Openvpn client complaining too many routes (not true)

agutxi

Dear all,
I'm hoping someone can shed some light on a strange error.
We have been using OpenVPN for a long time now and we are quite happy about it.
However, lately we are experiencing serious issues.
The problem starts with the clients losing connection (this can be normal as it happens during maintenance time - backup and stuff -, and it was happening before), but when the clients try to reconnect now, sometimes we get the following error message in the client side:

22:49:20 2013 read UDPv4 [EHOSTUNREACH|EHOSTUNREACH]: No route to host (code=113)
22:50:08 2013 TUN/TAP device tap0 opened
22:50:08 2013 /sbin/ifconfig tap0 192.168.25.28 netmask 255.255.255.0 mtu 1500 broadcast 192.168.25.255
22:50:08 2013 Initialization Sequence Completed
22:50:23 2013 OpenVPN ROUTE: cannot add more than 100 routes -- please increase the max-routes option in the client configuration file
22:50:23 2013 Exiting
22:50:23 2013 /sbin/ifconfig tap0 0.0.0.0

and they lose connection until the service is restarted.

There are a couple things that confuse me:
- Firstable we have many clients and many routes in the server, but we push only a few routes to the clients (less than ten) so I cannot guess why it is complaining about too many routes
- Second, usually once we start OpenVPN, the tap0 interface goes up as soon as we get internet connection, but in this case, we need to restart the service for the interface to come up, and we don't get the error message anymore
- and last, this happens randomly, in a few clients everyday, and so far, every client is different

I have been looking into possible causes, using both the documentation and Google, but I haven't found any clues yet as to why this can be happening, and I am getting a little desperate. Does anyone have any ideas?
Thank you kindly,
Agustin

Server: Debian Lenny
Package version: openvpn 2.1~rc19-2
Server config:

dev tapc
mode server

local XX.XX.XX.XX #hid sensitive info

port port# #hid sensitive info
float


#client-to-client

ifconfig-pool 192.168.25.2 192.168.25.254
ifconfig 192.168.25.1 255.255.255.0
keepalive 25 70
script-security 2 
# 							ROUTING
###############################################################


push "route 192.168.26.0 255.255.255.0 192.168.25.1"
push "route 192.168.27.0 255.255.255.0 192.168.25.1"


# SSL
tls-server
dh /etc/ssl/dh1024.pem
ca /etc/ssl/cacert.pem
cert /etc/ssl/servervpncert.pem
key /etc/ssl/servervpnkey.pem
crl-verify /etc/ssl/crl/crl.pem
client-config-dir /etc/openvpn/config/client_configs

# LOGGING
status /var/log/openvpnstatus-clientes.log
log-append /var/log/openvpn-clientes.log

# CONSOLE
management 127.0.0.1 4555 /etc/openvpn/consola.passwd

Clients: Debian Squeeze
Package version: 2.1.3-2+squeeze1
Client Config:

dev tap
remote XX.XX.XX.XX port# # hid sensitive information
lport 3194
tls-client
keepalive 10 60
pull 

#SSL
#nobind
ca /etc/openvpn/ca.pem
cert /etc/openvpn/cert.pem
key /etc/openvpn/key.pem

#LOGGING
log-append /var/log/openvpn.log
status /var/log/openvpn-status.log

shadilsingh

Hello

I had experienced a similar situation. I found that after adding 101 routes to the OpenVPN server, it would not restart. To increase the amount of routes for the OpenVPN server, edit the server.conf file. By default the OpenVPN settings are set to 100 routes. Do not confuse this with the max-clients settings.

Open the server.conf file and add this 1 line of code:

max-routes n

Where n can be any integer. By default n is set to 100.
Ensure that this line is added early on in the server.conf file prior to listing the routes.

janjust

for the original poster:

add 'verb 5' to the client config and reconnect; you should now see a list of all the routes that the server is pushing to the client.