Push routes to client

dix

Hi,

I've configured the OpenVPN for a site-to-site VPN. I've used the ccd folder to tell the OpenVPN server the routes behind the client; but I need to push the same routes into the client. The problem is that I don't want to use the push option into the server.conf file because the routes are specific for this client, not the others.

This works if I put the routes into the client.conf file directly, but I don't want this; I want to know if it is possible to use the option push into the ccd/client file; I've tried but it doesn't work. Is it possible?

Thanks.

janjust

it's the SERVER that needs to know about the subnet behind the client; so instead of putting a "push route" in the CCD file you should put

route A.B.C.D 255.255.255.0
iroute A.B.C.D 255.255.255.0

in the CCD file.

dix

Yes, I put it into the server. But I also want that the server push this route for the specific client with push route command. I've tried into the ccd file but it doesn't work.

And the command:

route X.X.X.X 255.255.255.0

Doesn't work in the CCD file; the log shows the next error:

OPTIONS IMPORT: reading client specific options from: ccd/client1
Options error: option 'route' cannot be used in this context

janjust

oh right, I forgot about that one - there was discussion whether this should be possible. For now you'll have to resort to putting the route in the global config - the route will not be used until that client logs in anways

dix

Yes, but the problem is that I use the same OpenVPN server for a road-warrior clients and also for a site-to-site vpn. I only want to push the routes for the site-to-site "client" not for the other normal users. Doing it into the general config file, makes that every client receives all the routes behind the site-to-site client and I don't want this.

Well, if it is not possible right now I'll put the routes into the site-to-site client "client.conf". But it would be great to have this possibility through the CCD files 😉.

For curiosity, where is this discussion regarding this issue? What was the conclusion?

Thanks again.

P.S: useful book 😉

janjust

that's not entirely true : the other clients will not get the route to the client's LAN , *AND* client-to-client comms are prohibited anyways unless you specify 'client-to-client' .

This discussion was either on the openvpn-devel mailing list or the #openvpn-devel freenode forum; I think it was the former.