reinaldo.gomes
I"ve set up an OpenVPN server which listens on two interfaces. The server itself accepts connections from two internet links, and pfSense handles it just fine. I also have 2 "remote" entries in my client config, so that it can connect through either link. Finally, I must use the option to "force traffic through the tunnel". And that's when my problem begins.
Upon connection establishment, I only get a specific route to ONE of my links (the one to which I get connected to). In this situation, whenever my first link fails and the client tries a soft reconnect, it has no specific route to my second link, thus it can't connect because the "force traffic through the tunnel" route will send it through the wrong interface. Things work fine if I do a hard (manual) reconnect, since the routing tables gets flushed and rebuilt.
So my question is how can I automatically add routes to as many links (remotes) as I might have? I know I can push routes to the clients, but should my IP address change, I would have to change it in the server config, potentially causing unavailability. So how can I add routes based on my remote entries?
The Johan
This appears to be a use-case we haven't quite foreseen. As you've seen, a /32 route is added for specifically that IP address that your Access Server can be reached on. If you want to add such a similar route for another IP address, which should go through your default gateway instead of the VPN tunnel, you could try pushing such a route from the server. To do this go to the Admin UI, go to Advanced VPN, and go to the Server Config Directives field. Please note that this field is not checked for errors, and if you make an error here, the server could fail to start. So make backups of /usr/local/openvpn_as/etc/db/ files before you try any of this.
Then enter this in the server config directives field:
push "route 123.45.67.89 255.255.255.255 net_gateway"
The IP address 123.45.67.89 with mask 255.255.255.255 (123.45.67.89/32) would then be the other IP address you want to have sent through the default gateway at the client side. The name 'net_gateway' is an internal name that the client will convert to whatever the default gateway IP address is on the client side.
Then save settings and update running servers. You should then be reconnected and the route should be implemented.
reinaldo.gomes
Yes, I'm aware of that workaround, and I've tested it already. But thanks anyway. I just wanted something a bit more "fail-proof", since these pushed routes would have to be updated should the server's IP addresses change.
I've also noticed that removing the "persist-tun" is another workaround for this, as it removes the tun interface upon SIGUSR1, which refreshes the routing table.
Even so, I think it would be great if the client could just automatically add one specific route for each remote entry, by default.
The Johan
At this time what you want is not supported, sorry.
