Gateway redirect vs short DHCP lease

totaluser

Hello everybody,

I am running OpenVPN 2.2.0 server at home that I connect to from locations I am currently at to secure my data communication.
I am using redirect-gateway on clients so that all my traffic goes through encrypted OpenVPN tunnel

this works absolutely fine in almost all of my locations and traffic flows through the tunnel as expected.
when I am at the university using our WiFi network, it works only for a very short time and then a default route via tunnel interface is overruled.

I discussed this with our admin and I was able to narrow it down to DHCP lease time
in locations where it works as expected, lease time is either 24 hours or 48 hours and I am never connected longer than 6-12 hours, so no DHCP renewal happens that would change the default route via tunnel

at the university however, the lease time is set to 5 minutes and the next DHCP renewal overrides the default route via tunnel and after 5 minutes my traffic flows through WiFi directly instead of my tunnel

after disconnecting and connecting my traffic flows through the tunnel for a while before DHCP lease is renewed and default route is changed

I would like to ask if there is some setting in the config of either server or client that could solve my problem.

Thank you very much for your answer in advance

Mimiko

Disable persist-tun option. Using 5 min for DHCP is flawless. Too much negotiation traffic.

totaluser

if I understand correctly, by disabling persist-tun option you mean to remove --persist-tun option from my config, am I right?

Server config

# Tunnel options
mode server # Set OpenVPN major mode
proto udp # Setup the protocol (server)
port 9999 # TCP/UDP port number
dev tap1 # TUN/TAP virtual network device
keepalive 15 60 # Simplify the expression of --ping
daemon # Become a daemon after all initialization
verb 3 # Set output verbosity to n
# comp-lzo # Use fast LZO compression
push "route-gateway 10.11.x.x"
push "dhcp-option DNS 208.67.222.222"
# pool of IPs for connecting clients
push "ip-win32 dynamic"
ifconfig-pool 10.11.x.x 10.11.x.x 255.255.255.0
# virtual endpoints (are these arbitrary?)
ifconfig 10.11.x.x 255.255.255.0
# OpenVPN server mode options
client-to-client # tells OpenVPN to internally route client-to-client traffic
duplicate-cn # Allow multiple clients with the same common name
# TLS Mode Options
tls-server # Enable TLS and assume server role during TLS handshake
ca /jffs/openvpn/ca.crt # Certificate authority (CA) file
dh /jffs/openvpn/dh2048.pem # File containing Diffie Hellman parameters
cert /jffs/openvpn/server.crt # Local peers signed certificate
key /jffs/openvpn/server.key # Local peers private key
cipher AES-256-CBC # AES
log /tmp/openvpn_udp.log

Client config

port 9999
remote a.b.c.d
client
tls-remote server
dev tap
proto udp
resolv-retry infinite
nobind
persist-key
float
ca ca.crt
cert client1.crt
key client1.key
#comp-lzo
verb 3
cipher AES-256-CBC # AES
pull
redirect-gateway

so there is no --persist-tun in my configs (I am sorry that I did not post my configs in the first post)

Mimiko

Try with persist-tun removed and see how its working. Also see the routes which are added when dhcp is renewing. OpenVPNs rules are more specific and ovveride the default rule of local gw. See the version of OpenVPN on client.

totaluser

Hello,
I deployed another OpenVPN server on my Raspberry PI and the problem is still happening
(this time it is routed VPN with tun interfaces)
I removed persist-tun from client config but default GW is still overriden when DHCP address is renewed

This is the routing table after initiation of VPN connection (everyting is OK)

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.11.15.1       10.11.15.2     30
       10.11.12.0    255.255.255.0       10.11.15.1       10.11.15.2     30
       10.11.13.0    255.255.255.0       10.11.15.1       10.11.15.2     30
       10.11.15.0    255.255.255.0         On-link        10.11.15.2    286
       10.11.15.2  255.255.255.255         On-link        10.11.15.2    286
     10.11.15.255  255.255.255.255         On-link        10.11.15.2    286
    88.212.xx.xx  255.255.255.255    147.232.xx.xx    147.232.xx.xx     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
    147.232.xx.xx  255.255.255.224         On-link     147.232.xx.xx    276
    147.232.xx.xx  255.255.255.255         On-link     147.232.xx.xx    276
    147.232.xx.xx  255.255.255.255         On-link     147.232.xx.xx    276
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link        10.11.15.2    286
        224.0.0.0        240.0.0.0         On-link     147.232.xx.xx    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link        10.11.15.2    286
  255.255.255.255  255.255.255.255         On-link     147.232.xx.xx    276

this is how the routing table looks like after DHCP renew (after the lease time is close to expire)

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.11.15.1       10.11.15.2     30
          0.0.0.0          0.0.0.0    147.232.xx.xx    147.232.xx.xx     20
       10.11.12.0    255.255.255.0       10.11.15.1       10.11.15.2     30
       10.11.13.0    255.255.255.0       10.11.15.1       10.11.15.2     30
       10.11.15.0    255.255.255.0         On-link        10.11.15.2    286
       10.11.15.2  255.255.255.255         On-link        10.11.15.2    286
     10.11.15.255  255.255.255.255         On-link        10.11.15.2    286
    88.212.xx.xx  255.255.255.255    147.232.xx.xx    147.232.xx.xx     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
    147.232.xx.xx  255.255.255.224         On-link     147.232.xx.xx    276
    147.232.xx.xx  255.255.255.255         On-link     147.232.xx.xx    276
    147.232.xx.xx  255.255.255.255         On-link     147.232.xx.xx    276
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link        10.11.15.2    286
        224.0.0.0        240.0.0.0         On-link     147.232.xx.xx    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link        10.11.15.2    286
  255.255.255.255  255.255.255.255         On-link     147.232.xx.xx    276

as you can see, default gateway is changed after the renew (from the default route via 10.11.15.x -- OpenVPN network to 147.232.x.x --Physical Ethernet network)

any idea how to prevent the default gateway changing?
I want to have my GW redirected via VPN even after DHCP renew on the physical port

VPN subnets are these

10.11.12.0/24
10.11.13.0/24
10.11.15.0/24

Thank you very much in advance