Hi I am seeing the below error in my logs, and want to get the rid of it.
20160315 09:12:52 CLIENT1/xxx.xxx.xxx.xxx:58776 MULTI: bad source address from client [yyy.yyy.yyy.yyy] packet dropped
What this usually means is that openvpn cannot find route back to yyy.yyy.yyy.yyy because its an address on the remote LAN.
But why is openvpn seeing this address at all since it gave yyy.yyy.yyy.yyy an openvpn provisioned ip of zzz.zzz.zzz.zzz which it knows how to route back too.
I must say that these errrors only seem to show up for a couple mins during the connecting phase.
My guess is that the remote client during connecting when told to send all traffic thru the vpn it also sends some sort of traffic meant for the local network.
I know about ccd but this is a phone connecting to the vpn and it can connect from anywhere at anytime so you see i dont know in advance what the network i will be connecting from will be, so i cant create a ccd for that i dont know.
Please note that the vpn works for what i intended though, that is access the internet thru the vpn. But these errors in the log bother me so I have thought about this.
What about adding these lines to the client config. They should never be internet routeable.
route 10.0.0.0 255.0.0.0 net_gateway
route 172.16.0.0 255.240.0.0 net_gateway
route 192.168.0.0 255.255.0.0 net_gateway
which means that no matter what local lan i connect from traffic meant for local lan will go to the correct place of the net_gateway and all other traffic to the vpn.
but i forsee one issue. I want the phone to use a dns behind the openvpn so i already have
push "route 10.0.1.1 255.255.255.255"
push "dhcp-option DNS 10.0.1.1"
So i think this will conflict with route 10.0.0.0 255.0.0.0 net_gateway above
How can I solve this nicely.
Also I dont want to add the three net_gateway lines to every client file. I would like to add them to the server instead to be pushed to client. would it be
push "route 10.0.0.0 255.0.0.0 net_gateway" if i wanted to put in server config file instead?
