CloudConnexa: Configure a Network Connector on Windows 11

This guide explains how to configure a Windows 11 device as a Network Connector for CloudConnexa.

A Network Connector routes traffic between your local network and CloudConnexa Users and Subnets, enabling secure access to private resources.

Recommendation: For production environments, consider using Windows Server, Linux, or WSL. These platforms handle routing more reliably and don't require registry changes.

Important: Be cautious when modifying the registry, as incorrect changes can compromise system stability.

Prerequisites

• Windows 11 device.

• Administrative access to the device.

• Access to your local gateway/router configuration.

Step 1: Install OpenVPN Connect and start the session

1. Install OpenVPN Connect on the Windows device. Refer to OpenVPN Connect for the latest version.

2. Download the Network Connector profile (.ovpn) using the steps in Download a Connector's profile.

3. Import the profile into OpenVPN Connect.

4. Click connect to start the session.

Step 2: Enable IP forwarding (registry change)

Windows disables routing by default. You need to enable IP forwarding at the OS level.

This registry change requires a device restart to take effect. You'll complete the restart before configuring the network interfaces.

Use PowerShell or Command Prompt with elevated privileges and run this command:

reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v IPEnableRouter /D 1 /f

Optionally, you can also make the change in the Registry Editor:

1. Open regedit (Win + R).

2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

3. Set IPEnableRouter to 1.

4. Close the editor.

🔁 Restart the device after applying this change before continuing.

Step 3: Enable IP forwarding on the network interfaces

After the restart, enable forwarding on both the local network interface and the OpenVPN tunnel interface. Both are required; the local interface receives traffic from your network, and the OpenVPN interface forwards it into the CloudConnexa tunnel.

1. Use PowerShell with elevated privileges and identify your interface names:

   netsh interface ipv4 show interfaces

   • Common names:
     Local interface: Ethernet
     Tunnel interface: Local Area Connection (default) or OpenVPN Data Channel Offload (if DCO is enabled).

2. Enable forwarding on both interfaces. The following example uses Ethernet as the local adapter and Local Area Connection as the tunnel adapter:

   netsh interface ipv4 set interface "Ethernet" forwarding=enabled
   netsh interface ipv4 set interface "Local Area Connection" forwarding=enabled

   If using DCO:

   netsh interface ipv4 set interface "Ethernet" forwarding=enabled
   netsh interface ipv4 set interface "OpenVPN Data Channel Offload" forwarding=enabled

Step 4: Configure Windows Firewall to allow forwarded traffic

Windows Desktop editions block forwarded (routed) packets by default, even when IP forwarding is enabled. You need to add firewall rules to allow this traffic.

Option 1: Allow all forwarded traffic

Open PowerShell with elevated privileges and run:

netsh advfirewall firewall add rule name="Allow Forwarded Inbound" dir=in action=allow enable=yes

netsh advfirewall firewall add rule name="Allow Forwarded Outbound" dir=out action=allow enable=yes

Option 2: (Recommended) Restrict to WPC subnet

For a more restrictive approach, scope these rules to the WPC subnet:

netsh advfirewall firewall add rule name="Allow WPC Inbound" dir=in action=allow remoteip=100.96.0.0/11 enable=yes

netsh advfirewall firewall add rule name="Allow WPC Outbound" dir=out action=allow remoteip=100.96.0.0/11 enable=yes

Note: Without these firewall rules, forwarded traffic is silently dropped.

Step 5: Verify IP forwarding status

Confirm that forwarding is enabled on both interfaces by checking the detailed view for each:

netsh interface ipv4 show interface "Ethernet"

netsh interface ipv4 show interface "Local Area Connection"

• If DCO is active, replace Local Area Connection with OpenVPN Data Channel Offload.

Look for Forwarding : enabled.

Note: The command netsh interface ipv4 show interfaces (plural) doesn't display the forwarding status. Use the singular show interface command with a specific interface name or ID to confirm.

Step 6: Add the WPC subnet to the Connector

Your local network needs to know how to reach CloudConnexa subnets. 

1. Sign in to the CloudConnexa Admin portal.

2. Go to Settings → WPC.

3. Note your WPC subnet. The default value is 100.96.0.0/11.

4. On your local router/gateway, add a static route:
   Example:

   100.96.0.0/11 via 192.168.1.48

   In this example, the Windows Network Connector device has a private IP of 192.168.1.48. Verify the private IP associated with your local interface by running ipconfig /all from Command Prompt or PowerShell.

Additional notes

• If you deploy multiple Network Connectors, add routes for each relevant CloudConnexa subnet.

• Ensure routing symmetry across your environment for full connectivity.

Summary

To configure a Windows Network Connect, you need to:

1. Enable IP forwarding (registry + interfaces).
2. Allow forwarded traffic through Windows Firewall.
3. Route CloudConnexa subnets to the Connector via your gateway.