So I'm trying to get network-manager-openvpn-gnome working with my OpenVPN (2.4.5) server on Ubuntu 17.10 / 18.04. I've given up on this with older distros due to them not being able to import the ovpn config if it contains some of the newer OpenVPN features however with 17.10+, I can import without issue, the tunnel connects and actually routes traffic. The problem is receiving the response of my tunneled request. For example, I'll generate TCP traffic from the client (wget or telnet) while logging it with on the receiving end (tcpdump / nginx access logs) and I can see the request coming across on the public tunnel IP, nginx will send the response (fresh install so it's sending back 200 - Welcome to nginx!) but the client never receives it. After taking a look at the routing table generated by NetworkManager (see below), I'm noticing that it has two default routes which is most likely the issue. I've tried manually editing the routing table just to see if I could get it working but from what I read, NetworkManager is actively monitoring it and will reverse any conflicting change you make.
Question: Does anyone know if there's anything I can push to the client or add to the client config to fix the routing issue?
This ovpn config works fine if passed directly to /usr/sbin/openvpn and has been tested on Win10, macOS, Arch Linux (networkmanager 1.10.5, networkmanager-openvpn 1.8.1) and other Linux distros using the Pritunl client. I've also included the command which NetworkManager runs to start the tunnel (output from ps aux | grep openvpn) and noticed there's a blank flag/argument in between --tun and --up-restart, not sure if this is related.
server.conf
local 111.222.333.444
port 1194
proto udp
dev ovpn-tun
dev-type tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 172.31.200.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/server/ipp.txt
client-config-dir /etc/openvpn/server/ccd
crl-verify /etc/openvpn/server/crl.pem
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/crt_server.crt
key /etc/openvpn/server/key_server.key
dh none
verb 3
compress lz4-v2
auth SHA512
tls-crypt /etc/openvpn/server/ta.key
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
cipher AES-256-GCM
log-append /var/log/openvpn/server.log
status /var/log/openvpn/server-status.log 10
status-version 2
ccd/client
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client.ovpn
client
dev tun
remote 111.222.333.444 1194 udp
resolv-retry infinite
nobind
persist-key
persist-tun
compress lz4-v2
auth SHA512
auth-nocache
cipher AES-256-GCM
remote-cert-tls server
verb 3
route-delay 2
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-crypt>
OpenVPN client command
/usr/sbin/openvpn
--remote 111.222.333.444 1194 udp
--nobind
--dev tun
--cipher AES-256-GCM
--auth SHA512
--auth-nocache
--tls-crypt /home/username/.cert/nm-openvpn/client-tls-crypt.pem
--remote-cert-tls server
--reneg-sec 0
--verb 1
--syslog nm-openvpn
--script-security 2
--up /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper
--debug 0 1958
--bus-name org.freedesktop.NetworkManager.openvpn.Connection_4
--tun
--
--up-restart
--persist-key
--persist-tun
--management /var/run/NetworkManager/nm-openvpn-d47376a2-75e6-44e8-99f9-016eb4b448d0 unix
--management-client-user root
--management-client-group root
--management-query-passwords
--auth-retry interact
--route-noexec
--ifconfig-noexec
--client
--ca /home/username/.cert/nm-openvpn/client-ca.pem
--cert /home/username/.cert/nm-openvpn/client-cert.pem
--key /home/username/.cert/nm-openvpn/client-key.pem
--user nm-openvpn
--group nm-openvpn
--chroot /var/lib/openvpn/chroot
Routing generated by NetworkManager
root@ubuntu:/home/user# ip route
default via 172.31.200.1 dev tun0 proto static metric 50
default via 192.168.19.2 dev ens33 proto static metric 100
111.222.333.444 via 192.168.19.2 dev ens33 proto static metric 100
169.254.0.0/16 dev ens33 scope link metric 1000
172.31.200.0/24 dev tun0 proto kernel scope link src 172.31.200.2 metric 50
192.168.19.0/24 dev ens33 proto kernel scope link src 192.168.19.135 metric 100
192.168.19.2 dev ens33 proto static scope link metric 100
root@ubuntu:/home/user# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 172.31.200.1 0.0.0.0 UG 0 0 0 tun0
0.0.0.0 192.168.19.2 0.0.0.0 UG 0 0 0 ens33
111.222.333.444 192.168.19.2 255.255.255.255 UGH 0 0 0 ens33
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 ens33
172.31.200.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.19.0 0.0.0.0 255.255.255.0 U 0 0 0 ens33
192.168.19.2 0.0.0.0 255.255.255.255 UH 0 0 0 ens33
