redirect-gateway to a second tunnel breaks the first tunnel

total0verride

I am running an openvpn server to which my client connects and gets assigned the 10.8.0.6 ip. After that it connects to another openvpn server (10.8.0.10) which is connected to the same "original" server (10.8.0.1). The first server essentially just puts me on the same subnet as the second server (second server doesn't have a static ip and can't be port forwarded). My goal is to route all traffic through the second server.

It works fine when connected without redirect-gateway. I can ping everything on the 10.8.0.0/24 subnet (first server, tun0), and the 10.9.0.0/24 subnet (second server, tun1).

But when I add redirect-gateway, specifically, when the client adds the 0.0.0.0/1 and 128.0.0.0/1 routing tables, all the connections break. I can't ping the first server OR the second server, or anything outside.

This is the ifconfig on my client:

eth1      Link encap:Ethernet  HWaddr 54:04:a6:49:99:16  
          inet addr:192.168.0.12  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::5604:a6ff:fe49:9916/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:33325389 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19876569 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:38511610122 (38.5 GB)  TX bytes:5030880286 (5.0 GB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1532251 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1532251 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:128544929 (128.5 MB)  TX bytes:128544929 (128.5 MB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:113 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1663663 errors:0 dropped:489668 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:14523 (14.5 KB)  TX bytes:1140762511 (1.1 GB)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.0.6  P-t-P:10.9.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:4 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1623870 errors:0 dropped:570939 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:828 (828.0 B)  TX bytes:1130753499 (1.1 GB)

This is my clients ip route before redirect-gateway:

default via 192.168.0.1 dev eth1  proto static 
10.8.0.0/24 via 10.8.0.5 dev tun0 
10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6 
10.9.0.0/24 via 10.9.0.5 dev tun1 
10.9.0.5 dev tun1  proto kernel  scope link  src 10.9.0.6 
192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.12  metric 1 
192.168.1.0/24 via 10.8.0.5 dev tun0

These are all the config files. (I'll omit irrelevant or default settings)

main > the main client that is trying to achieve internet traffic routing
alpha > the server that puts everyone on the same subnet
beta > the server/client that main wants to route it's traffic through. (note, beta doesn't have a static ip and cannot be port forwaded)

alpha server.conf

port 443
proto udp
dev tun
server 10.8.0.0 255.255.255.0
client-to-client
# broadcast beta's subnet
route 192.168.1.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"

beta client.conf (used to connect to alpha server)

client
dev tun
proto udp
remote [alpha IP] 443

beta server.conf (the traffic should be routed through this server)

port 444
proto udp
dev tun
server 10.9.0.0 255.255.255.0
client-to-client
push "redirect-gateway local def1"
push "dhcp-option DNS 8.8.8.8"

main alpha client.conf

client
dev tun
proto udp
remote [alpha IP] 443

main beta client.conf

client
dev tun
proto udp
remote 10.8.0.10 444

Any help would be appreciated

total0verride

Traffic wroteWhen you redirect your gateway over the first tunnel this will break the second tunnel routing.

Read about --redirect-gateway in The Manual v23x

I've configured this to work before. I just can't replicate it.

There is a way.

total0verride

I attempted to use a reverse SSH tunnel on the alpha server instead of using an intermediately openvpn server, but I had the exact same problem.

I tunneled from beta like this

ssh -Nf -R \*:444:localhost:444 root@[alpha IP]

And changed the main client.conf to connect to [alpha IP]:444 instead of 10.8.0.10.

The configuration worked perfectly without redirect-gateway, but as soon as redirect-gateway added the 0.0.0.0/1 and 128.0.0.0/1 routes, I couldn't ping anywhere again.