petiepooo
Hello all.
Is there a way to add internal routes (like a ccd file's iroute directive) without bouncing the connection from the client which the route would be going to?
Say for example, we have the following setup:
Server IP: 192.168.0.1
Client IP: 192.168.7.1
Neighbor IP: 192.168.7.2
VPN subnet: 10.0.0.0/24
When the VPN comes up, tun0 on the server is 10.0.0.1, tun0 on the client is 10.0.0.6.
Now say I want the server to be able to reach the neighbor (I'm using host routes here for simplicity). We need a static route on the neighbor so it knows to send packets going to the server via the vpn client:
ip route add 192.168.0.1/32 via 192.168.7.1
(or using the older route command: route add -host 192.168.0.1 gw 192.168.7.1)
Then I would normally add
route 192.168.7.1 255.255.255.255
to the server's config, and
iroute 192.168.7.1 255.255.255.255
to the client's ccd entry on the server. The first adds a route for 192.168.7.1 in the server's kernel routing table, whereas the second adds the openvpn server's internal route so it knows which client to send it to.
To get these changes to take effect means restarting the openvpn server service to let it add the linux route, and restarting the client so that when it connects the iroute is added.
Lets say there are other things using that VPN line, however, and I don't want to restart it. To avoid the server restart, I can manually add a route to the linux routing table with the command
ip route add 192.168.7.1/32 via 10.0.0.2
which gets the neighbor's packets into the openvpn server process. However, with no iroute, the server doesn't know what to do with it next, and the packet will be dropped. A HUP on the client will restart the process and force the ccd to be reread, but lets say there are other things using this link that I cannot interrupt, or some other reason for not wanting to bounce the client.
Is there an easy way to manipulate the OpenVPN server service's internal routing table? I know I can dump the status to a file and that shows the internal routing entries, but I know of no way short of ccdfile and bounce to add new ones. I envision something such as
openvpn-route add 192.168.7.1/32 via 10.0.0.6
or something using a format similar to the existing ip route format. Even an "iroute" command for the management interface would be great, as the rest could be scripted around that.
Assuming the answer is no, and although I doubt I'll have time anytime soon, if I developed the capability, would a patch that adds this capability be well received?
Thanks!
