Hi there,
i have a question regarding the OpenVPN Client config.
But first some words regarding my network setup. My OpenVPN Server is connected to the internet via a DS-Lite Broadband connection.
In a perfect world that would be no issue because there every connection would also provide IPv6. But here in Germany we are far away from that, so if i connect via my mobile Phone (Vodafone) i only get a IPv4 address.
So i have a dualstack server setup where IPv4 Clients can connect via TCP (via my own Portmapper) to the Server, IPv6 Clients can connect directly via UDP.
That works really good, there is only one thing that bothers me. Now i have to have two config files for the client, one for the IPv4 Server and one for the IPv6 Server.
I tried a config file where both remote Server are included which looks like this:
client
dev tun
remote home.xxxx.xxx 1194 udp6
remote home.xxxx.xxx 1194 tcp
resolv-retry 0
nobind
persist-key
persist-tun
verb 1
keepalive 10 120
comp-lzo no
cipher AES-256-CBC
auth SHA512
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
xxxx
-----END OpenVPN Static key V1-----
</tls-auth>
<ca>
-----BEGIN CERTIFICATE-----
xxxx
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
xxxx
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
xxxxx
-----END RSA PRIVATE KEY-----
</key>
When i try to connect to with this config (using an IPv4 only network) i get the following failure (Client OS is Mac OS):
Thu Apr 5 19:37:09 2018 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Mar 27 2018
Thu Apr 5 19:37:09 2018 library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
Thu Apr 5 19:37:09 2018 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 5 19:37:09 2018 TCP/UDP: Preserving recently used remote address: [AF_INET6]2a02:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:1194
Thu Apr 5 19:37:09 2018 UDPv6 link local: (not bound)
Thu Apr 5 19:37:09 2018 UDPv6 link remote: [AF_INET6]2a02:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:1194
Thu Apr 5 19:37:09 2018 write UDPv6: No route to host (code=65)
Thu Apr 5 19:37:11 2018 write UDPv6: No route to host (code=65)
The failure is pretty clear, when there is no IPv6 he cannot find the route to the host.
First thing that bothers me is that OpenVPN seemed to have cached the last Server IPv6 address and uses it even if there is no IPv6 connectivity.
What i expected would be that OpenVPN recognizes this failure und tries the second remote host what is the IPv4 one.
But that does not happen.
Have i missed something in my config, or is what i try to do simply not possible?
