Default route is changed WITHOUT redirect-gateway directive

diggy

Hi all.
I've been using openVPN in bridged mode I switched over to routed because I wanted to connect from openVPN connect for Android.
I have a problem with routed VPN:
For some reason after connecting, the default route changes to the remote p-t-p thus stopping access to the internet from the client (I DON'T want to route all traffic via VPN, just the requests to the server's subnet)

Below are the details of my networks' setup:
Server LAN gateway (ISP locked router): 192.168.1.1/24
Server IP: 192.168.1.50/24
Server Distro: OpenSUSE 13.1 x64
Port forwarding (NAT) on router publicIP:51194 -> 192.168.1.50:1194
/proc/sys/net/ipv4/ip_forward = 1

Client LAN gateway (ISP locked router): 192.168.10.254/24
Client IP: 192.168.10.1/24
Client VPN IP: 10.8.0.10/24
Client Distro: OpenSUSE 13.1 x64

Server.conf

port 1194
proto udp
dev tun
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/server.crt
key /etc/openvpn/ssl/server.key  # This file should be kept secret
dh /etc/openvpn/ssl/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/run/openvpn/ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
comp-lzo
max-clients 5
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 4

Client.conf

client
dev tun
proto udp
remote xxxx 51194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca /etc/openvpn/ssl/ca.crt
cert /etc/openvpn/ssl/asusClient.crt
key /etc/openvpn/ssl/asusClient.key
ns-cert-type server
comp-lzo
verb 5

Server ifconfig

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1

Server routes #route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 enp7s0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     1      0        0 enp7s0

Client ifconfig

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1

Client routes

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
[b]0.0.0.0         10.8.0.9        0.0.0.0         UG    0      0        0 tun0[/b]
10.8.0.1        10.8.0.9        255.255.255.255 UGH   0      0        0 tun0
10.8.0.9        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
178.59.42.187   192.168.10.254  255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     10.8.0.9        255.255.255.0   UG    0      0        0 tun0
192.168.10.0    0.0.0.0         255.255.255.0   U     1      0        0 eth0

As you can see, for the 1st issue, the problem lies in the client default route that gets changed resulting in no internet access.
Deleting the route with

route del default gw 10.8.0.9 netmask 0.0.0.0

and adding the one that preexisted before connecting to the VPN with

route add default gw 192.168.10.254

works, but has to be done every time upon connecting and isn't really a solution because probably there is something going something wrong that needs to get fixed.

Any ideas? I've been searching the docs and the web for a few hours and only found issues with wanting to push redirect-gateway.

diggy

Hi,
First of all thank you for the quick reply.
I didn't want to post the logs if not needed because flooding the post makes it harder to read for anyone else having the same issue. I will do so though if needed.

The server and client logs are correct and are the ones in use.

If you read the post carefully at the top I mention:

Port forwarding (NAT) on router publicIP:51194 -> 192.168.1.50:1194

So port 51194 (opened at router firewall) reached via internet is forwarded to port 1194 (opened at server firewall) at the server, thus the configuration files state different ports.

PS. Logs can be retrieved also via

egrep -v '^(#|;|$)' server.conf

. It seems more clean to me. 🙂

diggy

Server log from service restart:

Current Parameter Settings:
  config = 'openvpn.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
Connection profiles [default]:
  proto = udp
  local = '[UNDEF]'
  local_port = 1194
  remote = '[UNDEF]'
  remote_port = 1194
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  connect_retry_seconds = 5
  connect_timeout = 10
  connect_retry_max = 0
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = 0
  socks_proxy_retry = DISABLED
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 0
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 1
  tun_ipv6 = DISABLED
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '10.8.0.2'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 10
  keepalive_timeout = 120
  inactivity_timeout = 0
  ping_send_timeout = 10
  ping_rec_timeout = 240
  ping_rec_timeout_action = 2
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  username = 'nobody'
  groupname = 'nobody'
  chroot_dir = '[UNDEF]'
  cd_dir = '/etc/openvpn/'
  writepid = '/var/run/openvpn/openvpn.pid'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = ENABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  nice = 0
  verbosity = 4
  mute = 0
  gremlin = 0
  status_file = '/var/log/openvpn-status.log'
  status_file_version = 1
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 65536
  sndbuf = 65536
  mark = 0
  sockflags = 0
  fast_io = DISABLED
  lzo = 7
  route_script = '[UNDEF]'
  route_default_gateway = '[UNDEF]'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  max_routes = 100
  allow_pull_fqdn = DISABLED
  route 10.8.0.0/255.255.255.0/nil/nil
  management_addr = '[UNDEF]'
  management_port = 0
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = 0
  ciphername_defined = ENABLED
  ciphername = 'BF-CBC'
  authname_defined = ENABLED
  authname = 'SHA1'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  key_method = 2
  ca_file = '/etc/openvpn/ssl/ca.crt'
  ca_path = '[UNDEF]'
  dh_file = '/etc/openvpn/ssl/dh1024.pem'
  cert_file = '/etc/openvpn/ssl/server.crt'
  priv_key_file = '/etc/openvpn/ssl/server.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 0
  tls_timeout = 2
  renegotiate_bytes = 0
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = '[UNDEF]'
  server_network = 10.8.0.0
  server_netmask = 255.255.255.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'route 192.168.1.0 255.255.255.0'
  push_entry = 'route 10.8.0.1'
  push_entry = 'topology net30'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.4
  ifconfig_pool_end = 10.8.0.251
  ifconfig_pool_netmask = 0.0.0.0
  ifconfig_pool_persist_filename = '/var/run/openvpn/ipp.txt'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = DISABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 5
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  port_share_host = '[UNDEF]'
  port_share_port = 0
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.3.2 x86_64-suse-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on May 31 2013
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Diffie-Hellman initialized with 1024 bit key
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[212992->131072] S=[212992->131072]
ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=enp7s0 HWADDR=00:23:7d:93:a8:6d
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
/bin/ip link set dev tun0 up mtu 1500
/bin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
/bin/ip route add 10.8.0.0/24 via 10.8.0.2
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
GID set to nobody
UID set to nobody
UDPv4 link local (bound): [undef]
UDPv4 link remote: [undef]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
ifconfig_pool_read(), in='nexus,10.8.0.4', TODO: IPv6
succeeded -> ifconfig_pool_set()
ifconfig_pool_read(), in='asusLaptop,10.8.0.8', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
nexus,10.8.0.4
asusLaptop,10.8.0.8
Initialization Sequence Completed
MULTI: multi_create_instance called
46.103.36.212:50131 Re-using SSL/TLS context
46.103.36.212:50131 LZO compression initialized
46.103.36.212:50131 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
46.103.36.212:50131 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
46.103.36.212:50131 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
46.103.36.212:50131 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
46.103.36.212:50131 Local Options hash (VER=V4): '530fdded'
46.103.36.212:50131 Expected Remote Options hash (VER=V4): '41690919'
46.103.36.212:50131 TLS: Initial packet from [AF_INET](deleted public ip):50131, sid=de6df216 a06f6d44
46.103.36.212:50131 VERIFY OK: depth=1, C=GR, ST=Pella, L=GR, O=Tanisfood, OU=IT, CN=server
46.103.36.212:50131 VERIFY OK: depth=0, C=GR, ST=Pella, L=GR, O=Tanisfood, OU=IT, CN=asusLaptop, emailAddress=(deleted email address)
46.103.36.212:50131 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
46.103.36.212:50131 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
46.103.36.212:50131 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
46.103.36.212:50131 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
46.103.36.212:50131 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
46.103.36.212:50131 [asusLaptop] Peer Connection Initiated with [AF_INET]46.103.36.212:50131
asusLaptop/46.103.36.212:50131 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
asusLaptop/46.103.36.212:50131 MULTI: Learn: 10.8.0.10 -> asusLaptop/(deleted public ip):50131
asusLaptop/46.103.36.212:50131 MULTI: primary virtual IP for asusLaptop/(deleted public ip):50131: 10.8.0.10
asusLaptop/46.103.36.212:50131 PUSH: Received control message: 'PUSH_REQUEST'
asusLaptop/46.103.36.212:50131 send_push_reply(): safe_cap=940
asusLaptop/46.103.36.212:50131 SENT CONTROL [asusLaptop]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
asusLaptop/46.103.36.212:50131 MULTI: bad source address from client [192.168.10.1], packet dropped

Client log: Doesn't exist as I'm connecting via KDE Network Manager (imported the client conf file mentioned at first post).

diggy

True about that.
And the fact that the routing issue does not exist when connecting from console via the openVPN client binary made it official.

I do have another issue though, but I'll open another thread.

Thank you again for your sane advice.