From the docs: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage [quote] --redirect-gateway flags... ... def1 -- Use this flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. ... [/quote] I do some tests about the [url=https://torrentfreak.com/huge-security-flaw-leaks-vpn-users-real-ip-addresses-150130/]WebRTC Leak[/url] issue. If i use 'def1' i have the leak under Windows. If i use 'def1' and after the connection i manually delete the 0.0.0.0/0.0.0.0 route, i don't have the leak. If i don't use the 'def1' i don't have the leak. So, Windows bypass the two overriding rules in some cases. Today is WebRTC, but can be exists other cases. This is a bug of OpenVPN, or at least the docs need a disclaimer like 'This may not works in every cases'.

redirect-gateway, def1, webrtc leak

Clodo

From the docs:
https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

--redirect-gateway flags...
...
def1 -- Use this flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway.
...

I do some tests about the WebRTC Leak issue.

If i use 'def1' i have the leak under Windows.
If i use 'def1' and after the connection i manually delete the 0.0.0.0/0.0.0.0 route, i don't have the leak.
If i don't use the 'def1' i don't have the leak.

So, Windows bypass the two overriding rules in some cases. Today is WebRTC, but can be exists other cases.

This is a bug of OpenVPN, or at least the docs need a disclaimer like 'This may not works in every cases'.

maikcat

are you aware how webrtc chooses the route to send internet packets?

Michael.

Clodo

The STUN (Session Traversal Utilities for Nat) in the case of WebRTC leak is used to discover IP.
Probably Windows queries all interfaces, and for each one it considers only the specific route to each interface.

Do you know any disadvantage of not using 'def1'?
I'm trying to understand why OpenVPN offers this 'def1' feature (overriding) instead of the basic approach (wiping out), pros & cons, and recommended approach.
Thanks for any feedback.

maikcat

Do you know any disadvantage of not using 'def1'?

one and only,

openvpn was unable to restore your default gateway after openvpn disconnected
leaving the client without internet...

Michael.

Clodo

maikcat wrote openvpn was unable to restore your default gateway after openvpn disconnected
leaving the client without internet...

This occur only if OpenVPN crash or is killed ungracefully. Otherwise OpenVPN restore the default gateway (in a configuration that don't use def1).

I write a Reddit about my research and opinion, if anyone is interested: http://www.reddit.com/r/VPN/comments/32d94q/an_alternative_approach_to_socalled_webrtc_leaks/ .

maikcat

Otherwise OpenVPN restore the default gateway

Yes that is supposed to happened but in some cases, OpenVPN was unable to
determine the existing default route. This often happened to clients connecting through UMTS.

Michael.