"bad source address" errors with dynamic real source IP

kninja

I am connecting to my openvpn server using the openvpn for android client, the connection works and I can browse the internet, but the vpn server logs are filling up with errors like

Fri Sep 26 20:56:12 2014 us=923853 client/x.x.x.x:1194 MULTI: bad source address from client [10.y.y.y], packet dropped

x.x.x.x is the public IP my phone appears from, and 10.y.y.y is the actual IP address on my rmnet0 (3g) interface on the phone.

Firstly, I think this must be some kind of bug because really, the server should never see the 10.y.y.y address, everything routed through the tunnel should come from the tunnel IP, and the tunnel itself should be connecting from x.x.x.x

However I am attempting to work around this by adding the appropriate host route to the openvpn configuration. I realise the problem is that the server does not know how to route to 10.y.y.y, but the documented fix of "put a route in the ccd file" does not apply in this case because the IP address is dynamically assigned by the phone carrier, and to make matters worse, it changes not just subnets but entire address blocks depending on what cell I am on (sometimes 10.y.y.y, other times it will be 100.64.z.z, etc).

I am trying to use a client connect script to add a route to the server and an iroute command to the client config, but the problem is there doesn't seem to be an openvpn variable for the real ip address assigned to the interface which the tunnel is bound too. $trusted_ip gives me the x.x.x.x public address the server sees, and $ifconfig_remote gives me the IP address of the tunnel interface on the phone...

So can anyone offer any suggestions as to how I can resolve this issue? I have been searching online for days and am surprised no one else seems to be having this problem...

Thanks

Traffic

kninja wroteMULTI: bad source address from client [10.y.y.y], packet dropped

This can be safely ignored.

https://community.openvpn.net/openvpn/wiki/317-qmulti-bad-source-address-from-client--packet-droppedq-or-qget-inst-by-virt-failedq

kninja wrotethe documented fix of "put a route in the ccd file" does not apply in this case because the IP address is dynamically assigned by the phone carrier, and to make matters worse, it changes not just subnets but entire address blocks depending on what cell I am on (sometimes 10.y.y.y, other times it will be 100.64.z.z, etc).

if you really want to stop this you can add --iroute directives for all the possible networks your client will be on in the CCD file.
And routing to your server config.

kninja

Yes, I know I need to add iroutes but the question is how, when the network i need to add the route for is dynamic. I'm not talking about just the address changing, the whole network address is different. Effectively I need a way for the openvpn server to be able to execute commands on the client to get the IP address of the client and then inject an iroute for that...

Traffic

Or you can safely ignore it.
Or you can determine the process using the wrong source IP address.
Or you can add iroutes for ALL possible networks that your client may get.

Personally, I would just ignore it.