Route and route-ipv6 directives in Openvpn client configuration

r4w

Hi,

I'm using Openvpn server/client and in the past I have used the route directive in the Openvpn CLIENT to keep my local lan accessible while connected via VPN.

For example:

route 192.168.50.0 255.255.255.0 192.168.50.254

while I redirect all the remaining traffic to the VPN using:

redirect-gateway def1

This is working well.

Now, I'm trying to do the same with IPV6. I have native IPV6 provided by my ISP and I'm providing as well an IPV6 address and route 2000::/3 in my OpenVPN server config, so all the IPV6 traffic will be routed over the VPN.
This works as well, but then I cannot access anymore my local IPV6 subnet.

I have checked this and other information on Internet without finding how to specify a particular route as I'm able to do for IPV4.

I have tried the following directive:

route-ipv6 2a02:fff:f200:100::/56 fe80::f50:5fff:ff88:3f62

As my ISP provides me with a /56 network and I would like to keep accessing it locally.
I don't see any particular error in the log but the directive doesn't get run either.

Is there any other way to accomplish what I'm trying to do?
I didn't try to set up a persistent route in Windows for my IPV6 network, I believe it should work, but I would prefer a dynamic configuration instead.

Thank you in advance and I hope I have provided enough information 🙂

Traffic

r4w wroteI don't see any particular error in the log

Neither do we .. but that is because we have no configs or logs :roll:

Please see the Forum rules (top of this page)

r4w

Traffic wrote
r4w wroteI don't see any particular error in the log
Neither do we .. but that is because we have no configs or logs :roll:

Please see the Forum rules (top of this page)

Hi Traffic,

I have read the rules before post, but I didn't feel the logs is providing much infos.

I have provided only part of the config I'm working on and it should be enough, but here is my full config:

Server:

local xxx.xxx.xxx.xxx
port xxx
proto tcp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  
dh /etc/openvpn/dh1024.pem
server 192.168.30.0 255.255.255.0
topology subnet
server-ipv6 2fff:2fff:f:f:1::/80
tun-ipv6
push "route-ipv6 2000::/3"
ifconfig-pool-persist /etc/openvpn/ipp.txt
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
cipher BF-CBC        # Blowfish (default)
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
daemon

Client:

client
dev tun
proto tcp
remote xxx.xxx.xxx.xxx xxx
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert cert.crt
key key.key
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3
remote-cert-tls server
keepalive 10 60
ping-timer-rem

# the client is a diverse subnet than 192.168.50.0, so I want that to be routed locally through the local gateway.
route 192.168.50.0 255.255.255.0 192.168.20.254

# as above, I'm trying to route my other IPV6 subnet locally, but this doesn't work for me.
route-ipv6 route-ipv6 2a02:fff:f200:100::/56 fe80::f50:5fff:ff88:3f62

redirect-gateway def1

Relevant log sanitized:

Fri Apr 29 11:08:08 2016 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 10 2016
Fri Apr 29 11:08:08 2016 Windows version 6.2 (Windows 8 or greater)
Fri Apr 29 11:08:08 2016 library versions: OpenSSL 1.0.1s  1 Mar 2016, LZO 2.09
Enter Management Password:
Fri Apr 29 11:08:08 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Apr 29 11:08:08 2016 Need hold release from management interface, waiting...
Fri Apr 29 11:08:08 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Apr 29 11:08:08 2016 MANAGEMENT: CMD 'state on'
Fri Apr 29 11:08:08 2016 MANAGEMENT: CMD 'log all on'
Fri Apr 29 11:08:08 2016 MANAGEMENT: CMD 'hold off'
Fri Apr 29 11:08:08 2016 MANAGEMENT: CMD 'hold release'
Fri Apr 29 11:08:09 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Fri Apr 29 11:08:09 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 29 11:08:09 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 29 11:08:09 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Apr 29 11:08:09 2016 MANAGEMENT: >STATE:1461924489,RESOLVE,,,
Fri Apr 29 11:08:09 2016 Attempting to establish TCP connection with [AF_INET]xxx.xxx.xxx.xxx:xxx [nonblock]
Fri Apr 29 11:08:09 2016 MANAGEMENT: >STATE:1461924489,TCP_CONNECT,,,
Fri Apr 29 11:08:10 2016 TCP connection established with [AF_INET]xxx.xxx.xxx.xxx:xxx
Fri Apr 29 11:08:10 2016 TCPv4_CLIENT link local: [undef]
Fri Apr 29 11:08:10 2016 TCPv4_CLIENT link remote: [AF_INET]xxx.xxx.xxx.xxx:xxx
Fri Apr 29 11:08:10 2016 MANAGEMENT: >STATE:1461924490,WAIT,,,
Fri Apr 29 11:08:10 2016 MANAGEMENT: >STATE:1461924490,AUTH,,,
Fri Apr 29 11:08:10 2016 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:xxx, sid=1394bb09 a8cf7581
Fri Apr 29 11:08:10 2016 VERIFY OK: depth=1, C=IT, ST=.....
Fri Apr 29 11:08:10 2016 Validating certificate key usage
Fri Apr 29 11:08:10 2016 ++ Certificate has key usage  00a0, expects 00a0
Fri Apr 29 11:08:10 2016 VERIFY KU OK
Fri Apr 29 11:08:10 2016 Validating certificate extended key usage
Fri Apr 29 11:08:10 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Apr 29 11:08:10 2016 VERIFY EKU OK
Fri Apr 29 11:08:10 2016 VERIFY OK: depth=0, C=IT, ST=.....
Fri Apr 29 11:08:10 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Apr 29 11:08:10 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 29 11:08:10 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Apr 29 11:08:10 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 29 11:08:10 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Fri Apr 29 11:08:10 2016 [fireblade] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:xxx
Fri Apr 29 11:08:11 2016 MANAGEMENT: >STATE:1461924491,GET_CONFIG,,,
Fri Apr 29 11:08:12 2016 SENT CONTROL [fireblade]: 'PUSH_REQUEST' (status=1)
Fri Apr 29 11:08:12 2016 PUSH: Received control message: 'PUSH_REPLY,ifconfig-ipv6 2fff:2fff:f:f:1::1002/80 2fff:2fff:f:f:1::1,route-ipv6 2000::/3,tun-ipv6,route-gateway 192.168.30.1,topology subnet,ping 10,ping-restart 120,ifconfig 192.168.30.4 255.255.255.0'
Fri Apr 29 11:08:12 2016 OPTIONS IMPORT: timers and/or timeouts modified
Fri Apr 29 11:08:12 2016 OPTIONS IMPORT: --ifconfig/up options modified
Fri Apr 29 11:08:12 2016 OPTIONS IMPORT: route options modified
Fri Apr 29 11:08:12 2016 OPTIONS IMPORT: route-related options modified
Fri Apr 29 11:08:12 2016 ROUTE_GATEWAY 192.168.20.254/255.255.255.0 I=2 HWADDR=....
Fri Apr 29 11:08:12 2016 ROUTE6: default_gateway=UNDEF
Fri Apr 29 11:08:12 2016 do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
Fri Apr 29 11:08:12 2016 MANAGEMENT: >STATE:1461924492,ASSIGN_IP,,192.168.20.4,
Fri Apr 29 11:08:13 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ipv6 set address interface=7 2a02:29e0:2:5:1::1002 store=active
Fri Apr 29 11:08:13 2016 add_route_ipv6(2fff:2fff:f:f:1::/80 -> 2fff:2fff:f:f:1::1002 metric 0) dev Ethernet
Fri Apr 29 11:08:13 2016 C:\WINDOWS\system32\netsh.exe interface ipv6 add route 2fff:2fff:f:f:1::/80 interface=7 fe80::8 store=active
Fri Apr 29 11:08:13 2016 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Apr 29 11:08:13 2016 open_tun, tt->ipv6=1
Fri Apr 29 11:08:13 2016 TAP-WIN32 device [Ethernet] opened: \\.\Global\{A0B28E1B-7589-48B6-9541-85F5BF51EC28}.tap
Fri Apr 29 11:08:13 2016 TAP-Windows Driver Version 9.21 
Fri Apr 29 11:08:13 2016 Set TAP-Windows TUN subnet mode network/local/netmask = 192.168.30.0/192.168.30.4/255.255.255.0 [SUCCEEDED]
Fri Apr 29 11:08:13 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.30.4/255.255.255.0 on interface {A0B28E1B-7589-48B6-9541-85F5BF51EC28} [DHCP-serv: 192.168.30.254, lease-time: 31536000]
Fri Apr 29 11:08:13 2016 Successful ARP Flush on interface [7] {A0B28E1B-7589-48B6-9541-85F5BF51EC28}
Fri Apr 29 11:08:18 2016 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Fri Apr 29 11:08:18 2016 C:\WINDOWS\system32\route.exe ADD xxx.xxx.xxx.xxx MASK 255.255.255.255 192.168.20.254
Fri Apr 29 11:08:18 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=5 and dwForwardType=4
Fri Apr 29 11:08:18 2016 Route addition via IPAPI succeeded [adaptive]
Fri Apr 29 11:08:18 2016 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.223.1
Fri Apr 29 11:08:18 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Fri Apr 29 11:08:18 2016 Route addition via IPAPI succeeded [adaptive]
Fri Apr 29 11:08:18 2016 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.223.1
Fri Apr 29 11:08:18 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Fri Apr 29 11:08:18 2016 Route addition via IPAPI succeeded [adaptive]
Fri Apr 29 11:08:18 2016 MANAGEMENT: >STATE:1461924498,ADD_ROUTES,,,
Fri Apr 29 11:08:18 2016 C:\WINDOWS\system32\route.exe ADD 192.168.50.0 MASK 255.255.255.0 192.168.20.254
Fri Apr 29 11:08:18 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=5 and dwForwardType=4
Fri Apr 29 11:08:18 2016 Route addition via IPAPI succeeded [adaptive]
Fri Apr 29 11:08:18 2016 add_route_ipv6(2a02:fff:f200:100::/56 -> fe80::250:56ff:fe88:3262 metric -1) dev Ethernet
Fri Apr 29 11:08:18 2016 C:\WINDOWS\system32\netsh.exe interface ipv6 add route 2a02:fff:f200:100::/56 interface=7 fe80::8 store=active
Fri Apr 29 11:08:18 2016 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Apr 29 11:08:18 2016 add_route_ipv6(2000::/3 ->2fff:2fff:f:f:1::1 metric -1) dev Ethernet
Fri Apr 29 11:08:18 2016 C:\WINDOWS\system32\netsh.exe interface ipv6 add route 2000::/3 interface=7 fe80::8 store=active
Fri Apr 29 11:08:18 2016 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Apr 29 11:08:18 2016 Initialization Sequence Completed
Fri Apr 29 11:08:18 2016 MANAGEMENT: >STATE:1461924498,CONNECTED,SUCCESS,192.168.30.4,xxx.xxx.xxx.xxx

Routing tables after connection (only relevant entries for this problem):

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.20.254    192.168.20.10    261
          0.0.0.0        128.0.0.0    192.168.30.1    192.168.30.4     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0    192.168.30.1    192.168.30.4     20
    xxx.xxx.xxx.xxx  255.255.255.255   192.168.20.254    192.168.20.10      5
      192.168.50.0    255.255.255.0   192.168.20.254    192.168.20.10      5 <---- This is working, the route directive is in place with right gateway
      
      
IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  2     21 ::/0                     fe80::f50:5fff:ff88:3f62
  1    306 ::1/128                  On-link
  7    276 2000::/3                 fe80::8
  7    276 2a02:fff:f200:100::/56   fe80::8 <---- This is not working, my /56 class is routed through the VPN instead of my local gateway. As said, it seems that the directive got ignored or not accepting a gateway input.
  2     21 2a02:fff:f200:102::/64   On-link
  2    261 2a02:fff:f200:102:905d:d99a:770b:d220/128
                                    On-link
  2    261 2a02:fff:f200:102:e012:4ffb:82d7:39b6/128
                                    On-link
  2    261 2a02:fff:f200:102:e163:d70d:5b35:707c/128
                                    On-link
  7    276 2fff:2fff:f:f::/64       On-link
  7    276 2fff:2fff:f:f:1::/80     fe80::8

I hope I have included all the information needed this time, if not please let me know if you need anything else 🙂

r4w

Hi!, Do you have any suggestion after my last update here ? 🙂

Thank you!

Traffic

IPv4 redirect-gateway:

r4w wroteFor example:

route 192.168.50.0 255.255.255.0 192.168.50.254

while I redirect all the remaining traffic to the VPN using:

redirect-gateway def1

You do not need this route as the default local LAN route will take precedence over the --redirect-gateway def1 directive.

See --redirect-gateway in The Manual v23x

IPv6 redirect-gateway:

(Openvpn 2.3x does not support redirect-gateway ipv6 .. It is expected to be available in v2.4x)

r4w wroteI have tried the following directive:

route-ipv6 2a02:fff:f200:100::/56 fe80::f50:5fff:ff88:3f62

As my ISP provides me with a /56 network and I would like to keep accessing it locally.

You do not need this route and this may even be the cause of the problem .. post details of route -6

Also:

r4w wrote# as above, I'm trying to route my other IPV6 subnet locally, but this doesn't work for me.
route-ipv6 route-ipv6 2a02:fff:f200:100::/56 fe80::f50:5fff:ff88:3f62

I presume this is just a typo ..

r4w

Hi Traffic,

Thanks for the response.

I need route 192.168.50.0 255.255.255.0 192.168.50.254 as I have two subnets that i want to be routed internally.
Let's say that my interface has 192.168.49.10, so the 192.168.49.0 is taken care automatically.
However, 192.168.50.0 will be routed through the VPN gateway if I don't specify that route.
Anyway, this works perfectly for me.

You said: "Openvpn 2.3x does not support redirect-gateway ipv6".

I think this may be why I have this issue with IPV6, as I'm not able to specify a gateway with route-ipv6 at the moment.

IPV6 route print is posted above, route-ipv6 route-ipv6 2a02:fff:f200:100::/56 fe80::f50:5fff:ff88:3f62 was only a typo, in my config I have route-ipv6 declared only one time.

I think that the only solution I have is to wait for 2.4 then..

Any other idea is welcome 🙂

Traffic

r4w wroteI need route 192.168.50.0 255.255.255.0 192.168.50.254 as I have two subnets that i want to be routed internally

OK ..

r4w wroteroute-ipv6 2a02:fff:f200:100::/56 fe80::f50:5fff:ff88:3f62

Replace this with a gateway ..

r4w

Hi Traffic,

Sorry for the typo in my previous posts, I'm trying to mask my IPs and I didn't get all right:

route 192.168.50.0 255.255.255.0 192.168.50.254 is route 192.168.50.0 255.255.255.0 192.168.49.254 (otherwise it will not make sense with that gateway).

fe80::f50:5fff:ff88:3f62 is my internal gateway.

From the the IPV6 routing table above:

2 21 ::/0 fe80::f50:5fff:ff88:3f62

but it's getting ignored or the route-ipv6 command doesn't accept a gateway in input and routes that through the VPN gateway instead.:

7 276 2a02:fff:f200:100::/56 fe80::8

I didn't find any example that it's using a gateway, mainly I checked this document here: https://community.openvpn.net/openvpn/wiki/IPv6 and a lot of Google searching.

Thank you again.

Traffic

r4w wrotefe80::f50:5fff:ff88:3f62 is my internal gateway

This is not a gateway it is a link local ..

Example:

r4w wroteroute 192.168.50.0 255.255.255.0 192.168.50.254

192.168.50.254 is a gateway ..

Do the same with IPv6.

r4w

Hi Traffic,

The Link local address is configured automatically on both Windows and Linux machines and it's recommended over the use of a Global unicast IPV6 address.

That said, I have tried my router unicast IPV6 address and the routing table didn't change:

7 276 2a02:fff:f200:100::/56 fe80::8

My IPV6 network is still routed through the VPN.

Everything suggests that the route-ipv6 command doesn't accept a gateway as input, but strangely enough it doesn't thrown an error as I was expecting if the syntax is wrong.

Weird, isn't it?

Thanks!