Route Gateways not correct

radokristof

Dear Community!

I would need a little help in my config. I have several clients each exposing it's subnet to VPN. Everything works correctly, however the route list is not correct.

0.0.0.0         <IPADDR>   0.0.0.0         UG    0      0        0 eth0
10.0.0.0        192.168.0.2     255.255.255.0   UG    0      0        0 tun0
10.0.1.0        192.168.0.2     255.255.255.0   UG    0      0        0 tun0
10.0.2.0        192.168.0.2     255.255.255.0   UG    0      0        0 tun0
10.0.3.0        192.168.0.2     255.255.255.0   UG    0      0        0 tun0

Each gateway is 0.2, however they should be different, 10.0.2.0 should have 0.3 gateway, etc.. because they are different clients.
Oddly, traceroute shows correct route.

traceroute 10.0.2.2
traceroute to 10.0.2.2 (10.0.2.2), 30 hops max, 60 byte packets
 1  192.168.0.3 (192.168.0.3)  46.917 ms  104.479 ms  104.456 ms
 2  10.0.2.2 (10.0.2.2)  104.426 ms  104.395 ms  104.366 ms

Each client has it's own client-config in the ccd/ folder, similar to this:

ifconfig-push 192.168.0.2 255.255.255.0
iroute 10.0.1.0 255.255.255.0

port 1194

proto tcp

dev tun

ca ca.crt
cert cert.crt
key key.key

dh dh.pem

topology subnet

server 192.168.0.0 255.255.255.0

ifconfig-pool-persist /var/log/openvpn/ipp.txt

;push "route 192.168.0.0 255.255.255.0"
;push "route 10.0.0.0 255.255.0.0"

client-config-dir ccd
route 10.0.1.0 255.255.255.0
route 10.0.2.0 255.255.255.0
route 10.0.3.0 255.255.255.0
route 10.0.0.0 255.255.255.0

route 192.168.0.2 255.255.255.0
route 192.168.0.3 255.255.255.0
route 192.168.0.5 255.255.255.0
route 192.168.0.10 255.255.255.0

keepalive 10 120

cipher AES-256-CBC
auth SHA1

max-clients 100

user nobody
group nogroup

persist-key
persist-tun

status /var/log/openvpn/openvpn-status.log

log-append /var/log/openvpn/openvpn.log

verb 3

;mute 20

explicit-exit-notify 0

crl-verify crl.pem

client

dev tun

proto tcp

remote server.domain 1194

resolv-retry infinite

nobind

user nobody
group nogroup

persist-key
persist-tun

ca ca.crt
cert client.crt
key client.key

remote-cert-tls server

cipher AES-256-CBC
auth SHA1

verb 3

route 10.0.0.0 255.255.0.0

<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----
</key>

TinCanTech

radokristof wrote Everything works correctly, however the route list is not correct

No .. the list is correct, that is why it works. The gateway is from openvpn server point of view.

radokristof

TinCanTech wrote
radokristof wrote Everything works correctly, however the route list is not correct
No .. the list is correct, that is why it works. The gateway is from openvpn server point of view.

Well, the address of the tun0 interface is 192.168.0.1, so why the gateway is 192.168.0.2?

192.168.0.2 is reserved for one of the clients. That's why I'm confused.
Also why I need to add routes there for every vpn client IP (like 192.168.0.3)? It seemed that it won't work without it.

TinCanTech

radokristof wrote the address of the tun0 interface is 192.168.0.1, so why the gateway is 192.168.0.2?

Because this is openvpn and not a real network, that is what the server sees.

radokristof wrote why I need to add routes there for every vpn client IP (like 192.168.0.3)? It seemed that it won't work without it.

You don't need to add those routes and, infact, the routes you are adding are incorrect.

You should read your log with verb 4 set in the config.

https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

radokristof

Ok, thanks for your help! It seems that my initial config was correct (before I shared this one), without adding these routes explicitly, but I don't know why it didn't worked for first. Now it seems that everything works as it should.
Thanks!