Kernel Route for multiple Server Processes with LAN to LAN Connections

michael.uray

Hi guys,

I have a couple LANs to connect via a VPN server (OpenVPN 2.4.1) in the middle.

On this server I have to run multiple VPN server processes for different configurations (MTU problems on some clients) as well as for CPU load balancing on a multi-core CPU.

So far so good, but now I have the problem, that each time when a client with the LAN subnet 10.1.x.x/24 connects to a server process that I also have to announce this route to the according tunx adapter to the kernel.
Before that I had just one process running and so I had just one route (10.1.0.0/16) in the server configuration.

The problem is that the route needs to get added and removed depending on that to which process the according client connects, what may differ from each connection to the other.

So far as I have seen is it not possible to run this route command for the kernel via a CCD directive, what would be the preferred option.

Is there any solution for this scenario?

Best wishes
Michael

TinCanTech

michael.uray wrotewhen a client with the LAN subnet 10.1.x.x/24 connects to a server process that I also have to announce this route to the according tunx adapter to the kernel

--client-connect & --client-disconnect script ..

michael.uray

TinCanTech wrote--client-connect & --client-disconnect script ..

Yea thanks, I have tried something like this.
Now I am having the problem that when the client does a re-connect and the server does not recognize that the client is disconnected, the new client connection tries to add another route (what does not work "SIOCADDRT: File exists" because there already exists one) what is so far not a problem, but a bit later the server get into a timeout from the first client connection and removes the route again.

Pippin

Have you tried --explicit-exit-notify ?

michael.uray

Pippin wroteHave you tried --explicit-exit-notify ?

Yes, unfortunately is it not supported on some clients (OpenWRT).

TinCanTech

What version of OpenVPN is in use on OpenWRT ?

michael.uray

TinCanTech wroteWhat version of OpenVPN is in use on OpenWRT ?

I use a couple different versions, but this is the current version which I use for new devices as well as for my testing device which throws the error "Unrecognized option":

OpenWRT Chaos Calmer (15.05.1, r48532)
OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 31 2016
library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08

I guess it is just not compiled with this option.

TinCanTech

Pippin wroteHave you tried --explicit-exit-notify ?

michael.uray wroteYes, unfortunately is it not supported on some clients (OpenWRT).

TinCanTech wroteWhat version of OpenVPN is in use on OpenWRT ?

michael.uray wroteOpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 31 2016
library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08

michael.uray wroteI guess it is just not compiled with this option.

I guess ..

It feels a bit heavy handed to remove an option which is key to successfully managing a VPN.
--explicit-exit-notify has been a standard option since 2005.04.17 -- Version 2.0

https://github.com/OpenVPN/openvpn/blob/release/2.3/ChangeLog#L2838
https://github.com/OpenVPN/openvpn/blob/release/2.3/ChangeLog#L3453

Perhaps you can contact openwrt developers.