Hello to everyone, I have the following problem (simplified): I have two LANs (192.168.0.0/24 and 192.168.6.0/24). The machine 192.168.0.249 is present in the internet with a public IP and has a openvpn server running. On 192.168.6.2 there is a machine running openvpn as client connecting to the public IP of 192.168.0.249. This works so far. The machines can communicate and everything works perfectly. Now I want to allow routing between both LANs. I add a route for 192.168.6.0/24 in the routeing table of 192.168.0.249 and one push for 192.168.0.0/24. Further I add a iroute to the ccd file representing for the corresponding client. [oconf=Server config]tun-mtu 1492 #ca ssl/cacert.pem #cert ssl/vpn.crt #key ssl/hh/vpn_server.key.nopwd ca ssl/hh/ca.crt cert ssl/server.crt key ssl/server.key dh ssl/dhparam.pem cipher AES-256-CBC comp-lzo yes #nobind #client-to-client keepalive 10 60 auth-nocache script-security 2 persist-key persist-tun verb 2 port 1198 server 10.1.21.0 255.255.255.0 mode server tls-server dev tun proto udp user nobody group nobody status /var/log/openvpn-tun-udp-plain.status 2 client-config-dir ccd/tun-udp-plain route 192.168.6.0 255.255.255.0 push "route 10.1.20.0 255.255.255.0" push "route 10.1.21.0 255.255.255.0" push "route 10.1.22.0 255.255.255.0" push "route 192.168.0.0 255.255.255.0 vpn_gateway 50" push "route 192.168.5.0 255.255.255.0 vpn_gateway 50" push "route 192.168.6.0 255.255.255.0 vpn_gateway 50"[/oconf] The CN of the client is assumed to be bpi. [code] # ccd/tun-udp-conf/bpi iroute 192.168.6.0 255.255.255.0 [/code] This should work (like in https://community.openvpn.net/openvpn/wiki/RoutedLans). It works if I give the metrics with a high value. Normally the machine bpi should receive all routes pushed by the server except for the ones configured in the iroute statement. The problem is that the server sends the routes including the 192.168.6.0/24 route [code] # Output of the verbose output of the openvpn command on connecting PUSH_REPLY,route 10.1.20.0 255.255.255.0,route 10.1.21.0 255.255.255.0,route 10.1.22.0 255.255.255.0,route 192.168.0.0 255.255.255.0 vpn_gateway 50,route 192.168.5.0 255.255.255.0 vpn_gateway 50,route 192.168.6.0 255.255.255.0 vpn_gateway 50,route 10.1.21.1,topology net30,ping 10,ping-restart 60,ifconfig 10.1.21.6 10.1.21.5 [/code] As a result if something is working wrong the machine might get problems reaching its own LAN! I have verified in the routing table that the route gets installed: [code] Kernel-IP-Routentabelle Ziel Router Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.6.1 0.0.0.0 UG 0 0 0 eth0 10.1.20.0 10.1.21.9 255.255.255.0 UG 0 0 0 tun1 10.1.21.0 10.1.21.9 255.255.255.0 UG 0 0 0 tun1 10.1.21.1 10.1.21.9 255.255.255.255 UGH 0 0 0 tun1 10.1.21.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun1 10.1.22.0 10.1.21.9 255.255.255.0 UG 0 0 0 tun1 192.168.0.0 10.1.21.9 255.255.255.0 UG 50 0 0 tun1 192.168.5.0 10.1.21.9 255.255.255.0 UG 50 0 0 tun1 192.168.6.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.6.0 10.1.21.9 255.255.255.0 UG 50 0 0 tun1 (

[quote="clupus"]client-config-dir ccd/tun-udp-[b]plain[/b][/quote][quote="clupus"]# ccd/tun-udp-[b]conf[/b]/bpi iroute 192.168.6.0 255.255.255.0[/quote] :mrgreen: Also, See [b]--ccd-exclusive[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url]

Hello, [quote="TinCanTech"][quote="clupus"]client-config-dir ccd/tun-udp-[b]plain[/b][/quote][quote="clupus"]# ccd/tun-udp-[b]conf[/b]/bpi iroute 192.168.6.0 255.255.255.0[/quote] :mrgreen: [/quote] I am sorry. I misspelled in my post. The file exists in both ccd/tun-udp and ccd/tun-udp-plain. It was configured to be used in the tun-udp configuration but I changed to the plain version (which is another instance on another port with some minor configuration modifications). [quote="TinCanTech"]Also, See [b]--ccd-exclusive[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url][/quote] I would like to avoid ccd-exclusive. There are also some clients that can connect to the server that should simply been allowed to connect without prior registration by creating an empty ccd file. But it was a backup solution to force things. One more information: I have the statistics activated for the server. In this file the internal routing table of openvpn is listed. The 192.168.6.0/24 net is listed there. Thus the iroute command must have been read successfully. Otherwise openvpn could not have known of the IP. Thanks Chris

Openvpn sends route although iroute present

clupus

Hello to everyone,

I have the following problem (simplified): I have two LANs (192.168.0.0/24 and 192.168.6.0/24). The machine 192.168.0.249 is present in the internet with a public IP and has a openvpn server running. On 192.168.6.2 there is a machine running openvpn as client connecting to the public IP of 192.168.0.249. This works so far. The machines can communicate and everything works perfectly.

Now I want to allow routing between both LANs. I add a route for 192.168.6.0/24 in the routeing table of 192.168.0.249 and one push for 192.168.0.0/24. Further I add a iroute to the ccd file representing for the corresponding client.
tun-mtu 1492

#ca ssl/cacert.pem
#cert ssl/vpn.crt
#key ssl/hh/vpn_server.key.nopwd

ca ssl/hh/ca.crt

cert ssl/server.crt
key ssl/server.key

dh ssl/dhparam.pem

cipher AES-256-CBC
comp-lzo yes
#nobind

#client-to-client

keepalive 10 60
auth-nocache

script-security 2

persist-key
persist-tun

verb 2
port 1198
server 10.1.21.0 255.255.255.0
mode server
tls-server

dev tun
proto udp

user nobody
group nobody
status /var/log/openvpn-tun-udp-plain.status 2

client-config-dir ccd/tun-udp-plain
route 192.168.6.0 255.255.255.0

push "route 10.1.20.0 255.255.255.0"
push "route 10.1.21.0 255.255.255.0"
push "route 10.1.22.0 255.255.255.0"

push "route 192.168.0.0 255.255.255.0 vpn_gateway 50"
push "route 192.168.5.0 255.255.255.0 vpn_gateway 50"
push "route 192.168.6.0 255.255.255.0 vpn_gateway 50" The CN of the client is assumed to be bpi.

# ccd/tun-udp-conf/bpi
iroute 192.168.6.0 255.255.255.0

This should work (like in https://community.openvpn.net/openvpn/wiki/RoutedLans). It works if I give the metrics with a high value.

Normally the machine bpi should receive all routes pushed by the server except for the ones configured in the iroute statement. The problem is that the server sends the routes including the 192.168.6.0/24 route

# Output of the verbose output of the openvpn command on connecting
PUSH_REPLY,route 10.1.20.0 255.255.255.0,route 10.1.21.0 255.255.255.0,route 10.1.22.0 255.255.255.0,route 192.168.0.0 255.255.255.0 vpn_gateway 50,route 192.168.5.0 255.255.255.0 vpn_gateway 50,route 192.168.6.0 255.255.255.0 vpn_gateway 50,route 10.1.21.1,topology net30,ping 10,ping-restart 60,ifconfig 10.1.21.6 10.1.21.5

As a result if something is working wrong the machine might get problems reaching its own LAN! I have verified in the routing table that the route gets installed:

Kernel-IP-Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.6.1     0.0.0.0         UG    0      0        0 eth0
10.1.20.0       10.1.21.9       255.255.255.0   UG    0      0        0 tun1
10.1.21.0       10.1.21.9       255.255.255.0   UG    0      0        0 tun1
10.1.21.1       10.1.21.9       255.255.255.255 UGH   0      0        0 tun1
10.1.21.9       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.1.22.0       10.1.21.9       255.255.255.0   UG    0      0        0 tun1
192.168.0.0     10.1.21.9       255.255.255.0   UG    50     0        0 tun1
192.168.5.0     10.1.21.9       255.255.255.0   UG    50     0        0 tun1
192.168.6.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.6.0     10.1.21.9       255.255.255.0   UG    50     0        0 tun1 (<- This will lead to problems)

Can you tell me, if there is/was a bug in openvpn resulting in similar errors? Or do you see something I am doing wrong?

The version of the openvpn server is 2.3.12 and the client is 2.3.4.

Thank you very much
Christian

TinCanTech

clupus wroteclient-config-dir ccd/tun-udp-plain

clupus wrote# ccd/tun-udp-conf/bpi
iroute 192.168.6.0 255.255.255.0

:mrgreen:

Also, See --ccd-exclusive in The Manual v23x

clupus

Hello,

TinCanTech wrote
clupus wroteclient-config-dir ccd/tun-udp-plain
clupus wrote# ccd/tun-udp-conf/bpi
iroute 192.168.6.0 255.255.255.0
:mrgreen:

I am sorry. I misspelled in my post. The file exists in both ccd/tun-udp and ccd/tun-udp-plain. It was configured to be used in the tun-udp configuration but I changed to the plain version (which is another instance on another port with some minor configuration modifications).

TinCanTech wroteAlso, See --ccd-exclusive in The Manual v23x

I would like to avoid ccd-exclusive. There are also some clients that can connect to the server that should simply been allowed to connect without prior registration by creating an empty ccd file. But it was a backup solution to force things.

One more information: I have the statistics activated for the server. In this file the internal routing table of openvpn is listed. The 192.168.6.0/24 net is listed there. Thus the iroute command must have been read successfully. Otherwise openvpn could not have known of the IP.

Thanks
Chris