Hello, I am using OpenVPN to establish a tunnel from a router behind NAT to a server in a datacenter. After a LAN outage on the client side, the tunnel fails to recover. I noted that the route to the OpenVPN server is missing. The route being missing makes sense to me. My question is: how can I ensure that the route is restored. Here is what I understand: [list]When the tunnel is started, OpenVPN adds a /32 route to the OpenVPN server via the WAN gateway, so that packets to the OpenVPN server bypass the tunnel.[/list] [list]When the WAN link fails (port goes down), the router withdraws the routes via that port.[/list] [list]When the WAN link recovers (port comes up), the router does [u]not[/u] automatically restore the routes that it had removed.[/list] The WAN port gets its address from DHCP. Thus I cannot add a static route to the OpenVPN server. Is there a way to configure OpenVPN to restore the route when it recovers the tunnel. Or is there a scripting hook for reestablishing the tunnel, so that I can add the route via a script? OpenVPN 2.4.0 Ubiquiti EdgeRouter 2.0.6 (Debian based) Thanks... Roger

[quote=rwf post_id=91694 time=1588897236 user_id=45133] I guess I did not express myself correctly. [/quote]See: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963 [quote=rwf post_id=91694 time=1588897236 user_id=45133] I hope this makes more sense [/quote]So your router behaves incorrectly ? [quote=rwf post_id=91694 time=1588897236 user_id=45133] It is that last route that is the problem [/quote]When the client times out --redirect-gateway routing is torn down.

Restore route to server after link outage

rwf

Hello,

I am using OpenVPN to establish a tunnel from a router behind NAT to a server in a datacenter. After a LAN outage on the client side, the tunnel fails to recover. I noted that the route to the OpenVPN server is missing.

The route being missing makes sense to me. My question is: how can I ensure that the route is restored.

Here is what I understand:

When the tunnel is started, OpenVPN adds a /32 route to the OpenVPN server via the WAN gateway, so that packets to the OpenVPN server bypass the tunnel.

When the WAN link fails (port goes down), the router withdraws the routes via that port.

When the WAN link recovers (port comes up), the router does not automatically restore the routes that it had removed.

The WAN port gets its address from DHCP. Thus I cannot add a static route to the OpenVPN server.

Is there a way to configure OpenVPN to restore the route when it recovers the tunnel.

Or is there a scripting hook for reestablishing the tunnel, so that I can add the route via a script?

OpenVPN 2.4.0
Ubiquiti EdgeRouter 2.0.6 (Debian based)

Thanks...

Roger

TinCanTech

A client does not need a route to a server, that is not how the internet works.

rwf

I guess I did not express myself correctly.

The OpenVPN client on the router directs all traffic through the tunnel. I am using

push "redirect-gateway def1"

on the OpenVPN server side to do that.

This causes the OpenVPN client to create the following two routes:

0.0.0.0/1 via <tunnel-gw>

128.0.0.0/1 via <tunnel-gw>

But with that the UDP package between the OpenVPN client and the OpenVPN server will be directed to the tunnel. That is obviously wrong. So the OpenVPN client creates one more route:

<openvpn-server-pub-addr> via <gateway>

It is that last route that is the problem.

When the port the gateway is connected to goes down, the edge router (that the OpenVPN client runs on) loses the route.

I hope this makes more sense.

TinCanTech

rwf wrote I guess I did not express myself correctly.

See: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

rwf wrote I hope this makes more sense

So your router behaves incorrectly ?

rwf wrote It is that last route that is the problem

When the client times out --redirect-gateway routing is torn down.

rwf

So your router behaves incorrectly ?

I think so, but that is a matter of opinion. Ubuntu 16.04 does the same (remove the route, but not add it back).

When the client times out --redirect-gateway routing is torn down.

Then the client does not seem to time out, because the 2 default routes are still there.
0.0.0.0/1 via 10.0.14.1 dev vtun0
128.0.0.0/1 via 10.0.14.1 dev vtun0

I have the following logs on hand (both routers are remote, and also need reconfig for log level 4).

May  4 11:46:26 client-router openvpn[1888]: [server-router] Inactivity timeout (--ping-restart), restarting
May  4 11:46:26 client-router openvpn[1888]: TCP/UDP: Closing socket
May  4 11:46:26 client-router openvpn[1888]: SIGUSR1[soft,ping-restart] received, process restarting
May  4 11:46:26 client-router openvpn[1888]: Restart pause, 2 second(s)

Is that a client timeout?

TinCanTech

rwf wrote
So your router behaves incorrectly ?
I think so, but that is a matter of opinion. Ubuntu 16.04 does the same (remove the route, but not add it back).

You are probably referring to Network-Manager .. which we don't encourage the use of ..

rwf wrote
When the client times out --redirect-gateway routing is torn down.
Then the client does not seem to time out, because the 2 default routes are still there.
0.0.0.0/1 via 10.0.14.1 dev vtun0
128.0.0.0/1 via 10.0.14.1 dev vtun0

They should be gone at timeout.

rwf wrote I have the following logs on hand (both routers are remote, and also need reconfig for log level 4).

May  4 11:46:26 client-router openvpn[1888]: [server-router] Inactivity timeout (--ping-restart), restarting
May  4 11:46:26 client-router openvpn[1888]: TCP/UDP: Closing socket
May  4 11:46:26 client-router openvpn[1888]: SIGUSR1[soft,ping-restart] received, process restarting
May  4 11:46:26 client-router openvpn[1888]: Restart pause, 2 second(s)

Is that a client timeout?

That is a timeout.

Make this easy on yourself and read this:

TinCanTech wrote
rwf wrote I guess I did not express myself correctly.
See: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963