[solved] server pushing wrong gateway to client

Anonymous

openvpn 2.4.6 tun on gentoo with netifrc

server conf
local 172.25.120.2
server 172.25.121.0 255.255.255.0
route-gateway 172.25.120.1
topology subnet
client-to-client
route 172.25.0.0 255.255.0.0
route 172.23.0.0 255.255.0.0
route 172.24.0.0 255.255.0.0
route 172.27.0.0 255.255.0.0
route 172.30.0.0 255.255.0.0
push "route 172.25.0.0 255.255.0.0"
push "route 172.23.0.0 255.255.0.0"
push "route 172.24.0.0 255.255.0.0"
push "route 172.27.0.0 255.255.0.0"
push "route 172.30.0.0 255.255.0.0"

server log

ROUTE_GATEWAY 172.25.120.1/255.255.255.0 IFACE=eth0 HWADDR=00:16:3e:88:b0:c5
TUN/TAP device tun0 opened
/bin/ifconfig tun0 172.25.121.1 netmask 255.255.255.0 mtu 9000 broadcast 172.25.121.255
/bin/route add -net 172.25.0.0 netmask 255.255.0.0 gw 172.25.120.1
/bin/route add -net 172.23.0.0 netmask 255.255.0.0 gw 172.25.120.1
/bin/route add -net 172.24.0.0 netmask 255.255.0.0 gw 172.25.120.1
/bin/route add -net 172.27.0.0 netmask 255.255.0.0 gw 172.25.120.1
/bin/route add -net 172.30.0.0 netmask 255.255.0.0 gw 172.25.120.1
UDPv4 link local (bound): [AF_INET]172.25.120.2:61023
IFCONFIG POOL: base=172.25.121.2 size=252, ipv6=0
IFCONFIG POOL LIST

ip r

default via 172.25.120.1 dev eth0 metric 47
172.23.0.0/16 via 172.25.120.1 dev eth0
172.24.0.0/16 via 172.25.120.1 dev eth0
172.25.0.0/16 via 172.25.120.1 dev eth0
172.25.120.0/24 dev eth0 proto kernel scope link src 172.25.120.2
172.25.121.0/24 dev tun0 proto kernel scope link src 172.25.121.1
172.27.0.0/16 via 172.25.120.1 dev eth0
172.30.0.0/16 via 172.25.120.1 dev eth0

Thus far thus good, I reckon. Targets at the subnets are reachable via icmp.

However, when a client connects openvpn is pusing the wrong gateway to the client, for reasons inexplicable to me. The routing tables at the server are unchanged after client connect, as one would expect.

server log

[obfuscted]:61023 MULTI_sva: pool returned IPv4=172.25.121.2, IPv6=(Not enabled)
[obfuscted]:61023 MULTI: Learn: 172.25.121.2 -> [obfuscted]:61023
[obfuscted]:61023 MULTI: primary virtual IP for [obfuscted]:61023: 172.25.121.2
[obfuscted]:61023 PUSH: Received control message: 'PUSH_REQUEST'
[obfuscted]:61023 SENT CONTROL [TO Router]: 'PUSH_REPLY,route 172.25.0.0 255.255.0.0,route 172.23.0.0 255.255.0.0,route 172.24.0.0 255.255.0.0,route 172.27.0.0 255.255.0.0,route 172.30.0.0 255.255.0.0,route-gateway 172.25.121.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.25.121.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)

client log

[OVPN Server] Peer Connection Initiated with [AF_INET][obfuscated]:61023
SENT CONTROL [OVPN Server]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,route 172.25.0.0 255.255.0.0,route 172.23.0.0 255.255.0.0,route 172.24.0.0 255.255.0.0,route 172.27.0.0 255.255.0.0,route 172.30.0.0 255.255.0.0,route-gateway 172.25.121.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.25.121.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
OPTIONS IMPORT: route-related options modified
TUN/TAP device tun0 opened
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/sbin/ifconfig tun0 172.25.121.2 netmask 255.255.255.0 mtu 9000 broadcast 172.25.121.255
/sbin/route add -net 172.25.0.0 netmask 255.255.0.0 gw 172.25.121.1
/sbin/route add -net 172.23.0.0 netmask 255.255.0.0 gw 172.25.121.1
/sbin/route add -net 172.24.0.0 netmask 255.255.0.0 gw 172.25.121.1
/sbin/route add -net 172.27.0.0 netmask 255.255.0.0 gw 172.25.121.1
/sbin/route add -net 172.30.0.0 netmask 255.255.0.0 gw 172.25.121.1

And sure the client's routing tables are wrong

172.23.0.0/16 via 172.25.121.1 dev tun0
172.24.0.0/16 via 172.25.121.1 dev tun0
172.25.0.0/16 via 172.25.121.1 dev tun0
172.25.121.0/24 dev tun0 proto kernel scope link src 172.25.121.2
172.27.0.0/16 via 172.25.121.1 dev tun0
172.30.0.0/16 via 172.25.121.1 dev tun0

TinCanTech

The helper directive --server over writes your --route-gateway.

Your --route-gateway is also incorrect and the one set by --server is correct.

See --server in The Manual v24x

Anonymous

TinCanTech wrote The helper directive --server over writes your --route-gateway.

That is not apparent from the man pages. Instead

--route-gateway gw|'dhcp'
Specify a default gateway gw for use with --route

leaves the impression that such is rather specific. What is the purpose of it then when being supseded by --server anyway?

TinCanTech wrote Your --route-gateway is also incorrect and the one set by --server is correct.

That gateway is correct since openvpn runs inside a lxc container and 172.25.120.1 is the gateway for the container towards the host.

With

server 172.25.121.0 255.255.255.0

openvpn than assigns 172.25.120.1 to the tun iface which it should not happen as already assigned to another iface (bridge on the host). And the openvpn pool starts at 172.25.120.2 which is another ip already assigned to another iface.

Seems a bit of a conundrum or what I am missing?

Anonymous

Almost sorted with

server 172.25.120.0 255.255.255.0 nopool
ifconfig-pool 172.25.120.3 172.25.120.30 255.255.255.0
route 172.25.0.0 255.255.0.0 172.25.120.1
route 172.23.0.0 255.255.0.0 172.25.120.1
route 172.24.0.0 255.255.0.0 172.25.120.1
route 172.27.0.0 255.255.0.0 172.25.120.1
route 172.30.0.0 255.255.0.0 172.25.120.1
push "route 172.25.0.0 255.255.0.0 172.25.120.1"
push "route 172.23.0.0 255.255.0.0 172.25.120.1"
push "route 172.24.0.0 255.255.0.0 172.25.120.1"
push "route 172.27.0.0 255.255.0.0 172.25.120.1"
push "route 172.30.0.0 255.255.0.0 172.25.120.1"

What remains is that the server itself takes the ".1" address of the given network, which is should not but rather 172.25.120.3.

TinCanTech

n8v8r wrote That is not apparent from the man pages

Which is why there is a Forum and mailing lists ..

n8v8r wrote What is the purpose of it then when being supseded by --server anyway?

The --server directive implements a number of settings so that the user does not have to learn everything.

n8v8r wrote That gateway is correct since openvpn runs inside a lxc container and 172.25.120.1 is the gateway for the container towards the host

The route gateway for the server is fine .. but you are pushing route-gatewway to the client, which is not the same.

You do not need to push a route gateway to the client because --server does that for you.

Anonymous

TinCanTech wrote Which is why there is a Forum and mailing lists ..

Sure, it is appreciated but reckon to make it more clear in the man pages would not do any harm either

TinCanTech wrote The route gateway for the server is fine .. but you are pushing route-gatewway to the client, which is not the same.
You do not need to push a route gateway to the client because --server does that for you.

Got it and almost sorted, except - as stated in the post previous to this - the issue with the server itself taking the ".1" address of the given network.
As with [oconf=]ifconfig-pool 172.25.120.3 172.25.120.30 255.255.255.0[/oconf] I would need it to be taking 172.25.120.3 rather. The man pages are somewhat ominous

if dev tap OR (dev tun AND topology == subnet):
ifconfig 10.8.0.1 255.255.255.0
if !nopool:
ifconfig-pool 10.8.0.2 10.8.0.253 255.255.255.0
push "route-gateway 10.8.0.1"
if route-gateway unset:
route-gateway 10.8.0.2

How is

route-gateway unset

to by syntaxed?

Anonymous

tried

server 172.25.120.0 255.255.255.0 nopool
ifconfig-pool 172.25.120.3 172.25.120.30 255.255.255.0
ifconfig 172.25.120.3 172.25.120.2

but the server still assigns itself 172.25.120.1

TinCanTech

n8v8r wrote but the server still assigns itself 172.25.120.1

You mean --server 172.25.121.0 255.255.255.0 .. assigns 172.25.121.1 to the server.

The server always sets itself as the first host in what ever subnet you specify.
That is if you use --server, you can set it up manually if you prefer. (Please don't ask me about that)
--

n8v8r wrote if dev tap OR (dev tun AND topology == subnet):
ifconfig 10.8.0.1 255.255.255.0
if !nopool:
ifconfig-pool 10.8.0.2 10.8.0.253 255.255.255.0
push "route-gateway 10.8.0.1"
if route-gateway unset:
route-gateway 10.8.0.2

This is the server route gateway to the VPN subnet not a pushed route gateway to the clients.
--

n8v8r wrote reckon to make it more clear in the man pages would not do any harm

Somebody has to maintain that code and Openvpn is free ..

Openvpn is also open to all .. so you can help improve things by contributing. 8-)

If you only use the --server directive your routing will be setup correctly, try it .. :mrgreen:

Anonymous

TinCanTech wrote The server always sets itself as the first host in what ever subnet you specify.
That is if you use --server, you can set it up manually if you prefer. (Please don't ask me about that)

That is how it does

local 172.25.120.2
mode server
tls-server
ifconfig-pool 172.25.120.4 172.25.120.30 255.255.255.0
ifconfig 172.25.120.3 255.255.255.0
route 172.25.0.0 255.255.0.0 172.25.120.1
push "route 172.25.0.0 255.255.0.0 172.25.120.1"

At least for the server side. Now however the client reports

/sbin/ifconfig tun0 172.25.120.3 pointopoint 255.255.255.0 mtu 1500
ifconfig: SIOCSIFDSTADDR: Invalid argument
Linux ifconfig failed: external program exited with error status: 1
Exiting due to fatal error

Sigh, what to do now...

TinCanTech

n8v8r wrote local 172.25.120.2
mode server
tls-server
ifconfig-pool 172.25.120.4 172.25.120.30 255.255.255.0
ifconfig 172.25.120.3 255.255.255.0

The server tunnel IP cannot be within the same subnet as the --local subnet ..

Hence the example: --server 10.8.0.0 255.255.255.0

Otherwise, you may require bridge mode .. but that gets complicated.
https://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html

I advice you to start here:
HOWTO: For OpenVPN Community Edition

n8v8r wrote Sigh, what to do now...

Don't give up now .. Please see:
HOWTO: Request Help ! {2} :twisted:

Anonymous

TinCanTech wrote Otherwise, you may require bridge mode .. but that gets complicated

Been there, done that and just another fail at the last bit, so to speak https://forums.openvpn.net/viewtopic.php?f=6&t=26637
And nothing in the man pages again of to sort it, notwithstanding no input in the forum either

TinCanTech

In two separate threads
reveal your server operating system
you have not .. :ugeek:

( maybe somebody else can see a clue .. :?: )

Please see:
HOWTO: Request Help !

Anonymous

TinCanTech wrote You have not revealed your server operating system in two separate threads ..

Gentoo

Anyway, got it working

local 172.25.120.2
server 172.25.121.0 255.255.255.0
topology subnet
client-to-client
push "route 172.25.0.0 255.255.0.0"
push "route 172.23.0.0 255.255.0.0"
push "route 172.24.0.0 255.255.0.0"
push "route 172.27.0.0 255.255.0.0"
push "route 172.30.0.0 255.255.0.0"

adding nft nat in the lxc container and openvpn clients are able to reach the lxc host

table ip nat {
  chain postrouting {
    type nat hook postrouting priority 100; policy accept;
    meta oif eth0 masquerade
  }
}

TinCanTech

Solved by not configuring the wrong gateway in the first place :mrgreen: