iroute question

m_emelchenkov

Hello,

I have a scheme with 5 servers:

Client-1, Client-2 <--> Gateway-1 <--> Remote-1, Remote-2

Client-1, Client-2 uses Remote-1 and Remote-2 as Internet Gateways.
On Remote-1, Remote-2 I NAT all traffic from tun0.
On Gateway-1 I use policy-based routing with ip rules, i.e.:

ip rule add pri 1 from 10.8.8.1 (it is Client-1 address) lookup 1
ip route add default via 10.8.4.1 (it is Remote-1 address) table 1

The same for second client. It works. The problem is in "iroute"s. On Gateway-1 I set (in /etc/openvpn/ccd) for Remote-1 and Remote-2 list of iroute to accept all traffic 0.0.0.0/0.

While only Remote-1 is connected, I have no issues. When Remote-2 connects, OpenVPN "overrides" iroutes defined for Remote-1 and now all traffic pass to Remote-2, despite Linux kernel rule-defined gateway. In other words, OpenVPN ignores linux routing and do it on its own, based on the latest connected client which pass iroutes for 0.0.0.0/0. Everything Remote-1 accepted now accepted exclusively by Remote-2.

client-to-client option is disabled. How to disable internal OpenVPN routing, preventing OpenVPN be so smart and just accept traffic for client based on its Linux routing gateway, not on its internal ideas of what IPs are related to each client?

TinCanTech

m_emelchenkov wrote How to disable internal OpenVPN routing

Do not use --iroute

m_emelchenkov

TinCanTech wrote
m_emelchenkov wrote How to disable internal OpenVPN routing
Do not use --iroute

Without it traffic does not reach Remote-1.

TinCanTech

m_emelchenkov wrote Without it traffic does not reach Remote-1

Then you must use it ..

m_emelchenkov wrote preventing OpenVPN be so smart and just accept traffic for client based on its Linux routing gateway

The kernel has already made it's routing decision and sent the packet on it's way. It is the the job of openvpn to route the packet "internally" to the correct client .. which the kernel does not have anything to do with.

m_emelchenkov

How then to use policy-based routing inside OpenVPN? Traffic from 10.8.8.1 should be passed via 10.8.4.1, from 10.8.8.2 via 10.8.4.2. How to achieve it?

TinCanTech

m_emelchenkov wrote How then to use policy-based routing inside OpenVPN?

You can not. That is why it is called an "Internal" route .. it has nothing to do with the kernel ..

m_emelchenkov

I faced with a task which could not be solved with a single instance of OpenVPN server. Current OpenVPN internal routing is limited and does not contains any instructions for policy-based routing, it is a "plain old" route technology. I should run one more server instance, then 0.0.0.0/0 routing will works for each Remote client correctly, because it will be the only internal routing on each server instance.

The topic can be closed, thank you TinCanTech.