Hello, I've a problem with my openpn configuration. The VPN runs on 2 native Debian Linux Systems, the server has no static ip, so dyndns is needed. Everything runs fine, until the server changes it's IP. The tunnel brakes down, but the routes where not set back to clients defaults. -> No connection to internet, not able to resolve hostname How can I force openvpn to reset to default routes, if the tunnel brakes down? [code]Fri Oct 7 10:28:35 2016 us=647395 RESOLVE: Cannot resolve host address: xxx.biz: [TRY_AGAIN] A temporary error occurred on an authoritative name server. Fri Oct 7 10:29:20 2016 us=683917 RESOLVE: signal received during DNS resolution attempt Fri Oct 7 10:29:20 2016 us=684652 TCP/UDP: Closing socket [/code] Here is my config: Server: [code]port 1194 proto udp dev tun0 ca /tmp/openvpn/ca.crt cert /tmp/openvpn/cert.pem key /tmp/openvpn/key.pem dh /tmp/openvpn/dh.pem server 10.9.8.0 255.255.255.0 push "redirect-gateway" push "route 192.168.0.0 255.255.255.0" keepalive 10 120 comp-lzo persist-key persist-tun verb 3 client-config-dir /tmp/openvpn/ccd route 192.168.10.0 255.255.255.0 client-to-client [/code] Client: [code]client dev tun proto udp remote xxxx.biz port 1194 nobind ca /etc/openvpn/easy-rsa2/keys/ca.crt cert /etc/openvpn/easy-rsa2/keys/client1.crt key /etc/openvpn/easy-rsa2/keys/client1.key comp-lzo verb 4 ping 15 resolv-retry 300 persist-key persist-tun script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf[/code]

See [b]--redirect-gateway def1[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url] .. Read it carefully.

Try this in your server config: [code]push "redirect-gateway def1" keepalive 5 30[/code]

[quote="ueker123"]Looks like a bug for me and not for a config problem[/quote]It is a configuration problem [u]not[/u] a bug .. [quote="ueker123"]Maybe i should reinstall in debian 8 instead of 7[/quote]No reason to do this .. [quote="ueker123"]It's openvpn's task to reset the routes when connection [b]is lost[/b], but it doesnt[/quote][quote="ueker123"]the manual says: "When the tunnel [b]is torn down[/b], all of the above steps are reversed so that the original default route is restored. "[/quote]The tunnel is not [i]torn down[/i] when the connection [i]is lost[/i] because you also have:[oconf=CLIENT]persist-key persist-tun[/oconf]remove these from your client.

[Solved] redirect gateway - Routes not changed to defaults if connection is interuptet

ueker123

Hello,

I've a problem with my openpn configuration.
The VPN runs on 2 native Debian Linux Systems, the server has no static ip, so dyndns is needed.
Everything runs fine, until the server changes it's IP.

The tunnel brakes down, but the routes where not set back to clients defaults.
-> No connection to internet, not able to resolve hostname

How can I force openvpn to reset to default routes, if the tunnel brakes down?

Fri Oct  7 10:28:35 2016 us=647395 RESOLVE: Cannot resolve host address: xxx.biz: [TRY_AGAIN] A temporary error occurred on an authoritative name server.
Fri Oct  7 10:29:20 2016 us=683917 RESOLVE: signal received during DNS resolution attempt
Fri Oct  7 10:29:20 2016 us=684652 TCP/UDP: Closing socket

Here is my config:

Server:

port 1194
proto udp
dev tun0
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
dh /tmp/openvpn/dh.pem
server 10.9.8.0 255.255.255.0
push "redirect-gateway"
push "route 192.168.0.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
client-config-dir /tmp/openvpn/ccd
route 192.168.10.0 255.255.255.0
client-to-client

Client:

client
dev tun
proto udp
remote xxxx.biz
port 1194
nobind
ca /etc/openvpn/easy-rsa2/keys/ca.crt
cert /etc/openvpn/easy-rsa2/keys/client1.crt
key /etc/openvpn/easy-rsa2/keys/client1.key
comp-lzo
verb 4
ping 15
resolv-retry 300
persist-key
persist-tun
script-security 2
up   /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

TinCanTech

See --redirect-gateway def1 in The Manual v23x
.. Read it carefully.

ueker123

Thank you for your quick answer.
I already read this before and I tried to solve with the def1 flag.

But it doesn't change anything :?:

Routing-Table openvpn deactivated (also after I killed the process):

Kernel-IP-Routentabelle
Ziel Router Genmask Flags MSS Fenster irtt Iface
0.0.0.0 192.168.10.1 0.0.0.0 UG 0 0 0 eth0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

With activated vpn (also if connection broken down):

Kernel-IP-Routentabelle
Ziel Router Genmask Flags MSS Fenster irtt Iface
0.0.0.0 10.9.8.10 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.10.1 0.0.0.0 UG 0 0 0 eth0
x.xx.xx.105 192.168.10.1 255.255.255.255 UGH 0 0 0 eth0
10.9.8.0 10.9.8.10 255.255.255.0 UG 0 0 0 tun0
10.9.8.10 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
128.0.0.0 10.9.8.10 128.0.0.0 UG 0 0 0 tun0
192.168.0.0 10.9.8.10 255.255.255.0 UG 0 0 0 tun0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

The problem is, that routes where not set to defaults, when connection is interuptet, also the manual says:
"When the tunnel is torn down, all of the above steps are reversed so that the original default route is restored. "

If there is anything I didn't recognize please help :?

TinCanTech

Try this in your server config:

push "redirect-gateway def1"
keepalive 5 30

ueker123

Problem not solved with this settings...

I just added a static route to 8.8.8.8 through the default gateway 192.168.10.1.
Now openvpn resolves the hostname correctly, but wants to use the 10.9.8.10 gateway to connect -> Not working
Maybe i should reinstall in debian 8 instead of 7. Looks like a bug for me and not for a config problem.

It's openvpn's task to reset the routes when connection is lost, but it doesnt.

TinCanTech

ueker123 wroteLooks like a bug for me and not for a config problem

It is a configuration problem not a bug ..

ueker123 wroteMaybe i should reinstall in debian 8 instead of 7

No reason to do this ..

ueker123 wroteIt's openvpn's task to reset the routes when connection is lost, but it doesnt

ueker123 wrotethe manual says:
"When the tunnel is torn down, all of the above steps are reversed so that the original default route is restored. "

The tunnel is not torn down when the connection is lost because you also have:persist-key
persist-tunremove these from your client.

ueker123

You saved my weekend.
Thanks a lot, that was the misstake.

TinCanTech

Good news 8-) .. Thank you for letting us know the problem is solved.