make these route using the VPN interface.

It may seem more complicated than it is.

1st thing: Create the VPN connexion using standard MS Windows VPN.
In my case, my employer uses a simple PPTP tunnel, so it is very easy. But L2TP should be as easy. IPSEC might be a little more complex, but if you use IPSEC, you might skip this step and just change the routing as described below.

In order to set a Windows based VPN, you can use this tutorial:
https://people.chem.umass.edu/wiki/index.php?title=VPN_-_Connect_from_Windows_XP

One thing you must NOT forget is to uncheck the "Use default gateway on remote network":

This is the last screen of the tutorial mentioned above... If you do not know how to get there, just follow the tutorial above.

2nd thing:
Change the routing table

I use a .bat file like this one (I changed the real network classes...) :

NICIndex.exe /IPPrefix=193.105.13. /Type=PPP > %temp%\SetPPP.bat
if exist %temp%\SetPPP.bat call %temp%\SetPPP.bat
route add 192.105.13.0 MASK 255.255.255.0 %NICIP% Metric 50 IF %NICIDX%
route add 192.105.14.0 MASK 255.255.255.0 %NICIP% Metric 50 IF %NICIDX%

What you miss is my NICIndex tool that can be downloaded from this site, just following the link above.
It is a Delphi program which uses WMI to get the network adapters information.
It gets the ID of the first interface it founds which IP address begins with the parameter passed to it. In the example above:
NICIndex.exe /IPPrefix=193.105.13. /type=PPP
will get the interface ID of the first network interface which type is "PPP" (Point to point protocol, which is the type of VPN interfaces. The other types that you might use are "Ethernet" and, maybe, "TokenRing"...) that has an IP address beginning with 193.105.13
It will display this ID in the form
SET NICIDX=

for instance SET NICIDX=0x2000A
It also displays the interface IP address in the form
SET NICIP=193.195.13.127

Actually, NICPPPIndex.exe displays something like
SET NICIDX=
SET NICIP=
SET NICIP=193.195.13.127
SET NICIDX=0x2000A

So calling it this way:

NICIndex.exe /IPPrefix=193.105.13. /Type=PPP > %temp%\SetPPP.bat

you create a SetPPP.bat file in your temp folder.
When you call this SetPPP.bat file, you create the NICIP and NICIDX environment variables that you need to tune your routing table.
Thus my "VPNRoute.bat" file:

NICIndex.exe /IPPrefix=193.105.13. /Type=PPP > %temp%\SetPPP.bat
if exist %temp%\SetPPP.bat call %temp%\SetPPP.bat
route add 192.105.13.0 MASK 255.255.255.0 %NICIP% Metric 50 IF %NICIDX%
route add 192.105.14.0 MASK 255.255.255.0 %NICIP% Metric 50 IF %NICIDX%

In order for this to work, you need the NICIndex.exe file. And it must be in your PATH.

3rd thing:
Now connect it !

The only thing you have to do is to launch the VPN connection. When it is OK, launch the VPNRoute.bat file (for instance copy it on your desktop, after having modified it to suit your particular networking configuration)

Open Source !

My NICIndex source file, in Delphi, is here. Very simple.
NICIndex Source is available for download here:
http://www.filefactory.com/file/b13g5c3/n/NICIndex.dpr

I also include the full source text hereafter but blogger seems to truncate the end of lines...

program NICIndex;

{$APPTYPE CONSOLE}

uses
SysUtils,
Windows;

const
MAX_ADAPTER_NAME_LENGTH = 256;
MAX_ADAPTER_DESCRIPTION_LENGTH = 128;
MAX_ADAPTER_ADDRESS_LENGTH = 8;

TnTYPE:array[0..28] of AnsiString=('','','','','','','Ethernet','','','Token ring','','','','','','FDDI','','','','','','','','PPP','Loopback','','','','Slip');

type
PrIP_ADDRESS=^TrIP_ADDRESS;
TrIP_ADDRESS=record
Next:PrIP_ADDRESS;
IpAddress:array[0..15] of Char;
IpMask:array[0..15] of Char;
Context:DWORD;
end;

PrADAPTER=^TrADAPTER;
TrADAPTER=record
FNext:PrADAPTER;
FComboIndex:DWORD;
FAdapterName:array[0..MAX_ADAPTER_NAME_LENGTH+3] of Char;
FDescription:array[0..MAX_ADAPTER_DESCRIPTION_LENGTH+3] of Char;
FAddrLen:UINT;
FAddress:array[0..MAX_ADAPTER_ADDRESS_LENGTH-1] of Byte;
FIndex:DWORD;
FType:UINT;
FDHCPEnabled:UINT;
FCurrentIpAddress:PrIP_ADDRESS;
FIpAddressList:TrIP_ADDRESS;
FGatewayList:TrIP_ADDRESS;
FDHCPServer:TrIP_ADDRESS;
FHaveWins:BOOL;
FPrimaryWinsServer:TrIP_ADDRESS;
FSecondaryWinsServer:TrIP_ADDRESS;
FLeaseObtained:Longint;
FLeaseExpires:Longint;
end;

function GetAdaptersInfo(pAdapterInfo:PrADAPTER;pOutputBuffer:PULONG):DWORD;stdcall;external 'IPHlpAPI.dll' name 'GetAdaptersInfo';

var
Size:DWORD;
Info,P:PrADAPTER;
Found:Boolean=False;
PPPIP: string;
IPPrefix, NICType: string;
I: byte;

begin
Writeln(ErrOutput,ExtractFileName(ParamStr(0))+' Usage: ');
Writeln(ErrOutput,ExtractFileName(ParamStr(0))+' [/IPPREFIX= | /Type=]');
Writeln(ErrOutput,'Examples: '+ExtractFileName(ParamStr(0))+' /IPPREFIX=192.168.4.');
Writeln(ErrOutput,' '+ExtractFileName(ParamStr(0))+' /Type=Ethernet');
Writeln(ErrOutput,' '+ExtractFileName(ParamStr(0))+' /IPPREFIX=192.168.6. /Type=PPP');

Size:=0;
P:=nil;
GetAdaptersInfo(P,@Size);
GetMem(P,Size);
GetAdaptersInfo(P,@Size);
writeln('SET NICIDX=');
writeln('SET NICIP=');
PPPIP:='';
IPPrefix:='';;
NICType:='';
for I:=1 to ParamCount do
begin
if Uppercase(Copy(ParamStr(I),1,Length('/IPPREFIX=')))='/IPPREFIX=' then IPPREFIX:=Copy(ParamStr(I),Length('/IPPREFIX=')+1,Length(ParamStr(I))-Length('/IPPREFIX='));
if Uppercase(Copy(ParamStr(I),1,Length('/Type=')))='/TYPE=' then NICType:=Copy(ParamStr(I),Length('/Type=')+1,Length(ParamStr(I))-Length('/Type='));
end;
try
Info:=P;
if Assigned(P) then
// just printout - not needed
repeat
PPPIP:=PChar(@Info^.FIpAddressList.IpAddress);
if (IPPrefix<>'') and (NICType<>'') then Found:= (UpperCase(TnTYPE[Info^.FType])=UpperCase(NICType)) and (Pos(IPPrefix,PPPIP)=1)
else
begin
if NICType<>'' then Found:=(UpperCase(TnTYPE[Info^.FType])=UpperCase(NICType))
else if IPPrefix<>'' then Found:=(Pos(IPPrefix,PPPIP)=1);
end;

if (Found) then
begin
writeln('SET NICIP=',PPPIP);
writeln('SET NICIDX=',Format('0x%x',[Info^.FIndex]));
exit;
end;
Info:=Info^.FNext;
until not Assigned(Info);
finally
FreeMem(P);
end;
end.

The actual reasons for merlin u630 problem

2008-05-08T22:49:00.004+02:00

In my previous article,
http://mrvtech.blogspot.com/2008/02/novatel-merlin-u630-vodafone-drivers.html

I made several suppositions about the reasons for the Merlin u630 modem 3G card issues that caused it not to work with default configuration (aka automatic settings in resources tab of device manager).

After some more investigation I know now that it conflicts with the I/O Range for a serial port. All I had to do then was to change said I/O space used by the multifunction adapter. The one that is used by default is the one that is also used by COM2 and it fails.

One configuration that works correctly and totally (even after reboots) on my HP Compaq 8510w is then this one:
I/O Range: 02F0-02F7
I/O Range: 0180-0187
IRQ 16
Memory Range 000DD000-000DDFFF
Memory Range 000DC000-000DCFFF

All I had to do was to change the default I/O range for the SECOND I/O Range.

I hope it could help some other people...

Novatel Merlin u630 Vodafone drivers and configuration tricks

2008-02-10T23:24:00.001+01:00

I have had so many issues with my Vodafone 3G card (Novatel Merlin u630, provided by French carrier SFR) on Windows XP laptops that I thought I would create an help page for other users (I solved the issues).

First issue, with my IBM/Lenovo laptop Thinkpad Z60m

It did not work, the "Novatel Wireless UMTS Modem Secondary Port" device always appeared with a yellow mark.

Hopefully, I found some indications:
1. Insert the Merlin into the PC card slot.
2. Go to Device Manager. Start > Control Panel > System > Hardware > Device Manager.
3. Expand the Modems, the Multifunction adapters and the Ports category.
4. Select the Novatel Wireless UMTS Modem Parent under the Multifunction adapters category.
5. Right click and choose properties from the available menu.
6. Choose the resources tab.
7. Uncheck “Use automatic settings” to manually change the resource settings.
8. In the “Settings based on” drop down menu, choose a configuration that will eliminate the
error code. Usually, configuration 0004 or 0005 will work.
9. Choose OK and YES to further dialog windows.
10. Verify that there are no markings on Modems, Multifunction adapters or Port devices in Device Manager.

I found these hints on this page:
http://www.mybroadband.co.za/vb/showthread.php?t=32080

This made the card work in my Thinkpad...

Then, my company was acquired by another company and I got an HP Compaq 8510w mobile workstation.
I could not find the original software CD to install Vodafone Mobile Connect v5 (the one on my Lenovo, that came with teh card), but I did not care because I found the latest VMC software:
http://online.vodafone.co.uk/dispatch/Portal/appmanager/vodafone/wrp?_nfpb=true&_pageLabel=template11&pageID=BS_0036&tabIndex=2
I had to understand that Vodafone mixed up MacOS and Windows versions of the software and you had to click the MacOS link to get the Windows software (88MB).

Anyway, the software is here:
http://online.vodafone.co.uk/dispatch/Portal/SimpleGetFileServlet?dDocName=VF010615&revisionSelectionMethod=latestReleased&inline=0

This version of Vodafone Mobile Connect is supposed to support my 3G card and it even comes with updated drivers for the Novatel U630 card. Cool, they certainly have solved the issues there were with the previous version of the driver (I know a little about Windows driver programming and resource issues may be addressed in drivers).
But I was not able to even use the "resources" trick mentioned above.
Then I remember that when I struggled with my Lenovo and the u630, I already tried updated drivers, that were not working (I had to stick with the drivers shipped on the CD, even if they were outdated).

So I used DriverGenius on my Lenovo to extract the drivers for the 3 devices that the u630 installs in device Manager (Multi function parent device, Modem device and com port device). I then "upgraded" manually the drivers on the HP laptop (actually downgraded them).
And then it worked !... Once. When I rebooted it did not work anymore !

However, here is what happened the first time (before I rebooted):

I did not even have to enter the "advanced modem settings" that are used to connect to my phone carrier "ISP" node (you know the AT+CGDCONT=1,"IP"... stuff. Actually VMC 9 erases this value if you enter it. I guess it "knows" what value to use depending on the carrier you are connected to)

The drivers I extracted are said to be version 1.3.5.1
Actually, you need only the .inf and .cat files. I uploaded them and you can get them from this link.

But after I rebooted, it was still not working!.
Same issue as previously: Novatel Wireless UMTS Secondary Port (a COM port) had a yellow mark in device manager!

I tried to understand what happened.
I re-upgraded the drivers to v 1.3.5.4 (the ones shipped with VMC 9.2.4.7868).
I then modified again the resource settings.
I played a little with all the resource settings and I could diagnose the following:
The second I/O Range is the one used by the Novatel Wireless UMTS Secondary Port device.
Some values for this I/O Range are causing issues, though they are not in conflict with other devices and should be supported.
If you use a "wrong" value for the first I/O Range, then it's the Novatel Wireless UMTS Primary port device (the modem) that does not work anymore.
Sorry I did not write down THE value that was causing issue but I am pretty sure it was 0x02E8-0x02EF (and IRQ 3... The good old Com4 values !)

I tried several settings for this I/O Range. Some of them made Windows re-assigning resources for the WiFi adapter and Bluetooth connection. I finally managed to have a configuration that seemed to work.

I rebooted then...

And when I connected the u630 into my 8510w again, it seemed that Windows re-assigned ressources again (WiFi and Bluettoth got disabled and enabled again), but finally (after approximately 5 minutes), all the devices seemed to work. I had to admitthat the Plug'n'play manager and its handling of resources in Windows (and PnP BIOSes/firmware) is really a great job. Congratulations to the teams that developed these stuff!

Here are the resources used for u630 (Multi function device/Modem parent) at the time I write these lines (I did not reboot yet...)

I/O Range: 02F8-02FF
I/O Range: 03E8-03EF
IRQ: 16
Memory Range: 000DA000-000DAFFF
Memory Range: 000D4000-000D4FFF

And Novatel Wireless UMTS Secondary Port device is on COM6.

Now, we'll see what happen when I reboot the next time...

However, I could use VMC with the u630 and it worked quite well to connect to the Internet, even if it sets the metric for default route to 1 (You know, this is how MS deals with the option "use default gateway on remote nework") which is not what I want (especially when testing while being connected to the internet with a cheaper connection!). I can change the metric with the "route change" command, but I would like to do it automatically... VMC sets the setting by itself it seems. I'll try to see if I can change that.

Ah, and I tried to use VMC in order for it to control the Internet connection when I use my Treo 750v modem (either bluetooth or USB) but VMC does not detect the mobile phone.
Why do I want to do that? Well VMC knows the Access Points for a lot of GPRS/EDGE/UMTS/HSPA networks, and I wanted to use the same feature when using my Treo as a modem.
Maybe some new blog for this story... who knows?

Some more resources:

Firmware:
At the time when I write this page, you can download the v14.5 version of the firmware for u630 from this link:
http://www.vodafone.co.nz/personal/plans-services/3G-broadband/latest-downloads/firmware-releases/download-fw-4.jsp

Interesting technical bulletin from Novatel:
TECHNICAL SERVICE BULLETIN
Number: TSBU530-002(EC12)
Description Summary: Installation Problem -- Error Code 12
Documented: November 11th 2004
http://www.3.dk/upload/3DataCard/TSBU530_002(EC12%7D.pdf