OpenVPN routing between clients

nickh

Hi,
I am trying to find out how to route between OpenVPN clients. The clients.conf is:

port 1194
proto udp
dev tun
ca /etc/pki/CA/ca-cert.pem
cert /etc/pki/CA/sys-0-cert.pem
key /etc/pki/CA/private/sys-0-key.pem
dh /etc/openvpn/ssl/dh1024.pem
server 10.8.0.0 255.255.255.0
keepalive 10 120
comp-lzo
user nobody
group nobody
multihome
persist-key
persist-tun
ifconfig-pool-persist /var/lib/openvpn/ipp.txt 120
status /var/lib/openvpn/openvpn-status.log
plugin /usr/lib/openvpn/plugin/lib/openvpn-auth-pam.so openvpn
verb 3
push "dhcp-option DNS 192.168.11.1"
push "dhcp-option WINS 192.168.11.1"
push "dhcp-option DOMAIN gammasystem.net"
push "route 192.168.11.0 255.255.255.0"

In WinXP this gives a routing table of:

===========================================================================
Route attive:
Indirizzo rete             Mask             Gateway       Interfac.  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.7   20
         10.8.0.1  255.255.255.255         10.8.0.5        10.8.0.6   1
         10.8.0.4  255.255.255.252         10.8.0.6        10.8.0.6   30
         10.8.0.6  255.255.255.255        127.0.0.1       127.0.0.1   30
   10.255.255.255  255.255.255.255         10.8.0.6        10.8.0.6   30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1   1
   178.255.153.13  255.255.255.255      192.168.1.1     192.168.1.7   20
      192.168.1.0    255.255.255.0      192.168.1.7     192.168.1.7   20
      192.168.1.7  255.255.255.255        127.0.0.1       127.0.0.1   20
    192.168.1.255  255.255.255.255      192.168.1.7     192.168.1.7   20
     192.168.11.0    255.255.255.0         10.8.0.5        10.8.0.6   1
        224.0.0.0        240.0.0.0         10.8.0.6        10.8.0.6   30
        224.0.0.0        240.0.0.0      192.168.1.7     192.168.1.7   20
  255.255.255.255  255.255.255.255         10.8.0.6        10.8.0.6   1
  255.255.255.255  255.255.255.255      192.168.1.7     192.168.1.7   1
Gateway predefinito:       192.168.1.1
===========================================================================

which I find a bit odd. Why is there a route from 10.255.255.255 back through the VPN? I could understand 10.8.0.255 as that is the broadcast address of the "server" IP range in the clients.conf.
On my own setup, I use 172.17.3.0/24 for OpenVPN and again WinXP gets a route for 172.17.255.255. It is like the client is assuming broadcast IP from the class of the subnet normally associated with the range where that subnet is, so it has assumed Class A and Class B respectively (/8 and /16) rather than using the subnet mask presented in the clients.conf (/24). Do you know why this is happening?

In order to route between OpenVPN clients, presumably I need to push a route to the clients which does not interfere with the default routing. Would this work:

push "route 10.8.0.0 255.255.255.0 vpn_gateway 500"

I am trying to add a high metric so the existing routes created in the table above get higher priority than this one. Will this work or do I need something else?

nickh

Sorry, looks like I did not think of the ovpn file:

client
remote whatever 1194
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca-cert.pem
cert xxx-cert.pem
key xxx-key.pem
ns-cert-type server
comp-lzo
verb 3
auth-user-pass

What else do you want from the server config? I am running a prepackaged rpm on ClearOS (RHEL based). As far as I can see the only file with the name server.conf is /usr/share/doc/openvpn-2.2.2/sample-config-files/server.conf which is irrelevant. I've tried looking at the init script and it does not seem to be pulling a configuration from anywhere else. If it help you to point me to other configuration files, from "ps aux" the command line which is running is:

/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/clients.pid --config clients.conf --cd /etc/openvpn --script-security 2

I am not having problems connecting (nor is the person I am trying to help) so I've posted no log files.

The issues he is having is Client to Client routing and not being able to browse the network neighbourhood. I've tried to understand the routing and although I see in each instance the route at the top end of the Class A or Class B network, with my limited understanding it seems odd. For instance how would it work if I had a LAN subnet of 10.255.225.0/24 which I believe is valid? OpenVPN's 10.255.255.255 route would hijack my LAN's broadcast address. This only appears to be a WinXP issue and not Win7. I am asking this question to try to further my knowledge.

nickh

We both run servers with a similar set up only I do not have two remote end points to play with. Our server configurations will be virtually identical except for the certificates, the "remote" line and the subnets we are using. FWIW he is just someone I an trying to help here. I have managed to get his basic communications working but not his Client - Client connection nor his network neighbourhood browsing.

Again, what server config are you talking about? The only configuration we have on our servers that I can find is a file /etc/openvpn/clients.conf and I posted that in my first post. (Actually that is not quite true. We both also have a /etc/openvpn/clients-tcp.conf file which carries a similar tcp connection definition but neither he nor I are using it so it is irrelevant).

If you can point me to this other configuration file I'd appreciate it.

[edit]
Perhaps it is confusing you that our server configuration file is called clients.conf.
[/edit]

nickh

Thanks. I found that line after my last post and you've just confirmed it. I have added it to the thread on the ClearOS forum.

Can you elaborate on why a 10.255.255.255 route is added at all (rather than a 10.8.0.255 route) and the effect it may have on a 10.255.255.0/24 LAN subnet?