Greetings, I've set up a bridged tunnel. The client has an unrelated Sixxs IPV6 tunnel which acts as the default IPV6 gateway. When the Openvpn tunnel is connected it inserts an IPV6 route on its tap0 interface breaking IPV6. What is causing this and how can I prevent it? Server config: [code] port 1194 proto udp dev tap0 tls-server ca keys/ca.crt cert keys/mercury.crt key keys/mercury.key # This file should be kept secret dh keys/dh2048.pem tls-auth keys/ta.key 0 server-bridge 46.21.99.3 255.255.255.240 46.21.99.5 46.21.99.5 push "redirect-private def1" keepalive 10 120 cipher BF-CBC # Blowfish (default) comp-lzo max-clients 1 user nobody group nogroup persist-key persist-tun mtu-disc yes status openvpn-status.log verb 3 mute 20 [/code] Client config: [code] port 1194 proto udp dev tap0 tls-client ca keys/ca.crt cert keys/ettin.crt key keys/ettin.key ns-cert-type server tls-auth keys/ta.key 1 remote mercury.watson-wilson.ca resolv-retry infinite pull status openvpn-status.log comp-lzo persist-key persist-tun mtu-disc yes verb 3 mute 20 keepalive 10 120 [/code] IPV6 route table VPN off: [code] 2604:8800:100:111::/64 via :: dev sixxs proto kernel metric 256 fe80::/64 dev eth0 proto kernel metric 256 fe80::/64 dev br1 proto kernel metric 256 fe80::/64 via :: dev sixxs proto kernel metric 256 fe80::/64 dev vnet0 proto kernel metric 256 default via 2604:8800:100:111::1 dev sixxs metric 1024 [/code] IPV6 route table VPN on: [code] 2604:8800:100:111::/64 via :: dev sixxs proto kernel metric 256 2a02:750:11:2::/64 dev tap0 proto kernel metric 256 expires 2592321sec ^^^ this is the problem ^^^^ fe80::/64 dev eth0 proto kernel metric 256 fe80::/64 dev br1 proto kernel metric 256 fe80::/64 via :: dev sixxs proto kernel metric 256 fe80::/64 dev vnet0 proto kernel metric 256 fe80::/64 dev tap0 proto kernel metric 256 default via 2604:8800:100:111::1 dev sixxs metric 1024 default via fe80::21d:e5ff:fe89:82c0 dev tap0 proto kernel metric 1024 expires 1797sec [/code] How can I prevent that route from being made? Alternatively, can this configuration be made to provide tap0 with an IPV6 in addition to the IPV4 address?

A quick up date. If I manually issue an "ip -6 route del 2a02:750:11:2::/64" the unwanted route is gone. I tried to make the client config do this with [code]route-up '/sbin/ip -6 route del 2a02:750:11:2::/64'[/code] But the logs show an error: [code] WARNING: Failed running command (--route-up): external program fork failed [/code] No matter how much a turn up the logging verbosity the reason for the failure is not logged. Is there a way get this done without resorting to a shell wrapper?

Unwanted IPV6 route

neilhwatson

Greetings,

I've set up a bridged tunnel. The client has an unrelated Sixxs IPV6 tunnel
which acts as the default IPV6 gateway. When the Openvpn tunnel is connected
it inserts an IPV6 route on its tap0 interface breaking IPV6. What is causing
this and how can I prevent it?

Server config:

port 1194
proto udp
dev tap0
tls-server
ca keys/ca.crt
cert keys/mercury.crt
key keys/mercury.key  # This file should be kept secret
dh keys/dh2048.pem
tls-auth keys/ta.key 0
server-bridge 46.21.99.3 255.255.255.240 46.21.99.5 46.21.99.5
push "redirect-private def1"
keepalive 10 120
cipher BF-CBC        # Blowfish (default)
comp-lzo
max-clients 1
user nobody
group nogroup
persist-key
persist-tun
mtu-disc yes
status openvpn-status.log
verb 3
mute 20

Client config:

port  1194
proto udp
dev tap0
tls-client
ca keys/ca.crt
cert keys/ettin.crt
key keys/ettin.key
ns-cert-type server
tls-auth keys/ta.key 1
remote mercury.watson-wilson.ca
resolv-retry infinite
pull
status openvpn-status.log
comp-lzo
persist-key
persist-tun
mtu-disc yes
verb 3
mute 20
keepalive 10 120

IPV6 route table VPN off:

2604:8800:100:111::/64 via :: dev sixxs  proto kernel  metric 256 
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 dev br1  proto kernel  metric 256 
fe80::/64 via :: dev sixxs  proto kernel  metric 256 
fe80::/64 dev vnet0  proto kernel  metric 256 
default via 2604:8800:100:111::1 dev sixxs  metric 1024

IPV6 route table VPN on:

2604:8800:100:111::/64 via :: dev sixxs  proto kernel  metric 256 
2a02:750:11:2::/64 dev tap0  proto kernel  metric 256  expires 2592321sec
^^^ this is the problem ^^^^
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 dev br1  proto kernel  metric 256 
fe80::/64 via :: dev sixxs  proto kernel  metric 256 
fe80::/64 dev vnet0  proto kernel  metric 256 
fe80::/64 dev tap0  proto kernel  metric 256 
default via 2604:8800:100:111::1 dev sixxs  metric 1024 
default via fe80::21d:e5ff:fe89:82c0 dev tap0  proto kernel  metric 1024  expires 1797sec

How can I prevent that route from being made? Alternatively, can this
configuration be made to provide tap0 with an IPV6 in addition to the IPV4
address?

neilhwatson

A quick up date. If I manually issue an "ip -6 route del 2a02:750:11:2::/64" the unwanted route is gone. I tried to make the client config do this with

route-up '/sbin/ip -6 route del 2a02:750:11:2::/64'

But the logs show an error:

WARNING: Failed running command (--route-up): external program fork failed

No matter how much a turn up the logging verbosity the reason for the failure is not logged. Is there a way get this done without resorting to a shell wrapper?