[Openvpn-users] pushing server network as route to client stops openvpn

[Sascha Lucas]

Hi List,

I have a server (tls-server) with dev tun and IP forwarding (without NAT).

The Servers IP is: 129.69.90.133/255.255.255.248

Every thing works fine if i push networks to clients that do not include
the servers IP. I.e. push "route 129.69.1.0 255.255.255.0" works. push
"redirect-gateway def1" wokrs also.

When ever I push a network route that includes the servers IP, the VPN
connection stops working. I.e. push "route 129.69.90.128 255.255.255.248".
On the client side it looks like this:

Fri Dec 2 14:43:10 2005 /sbin/ifconfig tun0 129.69.204.6 pointopoint
129.69.204.5 mtu 1500
Fri Dec 2 14:43:10 2005 /sbin/route add -net 129.69.204.1 netmask
255.255.255.255 gw 129.69.204.5
Fri Dec 2 14:43:10 2005 /sbin/route add -net 129.69.90.128 netmask
255.255.255.248 gw 129.69.204.5
Fri Dec 2 14:43:11 2005 Initialization Sequence Completed

pinging the server (ping 129.69.90.133) and tcpdumping tun0 shows:

# tcpdump -ni tun0
14:48:46.649102 IP 129.69.204.6 > 129.69.90.133: ICMP echo request, id
47385, seq 1, length 64

but on eth0 nothing happend. With netstat I can see that the Send Queue
grows:

# netstat -an --inet
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 65932 0.0.0.0:32773 0.0.0.0:*

It looks like the ping leaves tun0 but is not routed through openvpn via
eth0. Can some help me?

here are my relevant config parts:

####### server config ###############################
port 1194
proto udp
dev tun0
server 129.69.205.0 255.255.255.0
keepalive 10 120
comp-lzo
cipher AES-128-CBC
user nobody
group nobody
persist-key
persist-tun
push "route 129.69.0.0 255.255.0.0"
####### server config ###############################

and from the client:

####### client config ###############################
dev tun
remote 129.69.90.133 1194
client
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
comp-lzo
cipher AES-128-CBC
####### client config ###############################

Sascha.

[Mathias Sundman]

Post by Sascha Lucas
Hi List,
I have a server (tls-server) with dev tun and IP forwarding (without NAT).
The Servers IP is: 129.69.90.133/255.255.255.248
Every thing works fine if i push networks to clients that do not include the
servers IP. I.e. push "route 129.69.1.0 255.255.255.0" works. push
"redirect-gateway def1" wokrs also.
When ever I push a network route that includes the servers IP, the VPN
connection stops working. I.e. push "route 129.69.90.128 255.255.255.248". On

ehh... Think about it for a few more seconds.. You are pushing a route to
the client that sais that is should route traffic for 129.69.90.128/29 via
your OpenVPN tunnel! What about the OpenVPN traffic itself, how is it now
supposed to find itŽs way to your server 129.69.90.133?

You will have to either push a host route for 129.69.90.133 via your old
default gateway, or split the subnet into smaller pieces that does not
include .133 and push them all.

[Sascha Lucas]

Post by Sascha Lucas
When ever I push a network route that includes the servers IP, the VPN
connection stops working. I.e. push "route 129.69.90.128 255.255.255.248".

ehh... Think about it for a few more seconds.. You are pushing a route to the
client that sais that is should route traffic for 129.69.90.128/29 via your
OpenVPN tunnel! What about the OpenVPN traffic itself, how is it now supposed
to find itŽs way to your server 129.69.90.133?

After some seconds of thinking I beleave I just followed the Howto
(http://openvpn.net/howto.html#scope). p2p works (nothing pushed). So I
pushed the Servers net "route 129.69.90.128 255.255.255.248". I.e. to
reach 129.69.90.130 via the VPN.

You will have to either push a host route for 129.69.90.133 via your old
default gateway, or split the subnet into smaller pieces that does not
include .133 and push them all.

The host route via my old GW is set by openvpn when useing push
"redirect-gateway def1"

Fri Dec 2 15:58:22 2005 /sbin/ifconfig tun0 129.69.204.10 pointopoint
129.69.204.9 mtu 1500
Fri Dec 2 15:58:22 2005 /sbin/route add -net 129.69.90.133 netmask
255.255.255.255 gw 129.69.11.254
Fri Dec 2 15:58:22 2005 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw
129.69.204.9
Fri Dec 2 15:58:22 2005 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0
gw 129.69.204.9
Fri Dec 2 15:58:22 2005 /sbin/route add -net 129.69.204.1 netmask
255.255.255.255 gw 129.69.204.9

I want this for not redirect-gateway only.

Sascha.

[Mathias Sundman]

Post by Sascha Lucas

Post by Mathias Sundman

Post by Sascha Lucas
When ever I push a network route that includes the servers IP, the VPN
connection stops working. I.e. push "route 129.69.90.128
255.255.255.248".

ehh... Think about it for a few more seconds.. You are pushing a route
to the client that sais that is should route traffic for
129.69.90.128/29 via your OpenVPN tunnel! What about the OpenVPN
traffic itself, how is it now supposed to find itŽs way to your server
129.69.90.133?

After some seconds of thinking I beleave I just followed the Howto
(http://openvpn.net/howto.html#scope). p2p works (nothing pushed). So I
pushed the Servers net "route 129.69.90.128 255.255.255.248". I.e. to
reach 129.69.90.130 via the VPN.

So, don't you understand that that will break the routing of the OpenVPN
tunnel itself, or do you think that OpenVPN should always be smart enough
to figure out that your server IP is part of the route you are trying to
push so it would automatically add a host route for the server?

Post by Sascha Lucas

Post by Mathias Sundman
You will have to either push a host route for 129.69.90.133 via your old
default gateway, or split the subnet into smaller pieces that does not
include .133 and push them all.

The host route via my old GW is set by openvpn when useing push
"redirect-gateway def1"

Yes, when you use --redirect-gateway, there is always a host route added
as it is always needed. When pushing normal routes, itŽs rather uncommon
to push the subnet that your server belongs to so no host route is
added.

[Sascha Lucas]

Post by Mathias Sundman

Post by Sascha Lucas
After some seconds of thinking I beleave I just followed the Howto
(http://openvpn.net/howto.html#scope). p2p works (nothing pushed). So I
pushed the Servers net "route 129.69.90.128 255.255.255.248". I.e. to
reach 129.69.90.130 via the VPN.

So, don't you understand that that will break the routing of the OpenVPN
tunnel itself, or do you think that OpenVPN should always be smart enough to
figure out that your server IP is part of the route you are trying to push so
it would automatically add a host route for the server?

Yes, I understand! But I think the next one: OpenVPN should always be
smart enough to discover that this pushed route includes the Servers IP.

Post by Mathias Sundman
Yes, when you use --redirect-gateway, there is always a host route added as
it is always needed. When pushing normal routes, itŽs rather uncommon to push
the subnet that your server belongs to so no host route is added.

realy uncommon? What if your company has a class B Network
(129.69.0.0/16), you place your VPN Server somewhere in this net and you
want your clients to access 129.69.0.0/16 via the VPN-Tunnel?

I have a workaround for now:

I replaced push "route 129.69.0.0 255.255.0.0" with

push "route 129.69.0.0 255.255.192.0"
push "route 129.69.64.0 255.255.240.0"
push "route 129.69.80.0 255.255.248.0"
push "route 129.69.88.0 255.255.254.0"
push "route 129.69.90.0 255.255.255.128"
push "route 129.69.90.128 255.255.255.252"
push "route 129.69.90.132 255.255.255.255"
push "route 129.69.90.134 255.255.255.254"
push "route 129.69.90.136 255.255.255.248"
push "route 129.69.90.144 255.255.255.240"
push "route 129.69.90.160 255.255.255.224"
push "route 129.69.90.192 255.255.255.192"
push "route 129.69.91.0 255.255.255.0"
push "route 129.69.92.0 255.255.252.0"
push "route 129.69.96.0 255.255.224.0"
push "route 129.69.128.0 255.255.128.0"

just to exclude 129.69.90.133. This is .... not nice :-(

Sascha.

[Mathias Sundman]

Post by Mathias Sundman

Post by Sascha Lucas
After some seconds of thinking I beleave I just followed the Howto
(http://openvpn.net/howto.html#scope). p2p works (nothing pushed). So I
pushed the Servers net "route 129.69.90.128 255.255.255.248". I.e. to
reach 129.69.90.130 via the VPN.

So, don't you understand that that will break the routing of the OpenVPN
tunnel itself, or do you think that OpenVPN should always be smart enough
to figure out that your server IP is part of the route you are trying to
push so it would automatically add a host route for the server?

Yes, I understand! But I think the next one: OpenVPN should always be smart
enough to discover that this pushed route includes the Servers IP.

Might be useful yes.

Post by Mathias Sundman
Yes, when you use --redirect-gateway, there is always a host route added as
it is always needed. When pushing normal routes, itŽs rather uncommon to
push the subnet that your server belongs to so no host route is added.

realy uncommon? What if your company has a class B Network (129.69.0.0/16),
you place your VPN Server somewhere in this net and you want your clients to
access 129.69.0.0/16 via the VPN-Tunnel?
I replaced push "route 129.69.0.0 255.255.0.0" with
push "route 129.69.0.0 255.255.192.0"
push "route 129.69.64.0 255.255.240.0"
push "route 129.69.80.0 255.255.248.0"
push "route 129.69.88.0 255.255.254.0"
push "route 129.69.90.0 255.255.255.128"
push "route 129.69.90.128 255.255.255.252"
push "route 129.69.90.132 255.255.255.255"
push "route 129.69.90.134 255.255.255.254"
push "route 129.69.90.136 255.255.255.248"
push "route 129.69.90.144 255.255.255.240"
push "route 129.69.90.160 255.255.255.224"
push "route 129.69.90.192 255.255.255.192"
push "route 129.69.91.0 255.255.255.0"
push "route 129.69.92.0 255.255.252.0"
push "route 129.69.96.0 255.255.224.0"
push "route 129.69.128.0 255.255.128.0"
just to exclude 129.69.90.133. This is .... not nice :-(

Yes, that was what I ment with splitting up the route in smaller pieces.
Why donŽt you try my other suggestion if you didnŽt like this solution.
Push a host route for your openvpn server IP. There is a keyword to use
for the gateway address that will resolve to your old default gateway,
look it up in the manpage.

[Sascha Lucas]

Yes, that was what I ment with splitting up the route in smaller pieces. Why
donŽt you try my other suggestion if you didnŽt like this solution. Push a
host route for your openvpn server IP. There is a keyword to use for the
gateway address that will resolve to your old default gateway, look it up in
the manpage.

Oh... thanks. I read over this before, but didn't realize for what its
good for. But ...

net_gateway -- The pre-existing IP default gateway, read
from the routing table (not supported on all OSes).

Do you know what OSes are supported? I must support linux+windows+mac
(*BSD+sol are nice to have).

THX,

Sascha.

[James Yonan]

Post by Sascha Lucas
After some seconds of thinking I beleave I just followed the Howto
(http://openvpn.net/howto.html#scope). p2p works (nothing pushed). So=

I

Post by Sascha Lucas
pushed the Servers net "route 129.69.90.128 255.255.255.248". I.e. to
reach 129.69.90.130 via the VPN.

So, don't you understand that that will break the routing of the OpenVP=

N=20

tunnel itself, or do you think that OpenVPN should always be smart enou=

gh to=20

figure out that your server IP is part of the route you are trying to p=

ush so=20

it would automatically add a host route for the server?

=20
Yes, I understand! But I think the next one: OpenVPN should always be=20
smart enough to discover that this pushed route includes the Servers IP.

Probably a warning would be appropriate. There are already a number of=20
warnings that try to detect these types of conditions, though I'm not sure=
=20
that this particular case is covered right now.

Yes, when you use --redirect-gateway, there is always a host route adde=

d as=20

it is always needed. When pushing normal routes, it=B4s rather uncommon=

to push=20

the subnet that your server belongs to so no host route is added.

=20
realy uncommon? What if your company has a class B Network=20
(129.69.0.0/16), you place your VPN Server somewhere in this net and you=

=20

want your clients to access 129.69.0.0/16 via the VPN-Tunnel?
=20
=20
I replaced push "route 129.69.0.0 255.255.0.0" with
=20
push "route 129.69.0.0 255.255.192.0"
push "route 129.69.64.0 255.255.240.0"
push "route 129.69.80.0 255.255.248.0"
push "route 129.69.88.0 255.255.254.0"
push "route 129.69.90.0 255.255.255.128"
push "route 129.69.90.128 255.255.255.252"
push "route 129.69.90.132 255.255.255.255"
push "route 129.69.90.134 255.255.255.254"
push "route 129.69.90.136 255.255.255.248"
push "route 129.69.90.144 255.255.255.240"
push "route 129.69.90.160 255.255.255.224"
push "route 129.69.90.192 255.255.255.192"
push "route 129.69.91.0 255.255.255.0"
push "route 129.69.92.0 255.255.252.0"
push "route 129.69.96.0 255.255.224.0"
push "route 129.69.128.0 255.255.128.0"
=20
just to exclude 129.69.90.133. This is .... not nice :-(

You don't need to do this. Just use your current route, but add a host=20
route to route OpenVPN payload packets directly to the next hop gateway:

push "route remote_host 255.255.255.255 net_gateway"

remote_host should substitute to 129.69.90.133 and net_gateway should=20
substitute to the machine's default gateway.

James

[Sascha Lucas]

Post by James Yonan

Post by Sascha Lucas
just to exclude 129.69.90.133. This is .... not nice :-(

You don't need to do this. Just use your current route, but add a host
push "route remote_host 255.255.255.255 net_gateway"
remote_host should substitute to 129.69.90.133 and net_gateway should
substitute to the machine's default gateway.

THX a lot. Mathias Sundman allready said this to me. from man page:

net_gateway -- The pre-existing IP default gateway, read from the routing
table (not supported on all OSes).

Do you know what OSes are supported?

Sascha.

[James Yonan]

Post by Sascha Lucas

Post by James Yonan

Post by Sascha Lucas
just to exclude 129.69.90.133. This is .... not nice :-(

You don't need to do this. Just use your current route, but add a host
push "route remote_host 255.255.255.255 net_gateway"
remote_host should substitute to 129.69.90.133 and net_gateway should
substitute to the machine's default gateway.

net_gateway -- The pre-existing IP default gateway, read from the
routing table (not supported on all OSes).
Do you know what OSes are supported?

Linux, Windows, Mac OS X, and *BSD.

James

[Tom Fanning]

-----Original Message-----
Of Sascha Lucas
Sent: 02 December 2005 13:02
Subject: [Openvpn-users] pushing server network as route to
client stops openvpn
Hi List,
I have a server (tls-server) with dev tun and IP forwarding
(without NAT).
The Servers IP is: 129.69.90.133/255.255.255.248
When ever I push a network route that includes the servers
IP, the VPN
connection stops working. I.e. push "route 129.69.90.128
255.255.255.248".

How is the client supposed to talk to the server if there is a route created
with better metric than the existing route to the server, when the route you
are creating depends on the "worse" metric route, the one that existed
before the openvpn session came up?

Depending on what you actually want to do, try setting a metric of say 30
(in any case "worse" than the existing route/default gateway route) on the
openvpn route to the server.

Why do you want to create a tunneled route to the server when you can
already connect to it? To bypass a firewall?

Tom

[Sascha Lucas]

Post by Tom Fanning
Depending on what you actually want to do, try setting a metric of say 30
(in any case "worse" than the existing route/default gateway route) on the
openvpn route to the server.

hm. I'm not familar with metric. I think of it as a number of priority.
But what happens if route A is preferred over B. And the firewall on A
drops while on B it accepts the connection?

Post by Tom Fanning
Why do you want to create a tunneled route to the server when you can
already connect to it? To bypass a firewall?

No. just http://openvpn.net/howto.html#scope. I.e. I want to access
129.69.90.130 via the VPN-Server 129.69.90.133 on the same subnet.

Sascha.

[Mathias Sundman]

Post by Sascha Lucas

Post by Tom Fanning
Why do you want to create a tunneled route to the server when you can
already connect to it? To bypass a firewall?

No. just http://openvpn.net/howto.html#scope. I.e. I want to access
129.69.90.130 via the VPN-Server 129.69.90.133 on the same subnet.

If .130 is the only host you need to access through the VPN (on that
subnet), then simply push a host route for .130 instead (netmask
255.255.255.255) of the whole subnet.