Multi Instance Server Routing Help

net_admin

Before I get into the issue here is quick overview of the scenario (and what I have labbed):
I have a dual-wan openvpn server, the dual WAN routing here is setup correctly. One server process for the vpn listening on both wan interfaces.
I am adding secondary connections to the client servers, and I want them to prefer one path over the other - in comes OSPF.

To accommodate this I have split the one OpenVPN server into two processes, each one listening to only one of the wan interfaces. The client connects to each server process concurrently and the routing protocol selects the best path. All is good and this works correctly.

My problem comes because some of the branch offices are not currently participating in ospf. These offices connect to only one of the server instances at a time. This causes a problem with the kernel routing table:

For example I have client test1 with subnet 192.168.1.0/24 behind it. WAN1 has tun0 10.3.0.1 /16 WAN2 has tun1 10.4.0.1 /16.
Client connects to WAN1, and everything works. The route in the kernel routing table shows:
192.168.1.0 via 10.3.0.2 dev tun0
Now the problem - Client connects to WAN2 - the tunnel is initiated, I can ping accross the tunnel endpoints, but the kernel routing table still has:
192.168.1.0/24 via 10.3.0.2 dev tun0 instead of:
192.168.1.0/24 via 10.4.0.2 dev tun1

If I manually delete the route 192.168.1.0 via 10.3.0.2 dev tun0 from the kernel - the new route gets installed and everything is good agian, but it does not happen automatically.

Any ideas? Thanks, Eric

net_admin

I have kept looking at this - It seems like routes are added when the processes is first instantiated. The --client-connect cmd and --client-disconnect cmd may hold the answer for manipulating the kernel routing table for the non-ospf sites. I will need to test it out, but this looks like it may be where I need to look.

Traffic

It would be easier to help if we had some idea of how you configure your servers. 😐

net_admin

Sure, I can post configs when I get back to my lab equipment. My problem is that both server instances have the route 192.168.1.0 255.255.255.0 line in the configs. The first process to start injects the route in the kernel routing table.

What I want is for the route to be injected when the client connects, and removed after a disconnect. My next plan is up/down scripts in ccd files, or the client-connect and client-disconnect config options.

The server is using topology subnet.

net_admin

Here are my two server configs:

local WAN1.IP.Add.rr

port 1194

proto udp

#create routed IP tunnel
dev tun

ca ca.pem
cert testfw.pem
key testfw.pem

dh dh2048.pem

topology subnet
server 10.3.0.0 255.255.0.0

ifconfig-pool-persist ipp.txt

push "route 192.168.2.0 255.255.255.0"

client-config-dir ccd

route 192.168.1.0 255.255.255.0

keepalive 10 120
persist-key
persist-tun
verb 4

ccd:

iroute 192.168.1.0 255.255.255.0
ifconfig-push  10.3.0.62 255.255.0.0

server2.conf:

local WAN2.IP.Add.rr

port 1194

proto udp

#create routed IP tunnel
dev tun

ca ca.pem
cert testfw.pem
key testfw.pem

dh dh2048.pem

topology subnet
server 10.4.0.0 255.255.0.0

ifconfig-pool-persist ipp.txt

push "route 192.168.2.0 255.255.255.0"

client-config-dir ccd2

route 192.168.1.0 255.255.255.0

keepalive 10 120
persist-key
persist-tun
verb 4

ccd2:

iroute 172.30.65.0 255.255.255.0
ifconfig-push  10.4.0.62 255.255.0.0

Both servers are running on the same server at the same time - note route 192.168.1.0 255.255.255.0 in both conf files - the second vpn process to start fails to insert this into the kernel routing table because it is already there from the first process. What I am after is a way to add/remove routes based on when the client cn connects/disconnects.
Thanks, Eric

net_admin

I think I have the workings of a solution to my problem:
To the server1.conf I added the line:
client-connect /etc/openvpn/script/openvpn-connect-script.sh
and also removed the "route 192.168.1.0/24" line from the conf file

#!/bin/env bash

# Env Variables set by OpenVPN
# $common_name=cn of connecting client
# $trusted_ip=remote public ip address
# $dev=tunnel device

function add_route () {
    network=$1
    exist=$(ip route show $network | wc -l)
    if [ $exist -eq 0 ] ; then
        /sbin/ip route add $network via $gateway dev $dev
        echo "$? " >> /etc/openvpn/test.txt
    elif [ $exist -eq 1 ] ; then
        /sbin/ip route change $network via $gateway dev $dev
        echo "$? " >> /etc/openvpn/test.txt
    fi
}

case "$config" in
    "server.conf")
        gateway=10.3.0.2
        ;;
    "server2.conf")
        gateway=10.4.0.2
        ;;
    "*")
        ;;
esac


case "$common_name" in
    "test-remote-fw")
        add_route "192.168.1.0/24"
        ;;
    "*")
        ;;

esac
exit 0

This script adds the route to the kernel routing table when the client connects, if the route is already there, it is changed to the correct gateway. I do not think I want to delve into removing the route after a tunnel disconnect - it could get messy to make sure that the route currently being deleted wasn't one that was just installed from the other server instance.

Traffic

You may want to See --explicit-exit-notify in The Manual v23x