How do I prevent Windows from modifying routing table?

2

2

I have a VPN that I want to route all of my traffic through in order to prevent my school from invading my privacy, and restricting the websites that I can access. The VPN works great once it's connected, but applications can still access the Internet before my computer connects to the VPN and before my VPN client routes all traffic through the VPN by modifying the routing table. I can temporarily solve my problem by deleting all of the routes in the routing table (including the default gateway), and then adding a single route to my VPN's IP through the school gateway and then by creating a default route through my virtual NIC.

The problem with this is, any time I reconnect to the network or restart my computer, all of the routes that I had previously deleted are recreated, and applications are able to access the Internet before the VPN connects, just as before. I have tried modifying the firewall and just blocking all outbound traffic by default, but this is NOT what I want, and it did not solve my problem.

Since I need to create and manage the required routes manually, how can I prevent Windows from modifying the routing table AT ALL, especially when connecting/disconnecting to/from a wireless network?

ProtectedMethod

Posted 2017-05-01T02:37:09.667

Reputation: 21

1The routes get added as part of dhcp, so one option would be to not use dhcp and use a static IP - however, you would need to work with your school to get a static IP reserved. Another option would be to run a script as soon as a network connection is established, which deletes the routes and adds the ones you want. – Paul – 2017-05-01T05:18:38.037

Answers

0

You might be able to block the IP range used by the university by creating persistent routes for these addresses that lead nowhere and prevent access.

For example, let's say that the IP address you want to block is 100.100.100.100, and an unused IP address on your local subnet is 192.168.100.51. Modify the route table with the following command:

Route -p add 100.100.100.100 mask 255.255.255.255 192.168.100.51

The route command must be run with elevated permissions, for example by scheduling a script to run after boot. A partial mask can be used to block an entire range of IPs.

References :

harrymc

Posted 2017-05-01T02:37:09.667

Reputation: 306 093